{ "Event": { "published": true, "date": "2023-05-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-16", "timestamp": 1684281782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e5d09be5-017a-43de-8ad4-d95375f64648", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc8af71-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684233779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233779, "uuid": "f2ba980a-c6e5-475c-9273-e315e6757eab", "comment": "Malware payload (SnakeKeylogger)", "value": "991db15c5c2d3e4309efdf07f102f95e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233779, "uuid": "fdced18a-2835-40e8-9bc3-099b0855512b", "comment": "Malware payload (SnakeKeylogger)", "value": "005eb1d8df310f308e9ac99c488ea415174fd9aff3fc875117b056e535d08271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233779, "uuid": "697b267a-8d53-43c2-bbd1-e5b09807def1", "comment": "Malware payload (SnakeKeylogger)", "value": "d6dd62b127b856cdb1d3beb9c7c4beb722deedd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233779, "uuid": "c209327e-06bf-496c-8437-2dcadc582617", "comment": "Malware payload (SnakeKeylogger)", "value": "62bb2445a151a5d40f4fb63182aa3600cfde3945a31d7f267ee8183ed0e351906adab05c38545bc2ce47538662a236ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233779, "uuid": "056961f4-08a2-4228-b7cd-a079dd7c57c1", "value": "T112C4D070609E8780E01FCBB165B8FC72037274F3A9D9C9751B3991C8CE26F546E89A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233779, "uuid": "6f2f7ddf-b6a1-44a7-9848-9afeefe4fa61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233779, "uuid": "ab2b1d5b-ccd5-4a69-80fd-843932246982", "value": "12288:RYCv5qNEkrh8GUrZAgWhHpM36kiNISjea5BsIFqm4o:Toa3frmgoM36RISjeIzio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233779, "uuid": "e31da9be-3663-4221-821a-a173e88991a1", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233779, "uuid": "fa852770-abfd-4488-858d-b15f5f3ed7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233779, "uuid": "9be3d70d-2d38-476f-901c-b978c1407415", "value": "bWvmkyv4OpHFRlv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bfd4f9-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243694, "uuid": "1292fc2f-65b7-44d3-aef0-72055117cb56", "comment": "Malware payload (Quakbot)", "value": "09898f199ab752767454a9073e15282f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243694, "uuid": "fd6ba7a3-2296-49ec-acf0-fa336ea8cccf", "comment": "Malware payload (Quakbot)", "value": "01a8735ace5e349ab46b286cae6658931fca9521f3cc640fe6f03951392a36bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243694, "uuid": "d50229dc-083d-4047-974b-746f8c2bea10", "comment": "Malware payload (Quakbot)", "value": "4d2bdf3e47a39fa418deafe0cbcd1f2f12093347", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243694, "uuid": "a44c3d5d-214f-42f0-8d6a-6cd4e8eaf398", "comment": "Malware payload (Quakbot)", "value": "4366bb7edf08128d1e809cb99ab2eb6afae7144a4542e640d426022b338d93e0dc3457a418f0e20c2518e74c8bc4bc39", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243694, "uuid": "9e4dab94-f007-4942-85bc-0d06f5750ec0", "value": "T17F540DD84F6528714B4B7D327AB0D5A9EB7D0E6482C8968BE49F31B1F1DDA8CC8D1720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243694, "uuid": "3bc07310-5cdb-4f79-92dc-bc96bdeaa616", "value": "3072:8Ra6vwAPaAtU0eUjidy0dI4eiVnXT95gQtNEs6:8Ra6VbU0xjidy0dIPiVnDh0s6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243694, "uuid": "6c8ae624-beb7-448d-a3d7-56a5ff7aa99c", "value": 290924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243694, "uuid": "4d64a97c-b0d8-4dd3-8ff1-e093101b3bef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243694, "uuid": "d494d73b-a73b-473b-82fb-9c7584c5d2c3", "value": "Gnbec.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4c64b6-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233001, "uuid": "d781dfec-86b8-4a98-8ee1-39ea9ce28ce2", "comment": "Malware payload (Mirai)", "value": "6af8eca0af7b59ff4dd8c756c2aee94a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233001, "uuid": "4ffe8fb7-3568-47c7-a534-f2459edd9826", "comment": "Malware payload (Mirai)", "value": "020575a723d66534e194b5a8d3e4f875b45251b9983a51e92c448f60fb70a0be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233001, "uuid": "05401d53-55ac-497b-99b5-0e68feec7807", "comment": "Malware payload (Mirai)", "value": "14cb535e94877af7aa64380ee54016af8c5232b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233001, "uuid": "72b85551-ef97-4bf9-94f6-c3028ee825dd", "comment": "Malware payload (Mirai)", "value": "bf3d5ddbe5f5302d76d631dd59a4b6b55df0c76954efa96ff23179d5609d4bbf2426d296a26d40c41108838b2d4ce566", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233001, "uuid": "827cb1ef-eb0f-4af2-ba21-398b595be2b5", "value": "T1C3530946BC819F05C9D41279FB6E128D3313577CF2EEB3138E14AF28678A92B0A3B555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233001, "uuid": "2d8ba239-3ccc-4b2c-91df-250a31498652", "value": "1536:8AnFPCLjrUqwpmXIipbpaynMpCP4dujryRgHGNkDa50TKJov+uFLcyBC4cwIqicO:ULjnLj9pNMpCP4dujryRgHGNkDa50TKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233001, "uuid": "2e58917b-a8ee-47d0-95fb-5a7c3c5d7400", "value": 62812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233001, "uuid": "27481eb0-31e5-4f12-921a-beb71a7303c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233001, "uuid": "504a633a-3fd9-4093-8586-dc52047fef85", "value": "6af8eca0af7b59ff4dd8c756c2aee94a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2a9684-f3e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241856, "uuid": "e981b43d-e2e8-4697-aa12-a6fe4fa7149d", "comment": "Malware payload (Mirai)", "value": "229a3a3478fe2930aeed1466e8d2e45a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241856, "uuid": "200eb646-0c72-463d-8141-bb6edb90fa96", "comment": "Malware payload (Mirai)", "value": "022764be29e77147c73ba51bc29e6ba192c6781438d6f7283822106131634faa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241856, "uuid": "237171a8-29c6-48cc-ba43-0c8e0e07445c", "comment": "Malware payload (Mirai)", "value": "e6a00cf7121c8b6a862a721dcf0080bfbae06ef8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241856, "uuid": "f8b837bd-457d-4b87-910c-4e7b4e25b8ad", "comment": "Malware payload (Mirai)", "value": "1960019dfe3063d1f4ec21796a615f7a2095c74a35546d7634c250276e9b2b45ce0947946a64e5f263b38ba94668d32c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241856, "uuid": "1868202b-25af-4d79-8f39-6dfc57aa4b2f", "value": "T1FB83A51E7E218FADF76D823147B74E25A69833C627E1D642E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241856, "uuid": "494cb43f-762b-4313-8a53-f80585cea37b", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deyLYwHuRHI0I4EH6gTY97ZDYovZ73x/nL8y8s:Rakdn2Eo3eQaV6TY9RYo99Be037W0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241856, "uuid": "d0cc8e6d-4b65-4073-bde2-b6814ca6f98c", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241856, "uuid": "8c1c83da-5b64-4954-8c75-7ae1b82f1625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241856, "uuid": "abbd7179-4297-49b2-8170-6b59ec1162e9", "value": "229a3a3478fe2930aeed1466e8d2e45a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bf0f27-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684235431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235431, "uuid": "9e91ca7d-b0af-4bb0-b533-e97bf4bf37eb", "comment": "Malware payload (RedLineStealer)", "value": "b13683af42a46f81c9fee9a52523864b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235431, "uuid": "8d8748cb-521b-4ee0-841d-db18b210f723", "comment": "Malware payload (RedLineStealer)", "value": "03221e1e8cb4bbe0594ba17812cb173f93e6bb7d83438e7aa4aae5a9fcc026c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235431, "uuid": "b6fe331d-b958-4de5-87ff-a8478d53f89e", "comment": "Malware payload (RedLineStealer)", "value": "add174a1256aebf7d59341378865717b2dd7e53d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235431, "uuid": "e91fb5d0-7a0a-447a-94d2-53e36731989e", "comment": "Malware payload (RedLineStealer)", "value": "ca92cb544c7a7554726000f3cdaff956e773bcb5d09ebcade2b9590212851b65873a9ec61a0f9bbb910e96a5b1f84fcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235431, "uuid": "7ca57255-b4c0-47a0-92b7-1c37d52cb54c", "value": "T14245239287FCC432EAB06FB118F706971B32BCD44C2992CF36519AC90873799A53579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235431, "uuid": "1df9b3e0-c8d9-4d2b-a8a8-f886d3dac406", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235431, "uuid": "8a32bea5-4f64-4612-9ba7-b127b0f8d5d7", "value": "24576:xyCYHDn/XSUId/SEwKCQnY8hMBd6R9oSY1ZfuyEv3JzeYeXi:krjXSUA+sphMuoSg2yExiYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235431, "uuid": "095d9851-7e6e-484f-b3f4-efb8d97ad2f4", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235431, "uuid": "c4051893-90ef-4679-8569-186913790007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235431, "uuid": "e085fa67-6b7d-4fe8-9a46-f62fcf83e42b", "value": "b13683af42a46f81c9fee9a52523864b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f6cfc-f3ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684228523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228523, "uuid": "94b700ba-a9ef-4583-a7da-f315845fa70c", "comment": "Malware payload (Amadey)", "value": "70075f346a107ce7aa03e6759b34e484", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228523, "uuid": "7bf0138d-70a8-43c9-b56f-68bf3954b762", "comment": "Malware payload (Amadey)", "value": "034a4db1871c9199af2f2207e9519b41db86fac2c543b64aeefeb957418c10e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228523, "uuid": "63e2c125-aa27-42c9-ae61-1fe841ea3075", "comment": "Malware payload (Amadey)", "value": "3130734ba0f611d78847c5c29826e4affe5c49e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228523, "uuid": "5a29a6fa-6fe8-481e-8e61-3e843a7a62fa", "comment": "Malware payload (Amadey)", "value": "e59e3b5ee036cee9d47dde576279b2c19299558e1f2c5d8ca96450c7a8d42716c938691dbaf98387a957a3ea576e91c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228523, "uuid": "bea51bcd-9f06-4ec5-8887-8068c8d22254", "value": "T11A452213EAF88032C4F5277114FB5683173A7C66AD785BAB2345A60929739C0B93377E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228523, "uuid": "d9af45da-d1a7-44a1-91e8-bdce88244bda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228523, "uuid": "ad4c693b-3bef-4281-903c-b58f0e958edb", "value": "24576:SyGP/It/SLRJLJ9IaC+oAGvlV/SRU3rBD0x7:5Gn4AR5/xgHlV6R8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684228523, "uuid": "e93de26a-0ec6-4f76-a1fe-12fcfe82c745", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684228523, "uuid": "cd8f9c09-1bb5-4a4c-a9a8-fffd47846dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228523, "uuid": "f585c641-4413-4c22-bed9-1ce5db4aebb2", "value": "70075f346a107ce7aa03e6759b34e484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1006bb03-f3de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684237059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237059, "uuid": "ed1a5085-7cbf-4d60-9d59-8896a43747eb", "comment": "Malware payload (RedLineStealer)", "value": "38c5f73275ca4addd7d29b98ab0dc48e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237059, "uuid": "3331f30d-9ff6-4a22-8205-14c32216dd1f", "comment": "Malware payload (RedLineStealer)", "value": "0449f1701752d10ee22a97303ecf7bf6d333eb43c50ab64471ad8bb8437c57c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237059, "uuid": "a19c89b9-9a42-43b0-b117-b1921aeb9b55", "comment": "Malware payload (RedLineStealer)", "value": "572a9b977635c2ecca16768ac652dafb64e30df1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237059, "uuid": "f194c44d-e510-48a9-9587-d15c343117c3", "comment": "Malware payload (RedLineStealer)", "value": "11845ac1282226fac691e933beb152a92c8a195cbc183607c0cb82047a28f257f629dbcb01d24694a7a10767af5a6a23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237059, "uuid": "3f3830bc-ab43-4103-b5ee-85260c26ac6d", "value": "T1CF747D4396A13D5CEB264B73CE2E8AE87A9DF1504F5977AB32185A2F04702F2D173711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237059, "uuid": "230ee434-d841-4e5a-b956-9735cebdede2", "value": "60946fdd5682e6ea801f7726d24d2022", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237059, "uuid": "03bab3b6-03d4-42e0-8fd8-73df37083cd3", "value": "6144:mx7CearL8BDYaVqd45SuPdKpCixyudTse+FqeXKDbQgA4BSwb:d4p/VvXPd6DJ4e02BS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684237059, "uuid": "34769712-6d77-40d0-9a48-89158ef81993", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684237059, "uuid": "e3c34e80-af2e-4c67-b5bf-e4c1ca0b04d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237059, "uuid": "e262b4a5-425c-40ce-8fcb-4bbe76f81dd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a5dcc0-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684233800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233800, "uuid": "f821335f-6368-4db4-a4f1-e6b23610ec13", "comment": "Malware payload (SnakeKeylogger)", "value": "69078d32d9c984c300e2b2e270f2cd6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233800, "uuid": "d3d4cf02-1ca8-483e-b54e-843d15583fd9", "comment": "Malware payload (SnakeKeylogger)", "value": "0555b2be69a7f5ef1a4b3948af343d22ddf3d5e1b21be20f8f9b9151c04d2a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233800, "uuid": "9c602971-3175-441c-8738-e1b0b867e579", "comment": "Malware payload (SnakeKeylogger)", "value": "c0475d7c47bae96aa5421817d7b6af4ec70ff2ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233800, "uuid": "4c1ed2cd-10b8-41bc-9e34-3a03021c358e", "comment": "Malware payload (SnakeKeylogger)", "value": "6e482cfcfa61c686a1582a5a57799c239e2454c0cf4b4e8667c3e5f4ceafa0610ec41c96829e785af62b630680590e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233800, "uuid": "654a5018-cac6-4858-b1f7-bf3924fce241", "value": "T1F8150270209E4685E01BCBF164B8FD72027270F3EED9C9750B26A1C4CE67F546E98A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233800, "uuid": "da76e9c5-a39a-4cd0-94a9-c50842a0cf2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233800, "uuid": "18410f6c-b7dd-41f6-a0d7-809aede567f4", "value": "24576:kYaH8C0wjY54jQQd7N1taRAHdYeWoAi/ZYY:Ycvv50QQRH/ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233800, "uuid": "aeda657b-1761-4ecf-99ad-1fbdceee7c70", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233800, "uuid": "8b5ac93f-a7b6-4779-9159-7f159d214641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233800, "uuid": "4775c458-8890-43c3-a8b8-4b64148a813d", "value": "Yangi xarid buyurtma pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c060815-f40e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684257883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257883, "uuid": "6c6479ce-a3ba-4d9a-920a-0b45b3f57356", "comment": "Malware payload (RedLineStealer)", "value": "06177767e51a0015dac7df4c2fe44627", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257883, "uuid": "f91a805b-49de-4e75-b339-aa1f6a3af02c", "comment": "Malware payload (RedLineStealer)", "value": "0591c04acd36d8b7fea45785544a785783a8dca4b372744f0eb1642fb282dab8", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257883, "uuid": "13a07d16-0a7b-4b11-9e2a-7a92c290c37b", "comment": "Malware payload (RedLineStealer)", "value": "ba09316a20ee3129b481936c7455a55f3757d6e8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257883, "uuid": "71278e08-2b6d-451e-bf00-1119e1fb2c8c", "comment": "Malware payload (RedLineStealer)", "value": "3d1dfff2e5b3ee54881dda10931295eaaef2937cebfb4f9e7dfa3656244f13fd7efab386c5f82b35071ff52a5f6b9a0e", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257883, "uuid": "56518c7d-fba2-4316-8365-62337f62248e", "value": "T1BE652363A6E58077CCF44B714CFA16831B7BBED56564872B1348DCAB4CB2AC02475B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257883, "uuid": "e20c13a2-c54b-48bd-9a60-cfcc8df8ea9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257883, "uuid": "ffc09f35-3026-4dfe-8636-2c1ea145f400", "value": "24576:5yMHfPOi+PW2Bq4c7vF7QPCK35cC9ru+sKWyKM9/vGdUYAtIcntuhJU576c+Laa1:sVPWT4MY5snMizUvnIhQqLaaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684257883, "uuid": "cb223ce1-879c-402a-a0b1-d58229936dcf", "value": 1502208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684257883, "uuid": "3acdfe4f-4a10-494f-b817-ad4058db9560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257883, "uuid": "fe98b356-bb5b-4ba0-b27c-403d4fc55c81", "value": "starter.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c99dbf9-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210156, "uuid": "bf95ce6e-de90-4ee7-97ec-9cad00550a53", "comment": "Malware payload (Mirai)", "value": "f457b0a03bcbb1ae10869aaa44bf9d2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210156, "uuid": "1f965533-aabf-47dd-b673-0abef5538fed", "comment": "Malware payload (Mirai)", "value": "06b0340403b2c9a4e14a62c552685cfd38c8c7189cde14727176fbacb65aaaf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210156, "uuid": "50f73e4a-fd47-4e11-b08d-28e3ae649447", "comment": "Malware payload (Mirai)", "value": "0cdb12416ea8c5ad74f52c5c18e7a282d85e330b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210156, "uuid": "14ee17e5-3592-45f8-a2fa-ed02cd515d53", "comment": "Malware payload (Mirai)", "value": "57ba07c570a2680390514cc7e26ffed97a8e76e815d8527636ce7fbbbd503edae41ab1f384a32ed95a6c8d26db595f02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210156, "uuid": "37bd32b4-3c36-42c3-835d-951225393628", "value": "T1E7B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210156, "uuid": "abd3be94-ea88-4562-9ce6-f113a92774c4", "value": "3072:MDVLSItJP+Xsp4JlN3HijmH1cuEgvniuN/:MDV+ItJH2l3HijmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210156, "uuid": "3a90a562-86b3-4d89-81cd-91412006e251", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210156, "uuid": "6293dbe4-0537-47ea-9ed8-e3ac46fe3ced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210156, "uuid": "7a00604e-daa6-4b94-8392-fd9fa71ae5f4", "value": "f457b0a03bcbb1ae10869aaa44bf9d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afa5634-f389-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1684200731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200731, "uuid": "6ff776fa-90fd-4fdf-88e9-e23497f82b07", "comment": "Malware payload (Cobalt Strike)", "value": "4f2f57cf5d9c326bac188e388aadaf82", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200731, "uuid": "c0dfe577-c7dd-4dbd-b4e4-a49e41146c9c", "comment": "Malware payload (Cobalt Strike)", "value": "0749c57fa5774132e6218a35182fdb0d52a0f06fcd6d740dffa31342e43554eb", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200731, "uuid": "7ea92a8b-0bab-4560-9dc5-811f9cac9c57", "comment": "Malware payload (Cobalt Strike)", "value": "03bf388e4110ef1b0c6e36c1e1c0480ed6478a02", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200731, "uuid": "87284dba-773b-430b-bed7-d703551716c6", "comment": "Malware payload (Cobalt Strike)", "value": "2ea1a1b6ab44f3e84fd3ccab54ee63ccc803a8cbcb744419bcc43411aec009f34cbca29a719c0c1e9476fb8fb47ccf60", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200731, "uuid": "33ffe662-8a75-4941-b8d0-9fc4830fadcb", "value": "T18771E71827DB3949A9962507BD7E98801E2C2F67E5C53C00F9F49720E4DBC24E0B7B54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200731, "uuid": "d7056219-dd1f-4336-9883-ff51b0a9a73d", "value": "96:wmgPbvvOmIeoh1Yn64nk/wiJNXM0lgMk0l5:wJvOooh1YnWPPhZZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684200731, "uuid": "f83289f9-be4a-4d46-a867-1bede3ab3024", "value": 3528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684200731, "uuid": "a21d2687-58cc-4be3-913a-008925d6e5ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200731, "uuid": "a4b28d19-f33e-4e67-8457-8d54b6c67db8", "value": "ca26ba4682518b0c893a42fbc9f8c11e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ed7264-f3f5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684246994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246994, "uuid": "481d8914-1590-432b-9f7e-a04e624918f2", "comment": "Malware payload (Formbook)", "value": "d0f6af929c377fa9b374c88354121862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246994, "uuid": "22322ad1-a2b9-44b5-a142-3e6ee915fd58", "comment": "Malware payload (Formbook)", "value": "081527de30dc241c82bb300d57a72a24a296db7eb7f8878baf40d634ec361549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246994, "uuid": "58c46137-77eb-4f56-ba0e-977028a8e54a", "comment": "Malware payload (Formbook)", "value": "4436d995e016731218f223df3d3909dffdc1e5f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246994, "uuid": "513f0599-f2e4-48b1-a340-5328f92b795e", "comment": "Malware payload (Formbook)", "value": "8324729fbd7a6b2110f0b69398697af44ee70ed3cb376c8beb2cc51f7cf8c58133652b83f3337e7c0e73a90bbaccbd54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246994, "uuid": "2e13ceb4-7029-4610-934a-27a33404bc4b", "value": "T1154412044FE4D4B7E0FB0B709F75697F8FB6D82016A2D94B17A05B1E7972681F908392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246994, "uuid": "55f72b50-754f-4e45-8901-de8d97c9f1b3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246994, "uuid": "3dfe1b29-c76a-405a-a0e0-021af8894a63", "value": "3072:XfY/TU9fE9PEtuBbrUU0KpSBl1qPDAuYPtS63Fhea1O5QA8nr2ZEMpbdu+9A3jFU:PYa6vV0JBv6kLJFh2KiOMsFSUOUE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684246994, "uuid": "34b82ec1-798e-4b93-8fa9-c3011d25e2ac", "value": 255194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684246994, "uuid": "96fd873d-8c2d-4228-960c-e661a8f71e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246994, "uuid": "af86e1cf-35c8-4e20-b30d-c934dd0e3b92", "value": "4INDO7543847387583563875932427475353524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce80857c-f3ba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684221917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684221917, "uuid": "7b353ece-b18c-451f-a895-6895dc2fde32", "comment": "Malware payload (RedLineStealer)", "value": "217e70b466895d8bfd4ea25968ea582b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684221917, "uuid": "d7f9e42e-145f-4ded-b258-f6144c052bc7", "comment": "Malware payload (RedLineStealer)", "value": "084865d6a04d15633efe18a484e84adf0354e6eeb2858f46fa172d81852fed6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684221917, "uuid": "4f6e9b5b-3742-4a94-ac7e-46752dd4eceb", "comment": "Malware payload (RedLineStealer)", "value": "c0bf671afc9b77bb14c470a46b611cf5b7063f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684221917, "uuid": "c37b90bd-76cf-4c42-8790-ddd24da36fef", "comment": "Malware payload (RedLineStealer)", "value": "605eda6d5cf312f97456149b7d5e6df80dc55b59d113c46cc0c1a58d867d1e0be366cbd44e11740aee0a26131d018a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684221917, "uuid": "4649ba2b-f423-42be-af4a-eae4fda7a641", "value": "T1F6452353BBE58172DAF617B008FA42870739FD141DAA833A3B462D1B1CB23453577B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684221917, "uuid": "1873be26-d26a-4f28-81c2-bdad1c4583f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684221917, "uuid": "acb9790c-2ad5-49d4-beee-687a0ea7683f", "value": "24576:oyNIgqz7StI6/SPD8he/mgYacXidObwoht1dR3:v+gqzUTDea3t17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684221917, "uuid": "620eaeff-0bd4-4271-bce5-c6019b9dfa00", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684221917, "uuid": "b7bd3c0a-c4d6-4de7-aa17-5a24450bfc72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684221917, "uuid": "63822895-8656-4041-80b9-e258b79c4f8c", "value": "217e70b466895d8bfd4ea25968ea582b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29843482-f3e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684239249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239249, "uuid": "49ac10b8-eb3b-4d64-8ce8-4f145cfc07b9", "comment": "Malware payload (Mirai)", "value": "e6e7cf2fc4c926ff692679e90de52acb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239249, "uuid": "b0bd9a23-a9c1-4222-9f14-dac42eae420a", "comment": "Malware payload (Mirai)", "value": "0891c82b81894ee4392280c5ec2e7bab4c9c3c0973dfe71b7847031bbcc7b3da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239249, "uuid": "7b620853-c0a5-4af1-9d5f-c5c98f140dad", "comment": "Malware payload (Mirai)", "value": "55a437c0a460260ef033ee7354b30a6ef8e9bf96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239249, "uuid": "d67e61b4-ba0f-4c86-b45d-138bfd8fff46", "comment": "Malware payload (Mirai)", "value": "c27c538f577ff21874177faedfae63cb27d261e6c0724d67fb48972e9cd1f645f34ec3eac65690fa8b4f31c52c4d1d7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239249, "uuid": "082abba8-467d-48bd-923c-cf964b5ca47e", "value": "T1CFF2D791F8854727C2E41379B6AE5A8E377073EC82CBB627D8224B207AC591F1D63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239249, "uuid": "22e894ef-b3c1-4cbd-9a96-7449a0eb87e1", "value": "768:TjbUR4xPEXqqoG5M1ICBHGadwq3iFtKV5/a9tuF7h3RyT3pochtBYwn:TjbUmQqRG5MNxGaqRie8NBu3D5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684239249, "uuid": "1b05af31-57e5-4067-bdf1-51581c165050", "value": 34868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684239249, "uuid": "76fbbee5-c766-4709-99ef-1f4f7a5a07ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239249, "uuid": "379bb686-70e2-4542-810c-c3673e458b1f", "value": "e6e7cf2fc4c926ff692679e90de52acb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc57111-f3c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684226721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226721, "uuid": "08aecbe7-b1b7-497a-b20c-7b0709641f52", "comment": "Malware payload (RedLineStealer)", "value": "39fbef218fd7c8804845c681a0756321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226721, "uuid": "5d8a504b-72c2-4c37-ae95-f081edb7b83c", "comment": "Malware payload (RedLineStealer)", "value": "0968b35035f4129b680ac3d3828a2b9b320d610e3b2de969141712d35b5c7f79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226721, "uuid": "6bbd46b3-d40b-41d5-a860-dd89f640a799", "comment": "Malware payload (RedLineStealer)", "value": "c668d4ea057490d509d450c1bee6a0f578523e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226721, "uuid": "7b3dbd09-c4dc-4f28-aec5-8e191b335b1d", "comment": "Malware payload (RedLineStealer)", "value": "0aff04472c8fbe51fe55c42173a49c12e6f58ea30b039a387117a0f38e0e50a1d35143a213eb2f6af7abbe6c58ea86d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226721, "uuid": "5a2698a3-07ef-411d-b04d-6422a2c6b378", "value": "T10945220BBBD680B2F9728BB548F602830B7A7CF1496887BF1796758A48736C14476737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226721, "uuid": "9cc5a92f-8f3f-49ce-bba2-36b0043acf7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226721, "uuid": "b702f16c-249d-405a-98a0-162d5ee6db03", "value": "24576:ZyMFRsmXqbjzqTNnrS1qIN/Scl5Q27ECTwygsi+Qqu4JFIZdEUukR:MeRsqM51qEW27ECEynFu4JyZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684226721, "uuid": "8e073bf6-dfda-48c7-9e94-b333e2604f59", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684226721, "uuid": "1f0c98c0-80f8-4ec1-b666-f49ad4d3a7cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226721, "uuid": "e50702c4-1cb1-4b4f-b0ad-6553bb0f3b36", "value": "39fbef218fd7c8804845c681a0756321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62256d15-f3f9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684248793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684248793, "uuid": "bf50ae28-1d3d-48a8-8101-106bc065394f", "comment": "Malware payload", "value": "9b3c5ac962251c765ee1db3ae70a797b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684248793, "uuid": "c39ba31f-a06f-472f-952a-dce28dfd3e78", "comment": "Malware payload", "value": "0b9be33bd32af4690e1056e435f67ca993aea001094a97ed7f65c77531358335", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684248793, "uuid": "c6144a8e-e329-4025-a9cc-d6cb69dafd22", "comment": "Malware payload", "value": "82e33e2fbf3e31ae453c35194dc41a467769fe97", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684248793, "uuid": "8f7be113-575b-4b1c-a6c6-d2a97bc22f53", "comment": "Malware payload", "value": "d6f761b36823f89602e4379f9cec8d0a2879dc6b74376f9772d5032eeabdd1fbedd36ad19a54e79183d0a8d91128ced6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684248793, "uuid": "4f3e04a6-efb7-4380-abbe-54ac785c3e9a", "value": "T11FF3A9904B9519B15B4BBF36BA7094A5DF3E0DB8838C928BF05F3165F2DE98CC9D0660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684248793, "uuid": "746a858e-c685-47fa-b13e-eb89c45c82fd", "value": "3072:EbwkZ79veOv/TwOXw3bwGvi5W488eubY0VNQL8Ik2Dod:EM85veOvtXwrwQeNHbY0PXbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684248793, "uuid": "196bc368-4ee9-43d4-802d-1f1cbfacbbbc", "value": 172793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684248793, "uuid": "24db9b5d-9240-4b68-bfe0-3622c00118dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684248793, "uuid": "cb6867ac-da00-4082-ad38-6a913781518d", "value": "Eqjdcmw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11deb0e-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1684232283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232283, "uuid": "cd4371be-8f23-4951-bc89-a9c521fb2c38", "comment": "Malware payload (zgRAT)", "value": "89414a875b933ecb35afb4a0c5c60c71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232283, "uuid": "0525ca81-787d-48ed-b714-db1fbda5851b", "comment": "Malware payload (zgRAT)", "value": "0d798b38c892a0eac99a1ca814a8d98d1e1849b411f8f6160de953eb447ce286", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232283, "uuid": "8dcf540b-1fe0-47a3-8ca3-67633242c1e3", "comment": "Malware payload (zgRAT)", "value": "11378acab32153ae2845121f4f1792484739e8f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232283, "uuid": "075ec089-0e5c-4898-997f-f42bb4c74319", "comment": "Malware payload (zgRAT)", "value": "8823a17ebc11249bd02741f3665615edbb38c08dc5a6d1720bd3a7d1808d7a108eaba24a6e735f093a07401eb3a7db58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232283, "uuid": "145c868d-3edc-468f-b475-3d47b2ec77c4", "value": "T123B45A74A1F25AC5E886CEB29E61E219FFE74D819951820FE13439F216337C4D2492FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232283, "uuid": "1081b2a7-708e-4679-8ac3-0049079a4c53", "value": "6144:RkP4JrSAkMLwAZoY2CodamV3tfLqYnEwFKOlzbAhmkASa+En4:5JvkMLbkCoT3tj+wFrlQmkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232283, "uuid": "915c7cc1-7510-4cf7-b4d4-e7ba7ebfd56e", "value": 520264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232283, "uuid": "9951677d-43b7-404c-8bff-6264131292d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232283, "uuid": "c30e8140-6ba9-4cd9-a48c-ea9e246fd218", "value": "New Purchase Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73623c23-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684243668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243668, "uuid": "7bcd74fd-305d-4a77-8e6a-b743bcab8c9e", "comment": "Malware payload", "value": "2b63b9cf0347def480c61bf18ecbd331", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243668, "uuid": "62defea8-4658-40a7-82f3-0bbf06dae57f", "comment": "Malware payload", "value": "0fa4b1686e6cce46971d74a49f921f3ed19799f425d814822ddf9c9105b21c91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243668, "uuid": "688b9575-545b-4901-8fbd-a0ba41d9560b", "comment": "Malware payload", "value": "0479f306958c955b61cc22deab0366e8f3d78354", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243668, "uuid": "976ef5f1-68e5-49be-bbc2-0baadb33f8b2", "comment": "Malware payload", "value": "66e7a563efa42af7890976a3b6cae8592dfddb261c18e16af174ecb81be75340934833eb0cb49bfa5a38b66ce5b9c72b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243668, "uuid": "b03dd12b-e9e8-45cd-8596-ceda3a2f7de1", "value": "T1AC34DB5C435628234B6F7E32A769E4BDABB81EA4D2E0468BF89B7240F6DFD4CD4D0111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243668, "uuid": "a99f308c-6b71-4d57-ab88-e0727c34ccb0", "value": "6144:uuJYVW300gLo7D+x/+YGKEpOHtLH1fVQpauRVFm73LC+1o:OkD+RHVQRVFuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243668, "uuid": "f5c7c751-715c-4620-85aa-876862043785", "value": 244933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243668, "uuid": "7f104f82-dab9-45c8-967d-0b33c4e47d12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243668, "uuid": "208f60d2-2c32-49c0-81d3-35010d8aeb32", "value": "Muplotsu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f2bf62-f3de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684237398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237398, "uuid": "fb5a60c4-f903-4ac4-b462-0887193aa290", "comment": "Malware payload (Mirai)", "value": "c191bc87ea3a7e90309c8e9082cc9fac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237398, "uuid": "8c9deaa8-f8cd-4f39-afba-3c2c46462112", "comment": "Malware payload (Mirai)", "value": "109bfa411488f3de57a0c1767c19ab19b8afeb3408401a932d01e2d202d1286d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237398, "uuid": "7b33b3ed-55ed-4a34-b32d-e312f7f0e27e", "comment": "Malware payload (Mirai)", "value": "a330641906b25478e7437b4ba81aa61001b01c7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237398, "uuid": "68f54fc6-fd51-463a-9d0a-28c0d780ee40", "comment": "Malware payload (Mirai)", "value": "c2bfe1f99c2f516152096a8b80c768c85aa98ea2f72105c75d547a16d74e566498d733575ed44741adf10b76dbbad3bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237398, "uuid": "1829f235-7655-4be4-b666-c00574b4a900", "value": "T10C334AC4F643DAF9EC4705701177FB339A32F5E51229E743C3A99A32AC52602A906EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237398, "uuid": "f2e64dca-2f3b-45d5-8d61-9b599d51012c", "value": "1536:GWa2d5sf1Gg+ya+nlQyFKffDRTfwVsp3MSfCYK:Gt2d5sf1GCammoKndjMW3dCYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684237398, "uuid": "866d0da4-be72-46df-897d-0000cd9f6f63", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684237398, "uuid": "0e07c43b-dab8-4392-b862-0fa7ce7c8d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237398, "uuid": "eb8bcc58-765a-4356-ac5e-66a818ced52b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5170dd-f3d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684231822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231822, "uuid": "46d7e410-de62-4111-8b34-795dc93bb38a", "comment": "Malware payload (AgentTesla)", "value": "65e08c35cb761730245a1bca4627857b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231822, "uuid": "0f488259-f5c0-41bd-a02a-14d8428fff51", "comment": "Malware payload (AgentTesla)", "value": "114e9440122eea7390651a18546bdb6c9cd4251d6e0bd8e7d0352db4e5768776", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231822, "uuid": "339b841d-9cc4-4344-9197-31a90c98b1b6", "comment": "Malware payload (AgentTesla)", "value": "8e435139f676ac743e71fdc05abb919b588525cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231822, "uuid": "906f76cd-6a92-4f74-87e1-ac32a095273d", "comment": "Malware payload (AgentTesla)", "value": "5a4d9788547d4effc76f7c508277280a9fa8446a029c0e39e830aaef58b4e7c17369ac9bc46d40a4cc3995132e7bfda5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231822, "uuid": "621f026c-8fa8-4751-a39d-dae208c2f0da", "value": "T1E0B42387BA40DDFCBFD38395961CCB2AB953530D81F88D20DC9B08BE375AD09891E665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231822, "uuid": "757aad62-2a0f-454c-85f4-5091096c6839", "value": "12288:ybPmX9l/8J5qbdjhMRvxxQ2zO+J1ariaEaUhub8LFOnpJcE:ybPqli5qbdjhMRZq2a+fxha0ub8L6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231822, "uuid": "275608c0-bccd-4ef5-a0e7-1b56b4732948", "value": 509468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231822, "uuid": "bb3f872c-bf63-4cf9-8665-8690da5a8ce9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231822, "uuid": "8af8549c-f051-441b-a491-8ebfe2b3bf98", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818bbf43-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234243, "uuid": "81c51f7d-441c-4d0c-b32e-4b4afc4230cb", "comment": "Malware payload (SnakeKeylogger)", "value": "2a30f4c301916f21a1290a7d633f6af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234243, "uuid": "08efd467-5562-4234-8c89-3b6078334dff", "comment": "Malware payload (SnakeKeylogger)", "value": "1153334c1fc4ff4c47df6fdadd312dfaf653f32849b5ae910490aeea4fc452f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234243, "uuid": "f36d747b-b53a-467a-a43d-65dcb8ad9293", "comment": "Malware payload (SnakeKeylogger)", "value": "e5347dff7460589cc0491aaf18faeb59009826a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234243, "uuid": "9691a9aa-2533-488f-b888-d4863a2d393e", "comment": "Malware payload (SnakeKeylogger)", "value": "3d7dd4124e31b5e3a3e1ae7acc1db3a97e8d42237d66bf36dd84699775c47deeda1807a3e4bead4381f919404a1cec65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234243, "uuid": "bb961017-47b0-45f0-be37-1657c1101d81", "value": "T17154C682BA9EC162D2A95B73E4E216005F75F841E572C71E398E23D90903B77EC49F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234243, "uuid": "d524edf6-9aef-4a56-a9a6-98bd5ce5f2f8", "value": "3072:9hB+MdCFROsHv0mtnECDuLzZI3h2qSLft/y5ogWq/YmJKSGlRx90hXrFs3XR2K:9LRdc39JEZ3XqSLGj/+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234243, "uuid": "7bd6d4cd-0148-4a55-bd4f-13cb8a81a7ad", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234243, "uuid": "d23d2f7a-4d35-4a1f-b9f5-564bd093fa99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234243, "uuid": "ee77abe6-965e-4afc-bc10-b30798a363ae", "value": "Payment prood.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e75a77a-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684233406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233406, "uuid": "3c2bfd7e-55d3-4860-9fb9-c3b983e243f6", "comment": "Malware payload", "value": "65af68bdde4f6a6b2511b2e1fcaf8523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233406, "uuid": "63182f46-2c52-49cc-8a69-24e6a43828d3", "comment": "Malware payload", "value": "120bd2be0b826c1390850893f0f37a458a30cf29328a869a636691e6152c60c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233406, "uuid": "822d3af0-26a1-4803-892c-49899755226f", "comment": "Malware payload", "value": "c78d09b354a0c7295727f603fe0c1452601c4f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233406, "uuid": "0fe196ce-9354-474d-9c1e-97b0fd709767", "comment": "Malware payload", "value": "8a2185df066b23fb3b0f53f174f0f88002141f258c22fd95cd73a5907ad79ac7900459ef084390aea2aca767b606b03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233406, "uuid": "780b8917-9838-417b-bba3-2ae73e254415", "value": "T18EC4CF43B7A15DAAD067503945A3E317EE3178042B518BCBB3D859253FE73D02EBA391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233406, "uuid": "a8e801aa-260b-4e24-88aa-6bb6f886c8d8", "value": "eefb79a81bf95e89b89f16f6152d171e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233406, "uuid": "3d9b7997-4bdd-4703-9c1e-243519621360", "value": "12288:aOthee1+uh2lmVirZ5HQNRn0NqxiQaB8NXDJ1YjJ2c9:NHee1+i2cVidxQNRnjxiQTX3o7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233406, "uuid": "ffe18b06-4ecb-40ad-a081-6f144e736020", "value": 589856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233406, "uuid": "e0f2c065-4aed-448f-8b7c-310f783db3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233406, "uuid": "298c60af-2754-4446-96ea-14510e820094", "value": "65af68bd_120bd2be0b826c1390850893f0f37a458a30cf29328a869a636691e6152c60c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6702db07-f3c0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1684224320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224320, "uuid": "cdc47a56-e82f-4bc0-a7ed-3f88d4b0d029", "comment": "Malware payload (WSHRAT)", "value": "dca76785db3828884851b229738392e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224320, "uuid": "7ac7a887-d28d-41ee-a99c-b917497d654e", "comment": "Malware payload (WSHRAT)", "value": "1254fb84cd8e21d3c712881f606cd36e8d068ad89b205da335614696bfc59ca3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224320, "uuid": "b180cfed-eb36-45d3-80a7-d69fe70685e7", "comment": "Malware payload (WSHRAT)", "value": "d7687fe5780970e04849d142f7889391be73ed99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224320, "uuid": "984adf7c-582e-4455-945a-ef6a4ac394bb", "comment": "Malware payload (WSHRAT)", "value": "f46860a558db35d95d11540a786e6eb4cec310916f821b7f50f7dc0930afe2e896fe583b04a0701e39a990d7f4f62f04", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224320, "uuid": "9e28a92e-0d44-4eb8-97ba-ac086c03da76", "value": "T18345A2136A4EAD61726267CE915E67031DD4E38BCA3B106012D62F4DEE28D2872FD7CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224320, "uuid": "a65822f1-48f3-4434-83a5-75a91735f787", "value": "1536:QQ12UuLTs1CdS1nOsMokKleE73rnroY1YDEvMKfQXr6rsqTorsqTPs8Csn98uXOY:QQvo9S7xNJ0iIhQG9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684224320, "uuid": "87ddb011-e060-48ce-83da-e38ee7aa0935", "value": 1227489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684224320, "uuid": "bd0a3aa3-98b4-45ad-92cf-6a6278d83bef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224320, "uuid": "5e00bd47-1c1b-47d7-a414-abab55142454", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501f0d97-f3c0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684224282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224282, "uuid": "39f28316-5f9c-4e33-ae1b-356828f12670", "comment": "Malware payload (RedLineStealer)", "value": "342c7fe9508300e2793712c4f70f734f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224282, "uuid": "3a760e4e-a6ae-4a2a-b99c-7a00f555771f", "comment": "Malware payload (RedLineStealer)", "value": "12f64f73b7e5766f160c228cadc63fa0101ec8db2a3427e7a3687eb84be130c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224282, "uuid": "54fba03e-264c-4a66-8ddc-c0d8b197ab00", "comment": "Malware payload (RedLineStealer)", "value": "1f0aa824160d5e6d021ac0cdb0e96226a08215eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224282, "uuid": "8fea1a5a-7cc5-4400-a77c-ebaf684dfe87", "comment": "Malware payload (RedLineStealer)", "value": "5e4cba5ab0d0cd71f8e60d7778c571c9ec8d06fd84b7ad08a35f813abcfaaaa2f78e4147da6abd78afce9e02f8365025", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224282, "uuid": "64b2b230-a41d-452c-938f-b9016df257d8", "value": "T13B746C9392E1FC50EB664B73CE2ECAE8769DB1508E19776B12189A1F44732F2C173721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224282, "uuid": "4b5d404f-6f29-4cec-9526-29bfdc998e0f", "value": "8507dd6e83303e4881d265378980e13b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224282, "uuid": "77cacb76-d659-441c-8a88-794a1a8f090e", "value": "6144:WcWS4Ldk/3jWDfhYPMweYb35Y6qCJdpjPqQo5BSwu:XMBw3jMfqLS6TdpbqZBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684224282, "uuid": "68459fe4-5d51-48f5-8f4c-b89426b192c7", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684224282, "uuid": "f8852c81-7f96-4266-8f2d-9206e4f93aea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224282, "uuid": "e5a1f3f3-d2fe-4cae-b2c2-f48c610daa96", "value": "342c7fe9508300e2793712c4f70f734f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f47987-f3cb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684229123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229123, "uuid": "687577b2-941a-480e-bbaf-0dedd0ffdf8b", "comment": "Malware payload (Amadey)", "value": "75b696c079baa37dc51aa0783ba8f381", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229123, "uuid": "ad12f10a-3caa-4b9e-abfe-ce06ae2c852d", "comment": "Malware payload (Amadey)", "value": "134e2d1096bd0bdefc24629cd95e2efe634e6a55b2ef00c545e9c2e0f9004e1e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229123, "uuid": "a99765a0-9d28-4fe1-ab06-d919d9c4056e", "comment": "Malware payload (Amadey)", "value": "4b07c6943d5a52c7cfd7444b3cfb45d56add41e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229123, "uuid": "4f98c41c-3db8-49f9-91e8-5ed1539e381f", "comment": "Malware payload (Amadey)", "value": "261a90d5c0f03719466bd9cb82734b78a830f6cc938d0f52b4b03e90d6cd18f4b712faafa622531d4096872607d51684", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229123, "uuid": "c9e1befb-fc32-4770-980d-ff5fcfa8ef48", "value": "T174452367BBD88476CEB72BB118F703D30B31BCA44D3CC3577949C4592C62A62A83536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229123, "uuid": "a3e120aa-5fd0-4d30-8201-ddab8e0be098", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229123, "uuid": "6d69b2a5-54c7-4ba3-a6af-bde6557330c1", "value": "24576:Hy5WoAAGEEJrByjwIC/SP9tpUetzrd2N2QjW4XNH/:SrAAJEJrByjw/4d3d2s74Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684229123, "uuid": "f721f876-5135-4164-a3c2-b7663cc04ff0", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684229123, "uuid": "13cdabc7-3009-418f-bfc6-13bc11026ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229123, "uuid": "242169bd-d9a8-46a4-9134-70b0b8ee4d67", "value": "75b696c079baa37dc51aa0783ba8f381.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bb5011-f3ce-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684230489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230489, "uuid": "c147c5f0-d6ca-42e4-a4b5-b3781acd5efa", "comment": "Malware payload", "value": "97392d70e07cb9a1e93936f3b0cb483e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230489, "uuid": "a5d1f69f-7451-410b-982d-3d137c946b46", "comment": "Malware payload", "value": "149ca091b02aafdeff15610c639b442a61e0dfcd461d9bec7f8c38998a390575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230489, "uuid": "d7f8f172-4aa5-4361-9648-3327d44c012d", "comment": "Malware payload", "value": "834469fb8df8ae32bfb5e6e1a91f4fc14c1d265a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230489, "uuid": "ebeba68b-4241-4964-b55b-339fa4e19423", "comment": "Malware payload", "value": "74cf65e93956462c7cc12b2c010a6e62ed0d02fd7a6e279ffa238930a222cd09d90e2a8d046b64c7348560a5e2f4d2e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230489, "uuid": "9e0153e8-8f57-49c4-aa39-b84d17f7e0cd", "value": "T130B53312BFD9C632FD6096700DF253976730BA9547BAC78663C53A8E4EB22509C7334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230489, "uuid": "a3f9b326-571a-4d19-822c-e113651a0a65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230489, "uuid": "7428fe4d-5d15-43b1-905a-aefdb44015b8", "value": "49152:sEG5joOi6EeC1WpMxqWgOw41s3zEDDi1n9m7bg:Qi/HopMxqWg56fi1Q78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684230489, "uuid": "78afe8f9-0a5c-4ecc-9860-8eab96cf63a0", "value": 2469376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684230489, "uuid": "5c4fc0af-91f5-46e6-8240-a5e52cd7bd81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230489, "uuid": "ba03f12c-3858-47b5-b50e-426baabde58c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb230e6-f3e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684239226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239226, "uuid": "07205348-8fbb-4538-a3e5-7a05f6653514", "comment": "Malware payload (Mirai)", "value": "882ec025fbbe651a41247a201e8d67a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239226, "uuid": "875a0b9e-b8a5-40e2-9055-238e5a9792e6", "comment": "Malware payload (Mirai)", "value": "16365f543a15866c367c39a3e2fd1d749081dcdefcf3b0f45359f63cc7768ec7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239226, "uuid": "16f1ae85-2a72-42dd-831a-3f8e31ef11e0", "comment": "Malware payload (Mirai)", "value": "5825eec7fbd6116dce0d5217e40824ac30a26e29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239226, "uuid": "820d644a-2a3d-43da-bbad-40c645fe3ff3", "comment": "Malware payload (Mirai)", "value": "dac8b4347741c643269883e423654f3360eb3198a1cf7a1422223418bcf688e1f73bdcccd57b9afab1df01ee0906a2ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239226, "uuid": "83bb706f-b748-440d-8fe2-0c4e9b159821", "value": "T13B434A02B31C0E47C0A31A70263F1BD197BEE9D022E4F689352E979A9671E375586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239226, "uuid": "fef694bf-470c-4045-b073-bf95de5877ed", "value": "768:EbpJYxjEJf68CRZGRloQUEqde5POkdUWV96mCq2Rj5GMIgglGcFRxtafS+wn6Ia:q/mqzqQPJ286+2qMIgg4AxgfGn61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684239226, "uuid": "adea818f-0657-4507-8440-a98e9fd6a7c8", "value": 55160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684239226, "uuid": "31b44795-a9dc-4468-bff1-f09ab229d3df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239226, "uuid": "92adc888-71b9-4271-b207-1ed982cee9a8", "value": "882ec025fbbe651a41247a201e8d67a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe3d1f6-f3eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684242938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242938, "uuid": "249c9c32-85be-467e-8f8e-31946aa10601", "comment": "Malware payload (Amadey)", "value": "994d25b3209fa062f133ffaefac6da71", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242938, "uuid": "ad76538f-fb04-4dd5-a377-042bcefec3dd", "comment": "Malware payload (Amadey)", "value": "16578d24642f8a7672b7832349c2d774ec08ab1ae8be0d53b8ece44db226472a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242938, "uuid": "4fdae292-d18c-48cb-b527-67f0db087140", "comment": "Malware payload (Amadey)", "value": "70e5cb39bf57c7c1044821104bd350cb4efa69e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242938, "uuid": "1751f1b9-1af6-4a81-8362-03b92d949b1e", "comment": "Malware payload (Amadey)", "value": "7bf5e4c9d163866e8a2391adad9995b27e604403fcd23a5efb19ecaf7a384ac949b95c3bc1b6dc178dd1e9c91e1b597e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242938, "uuid": "2205ad19-5290-483b-9251-c63740514d22", "value": "T1DFA2E08C97A534E86A983EACC2E94837617E99D180C75429C2977FC0CE253F9F492798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242938, "uuid": "8dc25fad-5241-41c6-a097-bc2def4fbca5", "value": "384:bOPqJS3hOaPKLoQVD6/0/zFUUPvsegNELcsCC6q+rf9+KbGsyt2X0AIp65J9Ic3r:bOiJS3h+VD6M/zFzs1KIsCi+rkKb/ytw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684242938, "uuid": "9eb5cdad-d2e5-4fd8-9e6c-1696d60e652b", "value": 23059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684242938, "uuid": "a3c0d146-88ec-4bd5-a604-a8d170c40f08", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242938, "uuid": "38fe9c4a-34f7-44fd-b563-c3860a395f42", "value": "SKMBT28736292.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d27ada-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1684232349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232349, "uuid": "1df4b41b-6265-420a-b3f7-95ff31a587b1", "comment": "Malware payload (ModiLoader)", "value": "e23ca3ab7caf997d8361acea70517567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232349, "uuid": "80906525-3bd1-4373-a59b-be17e920492e", "comment": "Malware payload (ModiLoader)", "value": "16dbc44d14a74defb998a30220b5401ab840e1590e895a3ed5b2cb96b4c3a3c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232349, "uuid": "88083865-600f-48a5-b1eb-c890a3737bad", "comment": "Malware payload (ModiLoader)", "value": "62c07905f0aaa23f398c943cd1000599bb311a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232349, "uuid": "ca3cdff3-cb2f-43c8-9f82-3bbea19a59ac", "comment": "Malware payload (ModiLoader)", "value": "1e65610431fccc251c13f14da63217fd3467cb9e9b31e43a4409e07173293350cb225dd9e346edd9a27188f10fdc7c3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232349, "uuid": "bc89a4fd-52c9-4040-8a61-68ebbe535940", "value": "T1AD057C1AF2C2D933C1A3BB385D279710642C7F24182BF96736CA795CDA7BA423D05E52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232349, "uuid": "048bca63-d841-4ca0-b693-eff75355dca3", "value": "b994e2b35fac0eca9b95949a165480a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232349, "uuid": "67cc4a85-490c-497e-8f8e-ce092e746029", "value": "12288:IEaSIJxsS4ISFSs417nXbaGBazVb8N0K1Wqt:/F0mcSFS77LaG6VIEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232349, "uuid": "e3cfdf90-b358-470c-a218-1f1d968616d5", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232349, "uuid": "28f5ed1a-e806-4b84-b939-1828c74e6729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232349, "uuid": "487ae81a-9552-4624-be5f-357def9695cb", "value": "sipari\u015f PO_8791121-964-29 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70a9704-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684233930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233930, "uuid": "48d7e44f-fb0f-4d3d-9093-70bea7e1ee15", "comment": "Malware payload (AgentTesla)", "value": "71fd045ffa2754d04fb29af569058a4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233930, "uuid": "f2e396a9-aad4-4577-9a53-740185f38952", "comment": "Malware payload (AgentTesla)", "value": "193966c2198bd342a53892d74603233c2107d10b9d8507356b41a4666dfd8d16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233930, "uuid": "e09fe003-831d-48dd-98d9-eefc2f021eb6", "comment": "Malware payload (AgentTesla)", "value": "af8b0633406212abf619ad6e766cdb6d7343dc7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233930, "uuid": "6f49cea3-e10b-45c0-a35b-a00b755be4f7", "comment": "Malware payload (AgentTesla)", "value": "2429cd0ce70836f249917c8346e0e1a35b1daf6e34b3aebbcca37802b241f6382bedca9e66f665ad8eea05081cd33967", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233930, "uuid": "ef3e9783-4323-4440-b90f-674771b81ad0", "value": "T1AFF4CF71E93C4A0F8BA61D38C8EE004027C3FEB65214D3267A6894796C5FB98DBD7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233930, "uuid": "51ba9e0d-5ee1-40d3-accb-b535e09f76b3", "value": "12288:Uc3Ceb+m5NRSMJxG7r0fSzyLnFHPuqh7CFQQKUSNiu/mi28EOlBQS5O+w2q1ACi1:UcVNlYvWEyLFHGqVC5KUSZmi28EO7QSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233930, "uuid": "90d7ba7d-70b4-4b17-8bfc-698c3ba2fa54", "value": 739736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233930, "uuid": "7b8d370e-14f5-44e0-8a60-f3b1685e0253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233930, "uuid": "2ec5f7d5-4bf8-434a-8b27-086a2ce4a783", "value": "7rMMgBjx2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4437552-f3d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684231832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231832, "uuid": "a29603ef-d8dc-4986-b776-a9f6aa7b6a28", "comment": "Malware payload (RedLineStealer)", "value": "903322cd9fd4d536a36efe618c874e43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231832, "uuid": "6d24d281-5209-4dc5-96f8-885302dbed62", "comment": "Malware payload (RedLineStealer)", "value": "1aa57d4894da1b29af368401f33c856560517e77792a143419640a005c9f8465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231832, "uuid": "d0c89dbe-f994-4c37-a689-17e48200c2e7", "comment": "Malware payload (RedLineStealer)", "value": "5312ecceaa92da36d288c297c4a4953b22ef23c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231832, "uuid": "6676a6f7-c1fb-4392-b24c-df8aa16f8e57", "comment": "Malware payload (RedLineStealer)", "value": "172da6071ff3056e05dc858ab274ce5413766925f30a20589e4b1b397bd02d2abe5040bf353d2ad753364e265e3f8fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231832, "uuid": "a64dfef8-4e1b-41b5-b996-9c2ee6568693", "value": "T138452347E3DD00A3D8B263F52DFA03C70B357C758E64970B6A41B98A68B26C4B5347A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231832, "uuid": "1c8356ec-39b0-481f-9b47-cc4bfec13eaa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231832, "uuid": "f8c03d0d-4b5c-4079-a2b0-30a87dbf948a", "value": "24576:gygYefil5117XxwMIrIG/SeYe8C20F0PFrpDVN4vl/YjVxks+z8+Oq64:ngYV5VwtrLwe8yoAvlwq30q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231832, "uuid": "22128460-d699-4f51-8e7e-3225ded37fb4", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231832, "uuid": "6a88f52f-9a3e-4eb6-85fc-cdee0e6e3a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231832, "uuid": "f6ab3753-25f3-4b6f-8ad0-ddda2e2cf113", "value": "903322cd9fd4d536a36efe618c874e43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41964513-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232418, "uuid": "04bf22d0-934e-4fcb-858b-818ed985fc4f", "comment": "Malware payload (AgentTesla)", "value": "a24fab0aebf29ddaa784613ca315b518", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232418, "uuid": "b5d7e4c5-82a8-450a-94f3-a279d6e21120", "comment": "Malware payload (AgentTesla)", "value": "1aff0eb2eee6fe5d70d00aee2db2f30cea5167c64ea80369eaaffc39c7e654f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232418, "uuid": "58077d72-d34f-4a61-b79a-dbe960e90718", "comment": "Malware payload (AgentTesla)", "value": "85f2b6bb9bdd2c6803f2dd80187d1b052125efe6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232418, "uuid": "c3fca9b5-7039-42a2-924a-c87b73156f2a", "comment": "Malware payload (AgentTesla)", "value": "d464c8461c8e86c629879728512636c779baee133622cac3347c1186e6a5aaf1c9fad7c472fa54336416d598630ed475", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232418, "uuid": "ae0b224e-ccfd-429e-96ec-b6e65e56f3e8", "value": "T1BFD4E070119E8A91E41EDBB165BCBCB6433130F3DDD9CA760729A184CE2BF546E88D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232418, "uuid": "efeff570-c440-4e00-99d5-54f760ece2b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232418, "uuid": "a1aa859e-32e6-4548-8ef4-d88b7c30c4d8", "value": "12288:oSYnFv5MGMt2NydjO+RkJxUaPbPIXY3ONPNBeohsaWm:pIV0tdjDCffbCY3OdOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232418, "uuid": "181f5def-feb9-4548-8622-de1de7b0abae", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232418, "uuid": "70e753ff-d1d7-4e7c-a9a3-341f497de3bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232418, "uuid": "39f8208a-764d-4020-ae19-6f1826430d4d", "value": "S009892823055402_20230516,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33f113c-f43a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684276820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684276820, "uuid": "6d6a21e4-abf7-4f6a-bf80-84425e8aaacd", "comment": "Malware payload", "value": "a89efd3d3bd01ca63cef48f6b32588ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684276820, "uuid": "a65094f0-9123-4778-8f9e-375779459f6e", "comment": "Malware payload", "value": "1bac4b7c16b091b855e2873abc111f35461195f1f79c824239b61117ee2c1e82", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684276820, "uuid": "814b7f5c-aff7-41ab-bb2b-36111f6a085e", "comment": "Malware payload", "value": "6c31ab8c8032b5a38f7afaa279b7da3d93ae4f8d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684276820, "uuid": "a5d3dd45-8858-4bee-8e24-0c2045f45b50", "comment": "Malware payload", "value": "42cd5355f534e064af65378a4791aff8c4ae4a1ce72560483fbd8752df2e2526055b05dc8c0a8327422e0f1dc3522fea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684276820, "uuid": "0b0b4af4-db0b-4c4e-ba65-07fbc0c1c950", "value": "T1584477D84B5128274B5F7E76B728E4B9EBA91EA4D2D0828BF40B7261F2DFD4CC8D0511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684276820, "uuid": "f1b05dd8-7723-4e5c-9b0c-2d3889fd219e", "value": "6144:PBEKsi3ZyofjdPMpj38k9KaFmK9n0Gezr:5vpy0tMxMfA05P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684276820, "uuid": "1f451e07-61d7-4aa0-8bc1-64af883d1225", "value": 271163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684276820, "uuid": "ff3317d0-43af-4f19-9d98-c88a6c0c6d66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684276820, "uuid": "89bae49a-1d95-4652-adad-8d244b70aadb", "value": "Chcypn.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9413808-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1684233504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233504, "uuid": "e16d89ce-f5bd-4168-a04a-6a4b29fcd1c3", "comment": "Malware payload (ModiLoader)", "value": "7f0668df692ebe7885bec671ff6a20a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233504, "uuid": "994f1286-fcc4-4da7-a8d2-621c30ba24d2", "comment": "Malware payload (ModiLoader)", "value": "1c366b8b66431b3393b66821445ff84bf75d9b3e6fb0a3465b9d1cbd2b447355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233504, "uuid": "fb512f37-3c1a-426e-bc37-71472848894a", "comment": "Malware payload (ModiLoader)", "value": "fd7af24162b5f6bdfbd1a8b7892b12a8dec0d2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233504, "uuid": "cc523f01-47cc-4ec0-bc3a-eac310973fe4", "comment": "Malware payload (ModiLoader)", "value": "2e936a66c4aa220a084ddf93acac42887ccfaec9251590470c90f43c22abbf4a7d7bd5f9538d15dc10410bc3ceaa653a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233504, "uuid": "f3cee001-c352-428e-9434-b0c1caf06d38", "value": "T1B9F49F52B2D1D433D0773A389D079F55B839BE612A18FA8A6BE53D4C9F397803818E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233504, "uuid": "dbb80e7b-c7d6-4a33-be7d-a7f94b654cf8", "value": "fb386a4602ead823fe83a40098eff040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233504, "uuid": "64bdbd3d-90da-417d-9440-a49d5ab4fc79", "value": "12288:QVxfM/PNmfig4qXnWy1ZsY2mTS7gazVb8N0K1Wq7jPGb:0iEfB4Q9+VIEujP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233504, "uuid": "91b73377-8be4-47fa-a6c0-ced18f1ba2ae", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233504, "uuid": "221a914b-b2b6-494b-a701-7563153f3f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233504, "uuid": "81af659d-bc75-4794-b1a3-8b6824a5826a", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e173d8af-f388-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684200474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200474, "uuid": "162a9327-5f5c-4d5b-8a64-0470df38114c", "comment": "Malware payload (RedLineStealer)", "value": "59f2e96fdac9a2f8ac7e697859a9d843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200474, "uuid": "78e74a6c-7a24-41d8-8874-7878c0a65247", "comment": "Malware payload (RedLineStealer)", "value": "1ca2bbd11100944616c4ca00395e9580b89d32b0b57a208f3dc21cc045363ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200474, "uuid": "bab68659-19c7-4275-ba0b-5f799bf0d9e5", "comment": "Malware payload (RedLineStealer)", "value": "4fff77789defd9e3253388c080fe9bed672b0298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200474, "uuid": "bef88df2-e0d3-443d-8258-558b04ee161f", "comment": "Malware payload (RedLineStealer)", "value": "477f84bd39da23633265aac6ca7c26fdd5699814fc11f4cdadec4874026b2d08027d086b5f95135daa7a2c91ba53ff0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200474, "uuid": "390ef8b5-22a3-4787-a951-0458ea7df497", "value": "T1AE452322E7D990A7E6F0073058F713E32F34BD93183681EF6745AD8648B26D46634B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200474, "uuid": "9bf7f2d1-23b8-4a99-a862-efdcab870716", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200474, "uuid": "31365973-496e-4af9-8101-bc188a1dd831", "value": "24576:RyWAG4NrdzdIc/SF8An05kO3S8djI2clVjk/H59OrPG3y:Ebfzdf7c4/5pIrlVvbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684200474, "uuid": "82376334-7eae-4534-b566-ccc6d24917e6", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684200474, "uuid": "e0152fc5-e198-417a-b77c-0c8e2f01911d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200474, "uuid": "94216920-69e3-45dd-976a-0270b56e3317", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f29522-f3f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1684244984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244984, "uuid": "039a8a46-50bb-49b0-ac27-8e2a4b733403", "comment": "Malware payload (ArkeiStealer)", "value": "cb9026bc8dd35f665ab36ce1fc1fe44f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244984, "uuid": "547b3539-9ef3-4dc3-bae2-085d838e1e73", "comment": "Malware payload (ArkeiStealer)", "value": "1e42d63ed11929379e5739414c944bc755fb2e212eb475777de4a7e0ef54c517", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244984, "uuid": "0deabf00-6c95-43ee-b044-38cb4611d4e9", "comment": "Malware payload (ArkeiStealer)", "value": "c27a0596d75884ff484cc2c2be0fed4435a73ef8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244984, "uuid": "05d16480-0ca6-4344-848b-4fe87c52e928", "comment": "Malware payload (ArkeiStealer)", "value": "b0ea2ff0d764c1ab11d0a65076bf0e574c8e082ea015c8c7bb587e491d898ba79ca063447e84aa9c1308d2b13b912eec", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244984, "uuid": "a059100b-9240-4d0c-8e01-b45f71d04b6b", "value": "T186848D4792E57C54EB254B73CE3EFAE87A9EB6104F59276B12189A2F04B02F2C573701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244984, "uuid": "c30d1f75-c09f-4f60-aa98-4a6ed1cb1dca", "value": "60946fdd5682e6ea801f7726d24d2022", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244984, "uuid": "dd74d733-115c-4805-8bd3-d9e781d88758", "value": "6144:6p7TeoxfDLo9IPscuvgtVoxIxsCsi758cZYvYrOnHNtzOZlYunkBSwb:AM9OsbY5dDrOHNtzGY/BS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684244984, "uuid": "2add9ac9-1583-4539-95a8-ba6fbb085a94", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684244984, "uuid": "86d68659-f3de-4559-a495-4e311b5f1e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244984, "uuid": "37a6ee82-435f-407d-b053-ccdad07ddbac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2539bb-f42b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684270505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270505, "uuid": "ba43128c-f7ba-40c0-b96f-4fd289e139d2", "comment": "Malware payload", "value": "0b1bdc6ed2e9c2b3087159e8bf06e159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270505, "uuid": "a564e67c-5849-427d-a6b7-e2a6e4509bbc", "comment": "Malware payload", "value": "1f422e4f9b170b5a7bc282522ef446326d523b7b99b291c98957e74dcb4affcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270505, "uuid": "a5e68a4c-68c7-4234-bb48-94e3900c6ccc", "comment": "Malware payload", "value": "50c67efbb7fb0248ac34e9970ed60faa4a147440", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270505, "uuid": "56828744-d5d1-4e16-89ba-f62d4fa29565", "comment": "Malware payload", "value": "64b7cb81373bc436b98231b44b48ecdede5e7fc2f0546f42e97a3ead3831e75ce1abbed5afa0d12ac85c6a72e81baf31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270505, "uuid": "8faa9456-e0ec-41d6-bc8c-587d3b6d179c", "value": "T17044F14B3AC70912C5559AB191D3093413F2EB5B67B3C3DA3D48429A2F027D35F8ABAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270505, "uuid": "15839842-569f-43e9-b444-2e55e857158e", "value": "6144:QelDePKKBOgB5lvI0gbiM/BkCV3xVN/qPJt9Bo15qtwNn4:/APTOgAuMpV3dg04w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270505, "uuid": "aef11e9d-2a88-40d6-b9df-453d9a64968b", "value": 264776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270505, "uuid": "2a032df2-5e05-49a2-b5a8-2b8e6e789045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270505, "uuid": "8be2c97e-7d21-49ed-b307-3805d0c59043", "value": "Shipping Details_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1841af48-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219034, "uuid": "1936591d-78e1-4eb9-8903-a0b908a9d1a0", "comment": "Malware payload (Mirai)", "value": "43a4e66a39f52dc0a1321108f93f7e54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219034, "uuid": "3747bc08-7d2f-4ee0-ac75-352f49ef150c", "comment": "Malware payload (Mirai)", "value": "242c97062c7c5ae433f2d71faad181f4221977506c04d89bc701d07c7f7524b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219034, "uuid": "a8ce335a-3f65-4f92-a193-78bb12ac7e78", "comment": "Malware payload (Mirai)", "value": "6621af8d4f61244d2a1671e8efc759fe04a0129a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219034, "uuid": "e299747c-09c2-4412-822f-b668a58c6848", "comment": "Malware payload (Mirai)", "value": "d1aa62d1c90413c7b4f7abccd29a6bc87cbfae2401648cdfd1f3d89dc7f799ae53e7317c335eb701832cc9b2c27e655b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219034, "uuid": "ceaa0788-f175-4626-a587-12d5d1584433", "value": "T1B3834C02F743C6B3C8830BB2029BAE665931BDAA5E2A9F45F31D3DF46B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219034, "uuid": "639c7349-d154-40fe-a40a-76516a84c774", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LbxwfhcVmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YvxwfhcVmEwVOz+ucx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219034, "uuid": "69b2f02f-9e58-40e1-a05d-0cb3d434b099", "value": 84996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219034, "uuid": "b5219efb-0232-4375-9339-29a519628acb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219034, "uuid": "85f8363c-7cbb-45e7-bd4d-7062fd4675f0", "value": "43a4e66a39f52dc0a1321108f93f7e54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e41ef9a-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243713, "uuid": "5fa4da13-35da-4ddb-b527-f3f530ec4cae", "comment": "Malware payload (Quakbot)", "value": "b444796e89b45888f0e4430d738fadad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243713, "uuid": "710ce492-7ca4-418c-9b90-ad2bb9e1394c", "comment": "Malware payload (Quakbot)", "value": "25446911e149e9feec7c1bde09ed1780d9afcd2d78f88a1750121840d8bafddc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243713, "uuid": "fe4f8041-2dd4-4561-9f85-8d71890855e8", "comment": "Malware payload (Quakbot)", "value": "ad554f8f7eaaf5c83f55c403a2560f1476fd505a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243713, "uuid": "b01f638b-dc8d-4659-acea-4f064f331532", "comment": "Malware payload (Quakbot)", "value": "25200a04601a1e29c9e34dd42d91aff6f3a3d9ec10aa68914ef806c3cb52953d81cd8b53aec33357a4d9f040b8a41082", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243713, "uuid": "f9930a4b-b2ff-4fa4-90b7-1cc1c0ca2f58", "value": "T1DB5434D04F2558A59B4BBC26BB20F5A1EBE50EB4C290838FE45B337662CF14CCED5619", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243713, "uuid": "cbc7e254-e5ad-488b-a702-c831f08a49be", "value": "6144:khg7MvdFRzEfNiSVQUy5C4ClAsFVxgeqfEpdKcP9k48kC/td:eR1EHdov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243713, "uuid": "a433f73f-2d5e-4855-928c-84e64b492f91", "value": 295555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243713, "uuid": "51881eef-9d73-4e4a-a463-cc8b6c8b4967", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243713, "uuid": "c484a954-a4ae-4f8e-ab27-e30e447ad6da", "value": "Dvbxbxjc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121de650-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234056, "uuid": "8678d647-f922-454e-8ca0-808d8c850fcb", "comment": "Malware payload (SnakeKeylogger)", "value": "a50e9848fed2dc00e766bed0c56da398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234056, "uuid": "e7179fec-bb11-44f7-8b35-0dd4adec66ee", "comment": "Malware payload (SnakeKeylogger)", "value": "2545ec0d17c3b1cdcbf59f4bf29be0ee5d1c983bf6824f01bb103ad062898d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234056, "uuid": "c61191a6-6660-4e68-9a22-0519484c962d", "comment": "Malware payload (SnakeKeylogger)", "value": "1833249550a5da69f1cd56b70ce110ab0cdf972e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234056, "uuid": "aa46eb4b-e468-46d2-a85e-116dfb64b640", "comment": "Malware payload (SnakeKeylogger)", "value": "eab0f7f449763a1aa13d8407aaeab8deb948a50c7e63ca3c1f2520ef23ca9dbccbd63cc0b0648182b1aa96b51c1ce552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234056, "uuid": "d5b6bf1f-c034-4b39-ac04-0737c71190d3", "value": "T1DF04A518EF94D53FC26A3770D45182011E74A9546D13DF1EECA4FF9A3B22B89493C2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234056, "uuid": "a7376a0f-a60b-42af-9d5e-3b1d17efcc8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234056, "uuid": "c81855b5-6474-474a-b2db-f92cc9ce493d", "value": "1536:3hZJbw3u8FNTTR6azyVHENSlRS2Slb/eE6q6uwPAefrM0tk+q3VTA:5oBBTR6azGxRS2Slb/J6NPJ1ktK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234056, "uuid": "3fd890ac-9f09-4eb2-8fcb-da261923a5dd", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234056, "uuid": "c07b866a-c056-4511-abe3-6a0d55658795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234056, "uuid": "c525b1a2-9309-487f-96d4-7ca0867cd758", "value": "Dekont-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7750f6-f407-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684254745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254745, "uuid": "08c6b872-ef7a-4ce6-b8ea-e304f1f9aba1", "comment": "Malware payload (Quakbot)", "value": "c6f92c87ea125db2db67d3718117fe7c", "object_relation": "md5", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254745, "uuid": "8601b9c2-bc2a-40df-91c7-082ea4361105", "comment": "Malware payload (Quakbot)", "value": "2571fd8ac75f6d6fd4dd716155f929a84699b115fb085bf27222e4f471119582", "object_relation": "sha256", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254745, "uuid": "b3a7a448-3b5f-42e1-96dd-5fe51bb4cf89", "comment": "Malware payload (Quakbot)", "value": "470404e7f8349b5e07781cb2d16765a823fa2d50", "object_relation": "sha1", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254745, "uuid": "20da629a-1220-4dfe-af83-c842f7881d04", "comment": "Malware payload (Quakbot)", "value": "fec4e6b2c3ee8a5cbe5a88ef52b9f0627fb81b30f3a0d2255eef38aa6b0f2e04e6ae048b37de62a2b74b2ea1b7407440", "object_relation": "sha3-384", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254745, "uuid": "74bf7f37-81a7-4d66-a82e-1d65ef699bdd", "value": "T10AF49E32B7A1C47FC31703B1484963552CFDF1A50D371B47AEAD4B2D2EBCA929B08A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254745, "uuid": "5a2e3f3c-be00-4e13-9cba-1d2184eec41e", "value": "70f14b5cb667842cb2030f8ea7a53ffe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254745, "uuid": "f719196d-a075-41e7-8ce9-6490b862269b", "value": "12288:wRup73d7AV/GmnKRu3I6MK9T+UDg2RAknSTKz:wQpbd7AV+mKRu3RH9T+UDg2RA9T0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684254745, "uuid": "533add80-bf1a-4f76-9f2a-b85383898adc", "value": 752470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684254745, "uuid": "59759220-8bfb-4ccd-a2ae-9fc53f2fff83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254745, "uuid": "46b853ca-dd83-430a-b206-15331d3ff91f", "value": "updatedatemeplease.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e82fa7-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684232995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232995, "uuid": "b3203e0e-593f-4012-93e6-78c863348c84", "comment": "Malware payload (Mirai)", "value": "477a0fcd7b201c4f383be0ce06247f6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232995, "uuid": "c9deb3d9-0d81-44f6-b4d2-66abd8377634", "comment": "Malware payload (Mirai)", "value": "25bb20c53624112b24617a07e5a9ad9e4f21c722d76e3bbc31d4c2df9bea6eeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232995, "uuid": "19074f60-6a50-4353-9e2d-6ba7ed0e1fa0", "comment": "Malware payload (Mirai)", "value": "7fbb979c6f4a7d757e4470558097a108e913867d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232995, "uuid": "99dd5964-e8ea-4002-aed0-49e1f76930d0", "comment": "Malware payload (Mirai)", "value": "da963dd1a1677b8c6971116071f0a9deb266d5328acb09110c20ead30d3a6e706685e0cdcb4729896aa6ef9e817a0e03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232995, "uuid": "22babc3c-c7b9-4e30-928f-b9bae2fe2f90", "value": "T197030A827C828E1AC9D81379FB7E43DC33112369F1DAB747CE148B2876CE51A4977A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232995, "uuid": "c8220713-2c13-4da5-b706-ab407c233131", "value": "768:5tNfIYYpT+3D3EPu3vpfXnO96n7/Q3nHF+isbGP0EpMvCtIDOm/klqLYROX8NSDE:bNQ1T+IPulO9U/GcbGXpMvCtIDOm/klK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232995, "uuid": "59815b8a-0c97-43de-a52c-f10e6ef091a1", "value": 38268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232995, "uuid": "3833b122-4393-4a1e-8d31-565cb56b7a5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232995, "uuid": "68bea6de-d675-4bc8-94a1-c155d1854955", "value": "477a0fcd7b201c4f383be0ce06247f6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84411d4-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684235301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235301, "uuid": "a3135739-3f4c-4d36-a6d8-19aefc0c75c9", "comment": "Malware payload (GuLoader)", "value": "752bdb32c281c4184e05a5466bdbd9fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235301, "uuid": "5076d2fd-56c7-41a6-bf12-095dcfb69ec0", "comment": "Malware payload (GuLoader)", "value": "25d75cfcb97f4594d2cfde218c3d098ea70069e3cbbaa95c8f1bdba8d342ec36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235301, "uuid": "4e9766fb-20f4-403f-a044-d22cc5a232f2", "comment": "Malware payload (GuLoader)", "value": "42a973e881d6731564dcb83f4eba1cf88b60a5ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235301, "uuid": "5e434ed4-3212-4406-9676-a7fc1ccfde64", "comment": "Malware payload (GuLoader)", "value": "6140cfc12f0d970be02b39759ced202789ef33d72dc4665aeb332d3191f80b06deca624c6a4c43d319929ac2e8fe4591", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235301, "uuid": "23d4e6e4-bc5d-4ba9-91cc-d321c67a6ca8", "value": "T1C87412122FD3857BF4D9CAB51DBCEE3E83B5866D412524434708AFBA6E364634B8B704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235301, "uuid": "635b7769-9b05-4af1-a0c0-2bb0c6a8c6ad", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235301, "uuid": "e70509b4-b5d1-4a7b-ae55-35d88b940d1a", "value": "6144:h4SUjhtXAU7j4v6UcAEvtPR8xBR+c5H9ByjuGHK2Tb+w/B5HQFtbSJPB7A9K+:6XAUYwvL8zR+c5HHyjO2nHvwFtbSZBMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235301, "uuid": "e1f11038-58fe-4716-ad09-defffd6500df", "value": 362241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235301, "uuid": "f7befee1-9c3e-4503-9004-b91932b57680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235301, "uuid": "1be360f8-96b7-4230-802a-0c668e91392d", "value": "Dekont_16.05.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5a3d3c-f401-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1684252089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252089, "uuid": "3260d9a8-0d4a-4634-8d02-0cf2ea5ed1ed", "comment": "Malware payload (Glupteba)", "value": "444af2d14274155df027a61cb304b88f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252089, "uuid": "eb387376-ff82-4d4d-9ad6-85360a901449", "comment": "Malware payload (Glupteba)", "value": "2623d7e4c87307b1f05e9343ebc4e5c1550e4341da1781bd82d8995ef93e7715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252089, "uuid": "be93a05b-8396-4111-ad45-80a75fa72436", "comment": "Malware payload (Glupteba)", "value": "6f112b5a39e44c01ee93e577ea95fffb3b04ad5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252089, "uuid": "02788c39-bb9b-47b0-9904-f08ebab023cd", "comment": "Malware payload (Glupteba)", "value": "6e641b2abedf2ae0ae6544708ce31952dfd3bcfbe79e1f9484f1e8f6e70d2a4e86f1fb0222408629208281a7cbfda5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252089, "uuid": "2e18e600-ccd8-4dce-84a4-cc330abd1bab", "value": "T19C16235292E17D01FB598B379E2E9CD87E8EF1504F58376B122849DB87B32E2E163350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252089, "uuid": "b43a060f-73fa-4ed6-9562-47a05f954b2d", "value": "1952ea510032cb3f71e8e7073aa425fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252089, "uuid": "5615843b-68ae-43d0-b508-131a601c0ff8", "value": "98304:ALXGtqfij39yYWBhjCRP95mmLIbiPmNRcnn/vSlfeunv3:SMZjEY4hORFLI2PYcnYfbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684252089, "uuid": "813b3223-1a5a-4ce0-9562-b064d05c7968", "value": 4383624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684252089, "uuid": "d7bc5d8c-06e1-439d-89d3-d83c1deb5e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252089, "uuid": "3e5e5895-a680-4a4e-91b9-5ecc3eaffef6", "value": "0x0003000000000739-143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df932447-f42b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684270479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270479, "uuid": "942ac635-60de-43e6-bf82-8917df31cc73", "comment": "Malware payload (AgentTesla)", "value": "3985f1b2a6f67cd9f01832f5d5165127", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270479, "uuid": "39ca8673-6230-4183-8755-68bebc023ccc", "comment": "Malware payload (AgentTesla)", "value": "262d5417efa24ce09d412082de20448c2a26c41f0c3b6559b183c3ed580f4503", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270479, "uuid": "30f00776-7471-4c52-b1e5-f726643e64bf", "comment": "Malware payload (AgentTesla)", "value": "9b15bb39a6300e58894878e1f89eead389e49f0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270479, "uuid": "795a2051-aa58-4379-a171-c36a941c731e", "comment": "Malware payload (AgentTesla)", "value": "ba51f6845ac81c82efadae2fb72c2abbeb9d7c575cf9096f3766839f9511a10b080b44700c9cd73b94fc563baa93b81e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270479, "uuid": "6c93f408-010b-45d9-92c0-c329388387c8", "value": "T135933B795F9DCE17F5AC27B5AC5E00A467BCD50A9843FB0B06042C6ACEDB7E00963786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270479, "uuid": "8c84d467-6e6c-430a-886f-06f5cdb450a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270479, "uuid": "e0144db9-c525-449f-a59c-42ae06287f1f", "value": "1536:7LGz+xsgixwMtlDeUDKt87Z0Qeqb4ply+p3ch0MdKD+BC3KH7NeYRNv:1xsBwY4+Y3E0n+BC3K5eqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270479, "uuid": "f7cecb49-0f86-410a-8f43-2b267e7a8405", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270479, "uuid": "a297cee2-f2f3-4c21-803e-b95dc1ccdc91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270479, "uuid": "215aaaeb-c27b-4cc6-8b0e-90099273a817", "value": "att1-230504013825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f66b36-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219089, "uuid": "33b1cf94-457f-4c83-951e-a009ab3364b7", "comment": "Malware payload (Mirai)", "value": "51798a119f4c9a0148d6a2170395b072", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219089, "uuid": "bf970c17-ce2a-4556-9e52-f4073a70f5ee", "comment": "Malware payload (Mirai)", "value": "27d6187c016d10afabb437b27bc8623b363401d56754d7f62967ceb19e6d9c28", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219089, "uuid": "0b2f673d-c5fb-4c65-a86f-c34de58232fb", "comment": "Malware payload (Mirai)", "value": "437b3a7f8671f85f66a230b2e9631da56d067b19", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219089, "uuid": "4f3e907a-c9d6-4d8b-8107-2c9856f8fd43", "comment": "Malware payload (Mirai)", "value": "c533d27a23cb86d2b7913f6189de93373a8e313a81c585277aba3a70c027b5ab973398b5f0286a5020e84a70fe76a903", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219089, "uuid": "4cb0c9c4-3612-4af0-95b5-c13d254ce82c", "value": "T1F1935D27F552C67BC08752B42BDBEA615933B4BC0B32720B33E47DA52B219C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219089, "uuid": "ba7bd359-d90f-474c-b6ac-66fd1e1a9a25", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3MSZmA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKc+m/KWOXF7aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219089, "uuid": "551a8aa1-918c-4e3b-aecf-e354c1bf4d21", "value": 94676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219089, "uuid": "39732239-17d2-4804-9bff-a6ee7cbef958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219089, "uuid": "9cfd4b9b-2383-452d-b1b4-2ecd3743134f", "value": "51798a119f4c9a0148d6a2170395b072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9075da4-f3cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684229638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229638, "uuid": "6d6aa831-78b6-46de-adf7-79a517df8338", "comment": "Malware payload (AgentTesla)", "value": "db440bf93422632e4b68357488beec8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229638, "uuid": "9aa7aa4a-aa64-4a7a-83bf-f99179a57414", "comment": "Malware payload (AgentTesla)", "value": "27f0108dffaf853ead64f1372712383f02a98f8bf075ffa311eb4ee51a4608c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229638, "uuid": "f4b90d9b-a0c8-487e-b278-aa4ea197a2b2", "comment": "Malware payload (AgentTesla)", "value": "d0238fa05b550c460ea187acfebf252630cbe9bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229638, "uuid": "308578e2-4890-43af-8f28-6f351cc8a4a0", "comment": "Malware payload (AgentTesla)", "value": "4bde0b2da30f4632e2d97ce7259406c8678ebb60e23fac3299aa733d14afca262a15a6b95392c772d6a1115c2d377175", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229638, "uuid": "3ef89c3f-316a-4226-a106-45a8b94213e2", "value": "T1C3A423C58C3AC183162F9B1BAAB0A6F4CA516DE20055723E37BF796A1FC630193D8D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229638, "uuid": "c1ded811-0666-4eae-b14a-665eaf06abe5", "value": "12288:1lyZwKvZwJ3FSvjSbysp78Md8ALfOH7JHUJ03fdKpr:uZZwow7p75LgJHUe3qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684229638, "uuid": "1a541a4b-114d-48ff-aadf-4bf20275167d", "value": 463586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684229638, "uuid": "f489abfa-24ee-4525-98ea-f4cc4ca2ad46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229638, "uuid": "89dadb29-adfa-48ef-a0b5-27b64aaf9950", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7363c47-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684232212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232212, "uuid": "33e744b2-c379-4adb-aaef-f6a9369e11b7", "comment": "Malware payload (Formbook)", "value": "13111fe1d66ed7a2ec173b4f225d6b5f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232212, "uuid": "5ccdbf1e-dd1b-4300-b495-58e9e87cc69e", "comment": "Malware payload (Formbook)", "value": "284c0a8ab75712361b38eed70255fd82f615550058f8e61d5ffb909cefccfdad", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232212, "uuid": "facffa77-1ddf-462e-853e-b066560d99b0", "comment": "Malware payload (Formbook)", "value": "c4748440b2436f33484f98633b6358c8f86ed690", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232212, "uuid": "096c4107-2ef7-497a-98b0-f258a17a6e84", "comment": "Malware payload (Formbook)", "value": "a50ba6153ad9a27b376283da7890330b36a7fbb6ddb18246bc10e47ecd7ff0708b0e8b71a57ad29afa1ff048cc4e423f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232212, "uuid": "98288278-b1f6-4ec1-9565-17df7c81089d", "value": "T1D2F423E43F4058CFDA77B232268AFAE7E710156B17474E0E5342C24F5666CCBA33562A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232212, "uuid": "8369e2d2-7c89-4b98-80a2-2e0d784491df", "value": "12288:XUTQmSWFQcVf4EJI2YsKfXbsh29mBE140c9E3zBaa3m6yZvusqg8mXrQJ5AW9ATZ:XUQrW75JSsKQho4H9US6m3EJmWWzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232212, "uuid": "6c292ae9-fe71-4e87-be56-9183943fafdb", "value": 775030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232212, "uuid": "93a375e1-3b01-45d8-8d4d-bc21f9db3523", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232212, "uuid": "92eab52e-7173-407f-83a2-384e3b6dcdef", "value": "new order request.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b3ba65-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243724, "uuid": "4514cbc6-5a3a-4492-be8d-612cb8c0c855", "comment": "Malware payload (Quakbot)", "value": "f8ba2cef95bab307a370bb0d0a570c94", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243724, "uuid": "c3d18b91-d81b-44d7-9cb0-a5225931f79f", "comment": "Malware payload (Quakbot)", "value": "289678349269a8b1253121f9a47e1de8622d6ec73e766bfaea99d834cc0c3a4a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243724, "uuid": "6f5f1106-41a8-4ebc-a7a3-720c8413c20f", "comment": "Malware payload (Quakbot)", "value": "f04bbf98102ce86deff80d55899c5db03e5d199a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243724, "uuid": "bb5416a5-36fe-4ece-a7a4-0f724a48c883", "comment": "Malware payload (Quakbot)", "value": "d3ba009f18d777df01de366ed7145e0d8c33ae0c35442ecaed3f42bb5f2bd6450788c8ea89528d98ed637c5721e4ba14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243724, "uuid": "f86fcbd7-be53-4c02-915a-ddfc736681fd", "value": "T15C540C90428594729B9BBD266B30E5A19ABD0E7082CC578BF49E3364F2DE6CCDDD5330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243724, "uuid": "ef5a58a3-292b-43ce-968d-8965fa2c21c9", "value": "3072:2fRYSI57O7kDRTlwt0BB1C4xI1uJMZvexh/ek:uy7O7Se41C4+1uJMZveqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243724, "uuid": "e11ea51b-869d-426d-ad02-0ba154baa151", "value": 285960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243724, "uuid": "13ee55b7-b2d6-4bb3-9843-2770ef06d48d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243724, "uuid": "229c06df-ec84-40b6-aedb-d66f0f7c236b", "value": "Miwoad.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896f43de-f406-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684254443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254443, "uuid": "8c600887-a0cc-4499-9409-5edbe2a5a5c6", "comment": "Malware payload (Amadey)", "value": "13c6b003e4cd8319299a50a51e14a222", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254443, "uuid": "7fb5b1c8-f43a-49ba-b952-d2536e53360c", "comment": "Malware payload (Amadey)", "value": "28f5e5e43a67a48c6a41f9814a50b6faf5d20dfee6b17e867429efca82394681", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254443, "uuid": "d2260550-ec9d-4ef9-846c-60e9c81f7ac6", "comment": "Malware payload (Amadey)", "value": "00f9e5a0204defd1a569bfbdf0c690b351349dde", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254443, "uuid": "ba5f299a-7dae-45e5-b162-c553e3daf39c", "comment": "Malware payload (Amadey)", "value": "f46a6c61a9c2c4b929d8f3f0f64739b4a1b2bc2487e45948fa5c301e15a9afc86e4184905719af0e6f0ea78ae46d5656", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254443, "uuid": "923392b9-5721-4625-8100-c3173dc36fb5", "value": "T12C24F7667812C031D560A1B629F5BFF2C19D6829ABB049DB7B800F77DA112F73970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254443, "uuid": "11d4cdd4-50cc-449e-8310-99ea0da913c1", "value": "30345caf7ab375dfe19647a32bba1efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254443, "uuid": "13aafa21-6031-453a-8146-c0d42ef00f72", "value": "6144:tWh1VL9EWeJanEYL7OuuT7Ujz41FiPRL:tg1VdSYL3uT7e0KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684254443, "uuid": "becbff46-8cd3-4085-b2d0-f76f1685972a", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684254443, "uuid": "a95f4ee8-7074-43f1-a077-353b04a10809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254443, "uuid": "8393c11d-2c22-4ec7-8f9c-4cec63058e31", "value": "oneetx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a00642-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233572, "uuid": "02cc7417-90a3-49a8-9f40-865e1c564c54", "comment": "Malware payload (Mirai)", "value": "ae6596563add7f5df4b09dbfd3afd682", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233572, "uuid": "7d48e607-baa2-4682-8178-b0841f04dd9b", "comment": "Malware payload (Mirai)", "value": "2a7459e7cdad3a9f339507519bd217effebb1260caca3470fd36667ab6cafce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233572, "uuid": "02d0c890-6038-4c36-88ca-361a4cf8f1e8", "comment": "Malware payload (Mirai)", "value": "b6694a9419124ef0bf54b3e58d7d47f207cc0b7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233572, "uuid": "0f5c8970-118c-4e58-a2bf-7735247f1485", "comment": "Malware payload (Mirai)", "value": "243d742b45ac6a0b224b525cb4bbe5f8b8dd298d6edb118be2992bbd9c93baa37f328525353ed55285a010850ff3f6e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233572, "uuid": "3a565116-1c10-452d-8315-b614ff0657d7", "value": "T16683C50DBF621EBBD85FDD374499170124CC991B21A53B6AB238D819FB4B24E1AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233572, "uuid": "4a704193-ef0d-4451-bc14-f70303e04d5b", "value": "1536:4of6gxad3wnGIa3gQpWADL3yqQk55o03quH2glz3L5k:4ofvxm3wnGJtsuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233572, "uuid": "56f873b2-89c8-466a-97d3-9d03cee7b0be", "value": 81864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233572, "uuid": "9710bfe6-bf39-453d-bd14-a5318981658b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233572, "uuid": "9b56b0e8-1d28-459c-9f40-9b86ca3a3ac9", "value": "ae6596563add7f5df4b09dbfd3afd682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082a6663-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684231892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231892, "uuid": "c496d6e4-d677-4008-a3b7-afaea59a3c3d", "comment": "Malware payload (AgentTesla)", "value": "5fc7a0ae9a0907d23f74d24889969d45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231892, "uuid": "7abf4144-4527-43f1-ac97-cbef3690a83b", "comment": "Malware payload (AgentTesla)", "value": "2eda79ce3eef34dc8b236eb70ac36c6d9ec62f3e3c7364aee2acd9811ed3251c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231892, "uuid": "f301fafc-fc2f-4564-9a05-f1741dfe18b5", "comment": "Malware payload (AgentTesla)", "value": "f167693e4daeb1ffce78d94594a9b544ce538b15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231892, "uuid": "cc1e98ea-8a09-4867-9c78-b2c5f9419e1e", "comment": "Malware payload (AgentTesla)", "value": "1438bf930c01393a6cf03b6f06c1697b4c86d3ff1f3a3ba36bfda0c0e3698f82a46373152e8ebec049b8359d5e4a2acd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231892, "uuid": "2e130713-71cb-4336-b761-106be7df3350", "value": "T12503F1B614B729EDAEB2F510681A01E35103B3C3F132702A2B56D579E5C4EB4C3EE86D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231892, "uuid": "bbaadda2-fa9b-4db5-b295-8399e6026aea", "value": "768:83mZEoFB5DhTdlTmlu/UpW0GhqaInUFYDQ1su9KfB+eYqoPb:4YlH/TvTmlucpW00IbDQkjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231892, "uuid": "739cd192-829a-418c-a52d-e9ce5c0a6c3e", "value": 39266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231892, "uuid": "59ce3f70-39af-4c64-83ab-df157ba11301", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231892, "uuid": "23056bd5-93ae-479a-905d-f2d1ea6af447", "value": "Payment Advice - Advice Ref[A1WBFVjTVOhi] Priority payment.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c80cb96-f3f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1684244972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244972, "uuid": "3d51ad77-1c74-448a-8f00-fa51f645c974", "comment": "Malware payload (LgoogLoader)", "value": "a738a33f882c7082a98b246126228895", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244972, "uuid": "a580221b-2430-4889-9f79-a0b7885ec73f", "comment": "Malware payload (LgoogLoader)", "value": "310374f06e4f91f3392b38da586fcdf3f5183974df9f9a4b37edba39b2aab5b1", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244972, "uuid": "d09c43dd-c776-4958-a5c1-5ed52f47c0ea", "comment": "Malware payload (LgoogLoader)", "value": "0fb74e1cc79f64eb718b2ca2fd29495baa064973", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244972, "uuid": "3d5b35ed-2b56-43dd-a44b-c34d50517387", "comment": "Malware payload (LgoogLoader)", "value": "6e8a3b373418a767aa710a96ee2158996529c964d78ee4a870ed83b1ce098bf092e5c49ab5691d706cfe810c2f8e4375", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244972, "uuid": "a01ee689-82e8-4d40-92e7-bf7e459a5678", "value": "T145656D3439FA502AB273EEA54BE475EAD92FB6733707985D1050034B4723E81DED263A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244972, "uuid": "a843a821-61d0-453f-a718-bb743957be83", "value": "12288:XO8Z33ShEvoTOC4E2Htn2LLee2sCNOUFhqWXeTGtI3Tlv+5t3PwuZDUqPmQrvJ/c:jd+TkI3sPVUWKox2I2bti5I7dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684244972, "uuid": "cec10fd7-d2bc-48fa-befc-9b766fabb2e9", "value": 1533304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684244972, "uuid": "3b503ef1-2c73-4a9b-98fd-5009e224b6ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244972, "uuid": "06ab5add-0b96-4b11-843b-ddf11c0fa23c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7652b000-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210172, "uuid": "41619284-3c6b-45d7-b44a-1a64e6c70485", "comment": "Malware payload (Mirai)", "value": "35ccf25e8a030b10ec1031e39edf2f19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210172, "uuid": "479607ea-79b3-45dc-b984-3c32729a566a", "comment": "Malware payload (Mirai)", "value": "3200f00358e53603e44a0a1231bb167f35bec2bd703b36a4ca36e6dcac10546e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210172, "uuid": "33b85411-556a-403e-93bd-9a7280dbdbd3", "comment": "Malware payload (Mirai)", "value": "a28f69f7d2bee281a507dd2bc7dadb3e16ff4c9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210172, "uuid": "c9982362-5199-4d44-9f3c-ffc251c3ec41", "comment": "Malware payload (Mirai)", "value": "84ed45ef4467176688581bb45a63dbbd2bc67e997c29f645739744146c007f5f9ded94338c1b34058bc3777b1a59358a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210172, "uuid": "5d44d857-0776-49eb-8a48-8005344b9f2d", "value": "T1ABA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210172, "uuid": "aa9130fd-58d4-4a84-97aa-26c917aefcc6", "value": "3072:VK1z13U6HzHoXRtmTUhQogkEmmFVcqq0GnDZT:VK7DDeKlogkEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210172, "uuid": "882c437b-6a64-46f2-aeae-cfa81f4641fe", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210172, "uuid": "1ea0cd6b-908f-428d-ac77-a008b9ecb9c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210172, "uuid": "8acf6860-6438-4a85-8622-54d9ab430389", "value": "35ccf25e8a030b10ec1031e39edf2f19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14367d7b-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684232771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232771, "uuid": "6c685ab2-0ccd-4749-aa91-3b15f29e42a2", "comment": "Malware payload (GuLoader)", "value": "1f7446d4912e33d9276aafc049edf4dd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232771, "uuid": "059c46ae-3363-464e-b777-9e55fb4af41f", "comment": "Malware payload (GuLoader)", "value": "346d79c4efeb9a4fbbbb16149418db05637cd75636cf284758c3725da3715b3b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232771, "uuid": "ec9ac5e5-7a71-4a1f-926d-9c2d1832c920", "comment": "Malware payload (GuLoader)", "value": "707a756ca7af723e0b49f5101d6b9ff4ab68bc76", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232771, "uuid": "8b4598a8-14d7-4bb3-aba6-2cb591121d96", "comment": "Malware payload (GuLoader)", "value": "edfa614332597f754127f606ebfdb35eab17736ddb99c3c26632d3b8da96dae9adfaf4e290761b00cb1461122ec36c39", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232771, "uuid": "caf1982a-89dd-4150-9ea6-29bf1a54a72a", "value": "T181F2F2758A5FB1FDF864B223932453DBDAD914EB6782CC48E7DD773410B40350B51694", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232771, "uuid": "57ed4dec-fba4-4f14-99d5-bfdc192066e4", "value": "768:Gj8iz/T7+Hd9dOIW8mLRBqM/VBYWwDKIrOhgs:48y60IVylVBRKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232771, "uuid": "86cd4c9a-a197-4dba-a1fb-284f5a199e28", "value": 35696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232771, "uuid": "3ad2f243-75fe-4c97-89fd-1b422bff0c76", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232771, "uuid": "1ec654e9-9e39-433a-8d8f-a7322ff300f1", "value": "MT103SWIFT_83738883746467_737466477282736637.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c83176-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234035, "uuid": "d75ce7a7-488b-4aaf-b939-af1096981127", "comment": "Malware payload (SnakeKeylogger)", "value": "c8ab0372feca29ce45e979c94fa0c90e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234035, "uuid": "c5a053d2-821d-4415-8042-6e6f54c670e6", "comment": "Malware payload (SnakeKeylogger)", "value": "3483bcc8e4d439c0883bd94044e95f23c4b674c0472af8e695594e00bbbf9dbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234035, "uuid": "bd63e30f-66cd-4058-98ac-4477392779f4", "comment": "Malware payload (SnakeKeylogger)", "value": "8456a465c3f92cebff8767d6f2cfe4b333d9caa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234035, "uuid": "57cbd47c-c4fb-499d-894f-7a3d2c3ed6fd", "comment": "Malware payload (SnakeKeylogger)", "value": "0cef3825bd3dddfac0314e1b45c27c8addbed012b8bf887ace89b70f9a6c32fdd7fee980de89ff3ddf660310b000c69c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234035, "uuid": "c8087015-f15f-424d-8ad8-a33775b0c298", "value": "T19A053DE1F19488D6E85B4AF17D3AB93010A37DDE94E4811C16ADBB1666F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234035, "uuid": "f319a8be-b649-4487-a61e-dfad612ac7c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234035, "uuid": "e3d450d4-0683-4a39-9866-e5e230080911", "value": "12288:OYkv5pHjNDVVuYYDuABIVSpxJJEVAHHjkdRVu:QTjNDVzYSABIURJEoDkd7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234035, "uuid": "7024a4b5-616f-4c7f-9790-644e915435a7", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234035, "uuid": "c4c2fc83-e012-4290-9b57-8f4dc96a75a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234035, "uuid": "13b3e415-9b09-465e-acca-23bc9d5e79a5", "value": "FgDh5l8umXEzPzg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb76f0f-f3e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241483, "uuid": "51aadc86-94ca-416d-a874-82cca1a1a982", "comment": "Malware payload (Mirai)", "value": "f4c262dfde0346d5476ab89200e76672", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241483, "uuid": "412a6031-203d-49d8-8e2c-f667de9e7e36", "comment": "Malware payload (Mirai)", "value": "3497a8ac9b3060ddb4d518b2da300819ab8a876bb3afa9c2c1c6b1583a9d7238", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241483, "uuid": "6df10259-831d-4ef7-84c2-f0af67817081", "comment": "Malware payload (Mirai)", "value": "3097e83056e1592cb406297961acbb5c5b222010", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241483, "uuid": "8abdaa6f-b23b-40a4-8730-1ee36da6b19f", "comment": "Malware payload (Mirai)", "value": "108c9c68d001834863b20e71f1a17ab6b4da558786be47dfd0d9ee1e4d6dddbad54420b2117b386846a9ac80a948020f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241483, "uuid": "bcde3f79-080f-440b-9889-c5066e48b55f", "value": "T1D3632A21BA761E1BC4C1947621F74B25B2F143CA26ECCA0A3DB20D9EFF71A446543AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241483, "uuid": "b96905a2-d3c2-4ee3-b1f1-db6f3a575009", "value": "1536:lGBVg7AOotXhGIAsQ/VJAGQTQm75YH/tatwV:lSCz5LaQmVNCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241483, "uuid": "2fb523ed-3e01-436b-8a99-5caaf9c5c714", "value": 67312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241483, "uuid": "f35eeef2-1bc8-4efd-bf2d-d8dbec385a22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241483, "uuid": "f7752a54-4121-4588-a365-f4e0ab0836f2", "value": "f4c262dfde0346d5476ab89200e76672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3164747e-f3b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684218217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218217, "uuid": "407ba775-6deb-493e-8820-90b2034ee8ac", "comment": "Malware payload", "value": "d01b36674e1e173bbed14e23fed0d782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218217, "uuid": "5d3d7795-6be3-44b0-a27f-a2f6b8a45b15", "comment": "Malware payload", "value": "35aa37e589b0a265e0c86cce1d83b761cc999fece18011eeff9ad727022d6619", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218217, "uuid": "48336031-f681-4cb7-b483-dda61539b93e", "comment": "Malware payload", "value": "229164534c8616241dc16090f9c0a25ee79a32fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218217, "uuid": "f156c597-3a54-42cb-9a20-44f16ac185f3", "comment": "Malware payload", "value": "8b0e3edaa56c3f9f9c43254df7aadfc95c01142550cee2e3758bdcc22329e38159df2b7d6b18fa19be897243bc402f95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218217, "uuid": "cc18cde2-9e17-498d-9595-ba8a2617836e", "value": "T17223F10D0E54D69C0906B1CA50F7B63C062A30B5DFA97639490A7B72E33A79D49CEF6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218217, "uuid": "c1419819-36f9-4b0a-8e01-163057544393", "value": "768:jROCjk3Isgm8mTaX8g4rTAE3C0exzzjgKizbN9ia5FGdCoP4HU1NKjFQc0:jRO73mMTaX8tTAGeViXia54dC2vKmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684218217, "uuid": "2e3ae05e-f694-45f7-ba89-840b0acbbf13", "value": 48154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684218217, "uuid": "cae6e2ee-26c2-46e5-9919-056007c283a2", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218217, "uuid": "771d4e5a-d83c-4e2d-bfc0-1569c8be7094", "value": "Dost\u2500\u00d6pno\u253c\u0164\u2500\u00e7 i pilne zapytanie o cen\u2500\u00d6.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270d586b-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219059, "uuid": "14217f74-8f71-4c00-b19c-9ffa1dc55cf6", "comment": "Malware payload (Mirai)", "value": "f89496e62373e7506951eafbeea3b065", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219059, "uuid": "1f1fbc4c-f513-442e-8d1e-e9a44f5c05fe", "comment": "Malware payload (Mirai)", "value": "3604ae40c8356071a055526cf930006049277430a2a401e3d3e7e68b3253bac0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219059, "uuid": "6ebc249b-23e2-4315-8e7d-011fb15544a9", "comment": "Malware payload (Mirai)", "value": "5d655d7a07728227966f4933600325a88b3ede19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219059, "uuid": "0a932fe8-f8cf-4ac6-a39b-bd058b1571b1", "comment": "Malware payload (Mirai)", "value": "8ad201d775373aa6933d7834d0fe38938564e5f328c0b86274f0b5da1ff27ab760856f7d064b680bf2004dce9852609a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219059, "uuid": "1f712bd9-4980-4f6a-a211-97f22b0db297", "value": "T1A9A30796F800EF77F40AE67604D34B24B670BBE14E532622731739A6AE762D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219059, "uuid": "f1abe3bf-d1f3-4d46-a135-210bdb4cd59b", "value": "3072:nkrWBIvC/IymEdH8ffPemuxVqDr78fz1e:nkrWBIrym+8femuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219059, "uuid": "bc79c5a6-550e-4fbd-8142-58019096f088", "value": 98916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219059, "uuid": "b29d1542-a780-4a8b-8c5d-20ede71ade20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219059, "uuid": "fe376663-455e-48ad-80b0-4d857233b7cb", "value": "f89496e62373e7506951eafbeea3b065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a810d3a3-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233019, "uuid": "731573f1-d23f-4782-9a7f-de31c0faa40f", "comment": "Malware payload (Mirai)", "value": "01f5f8a90d06898c3bd8a942a10e8b24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233019, "uuid": "62a8a69b-b372-4708-ae6f-ec9e2e3a736c", "comment": "Malware payload (Mirai)", "value": "36bb67cda2d889a84f28e1ee150e378cae5222c21b25d6661a43513cb9b7e12d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233019, "uuid": "38a34c63-25e2-4cf7-b3c7-37a602c6730d", "comment": "Malware payload (Mirai)", "value": "83d43884f0f40c8bd67c099deaf2c6e0c089f1e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233019, "uuid": "b6aa5d5b-79e3-4589-88ed-3014cbea1d94", "comment": "Malware payload (Mirai)", "value": "2b3eaf685110821d74a49ab5a6c65c80ec952a8ca7661a0d00c8ffaad9d2fa0dd282b5d730bccd43e101241e41d2da3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233019, "uuid": "f4ded3be-0698-4dad-9a61-f6102cbe9442", "value": "T127D2E02CD95D7D05C69D3DBE51DE5AF5398CB0C0A35DAACE03228448B61BA8BFC071B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233019, "uuid": "04500416-ba7c-475e-89f7-e769bc4523e2", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNV2fJbiWUT:1bDs06t4BEub4sU/MbUV2fmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233019, "uuid": "468d885d-d8a5-40bb-bf14-ae885968f122", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233019, "uuid": "c20dc9bc-bbe9-4b50-bb7f-974dacf219a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233019, "uuid": "a1641180-64e3-4b18-8559-93f00ca0c02b", "value": "01f5f8a90d06898c3bd8a942a10e8b24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f522f40e-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233578, "uuid": "60fd8fda-ba4f-4592-9bcf-27b94272ac31", "comment": "Malware payload (Mirai)", "value": "c8d7c2b4984da0b7d6c67c23e5b3afab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233578, "uuid": "cf917b36-2242-4cb6-aca3-e8dceb4875b4", "comment": "Malware payload (Mirai)", "value": "376776b380af9a3ed51d607f2695d05ca498ab584da4bfd38a5988513748fa2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233578, "uuid": "290acc3c-126f-42f4-a6cf-4f3c476d8a55", "comment": "Malware payload (Mirai)", "value": "73da79bcff74a831eaf8d70e2381072d07575ea4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233578, "uuid": "039a9c90-3e1f-4f3a-91fe-ef4148828006", "comment": "Malware payload (Mirai)", "value": "c02280958413b0c7d6fbe9690c3cbbddf8069382df46dee59088ff7a722e3f312b8013f7c4fa103ed07ab157a77c7228", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233578, "uuid": "43392900-139b-4a62-aa0d-9a4400aee2ef", "value": "T1EF234B8FD6C7D6F0DC460574212FFB7AEAB1592533B0CE6BDBD8F867A871500A00621A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233578, "uuid": "661d1c22-adaa-4959-b880-c0184447977c", "value": "768:hOkNYf2Q72GfAAflaV1Lw0x6KzOAlu89XwIafIPrpuFG7rKdLI/:hLNYf2Q72GYA23wau89XjFMSudL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233578, "uuid": "312ba0f5-1d12-4195-9d1e-1f53e0db6da0", "value": 49844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233578, "uuid": "5ee35065-aa7a-41d9-b7c2-3a9bf9a34ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233578, "uuid": "35d4a88d-d5d6-45a6-a05b-c2c21461f012", "value": "c8d7c2b4984da0b7d6c67c23e5b3afab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7208c6b6-f3f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684245384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245384, "uuid": "42221d35-a6ed-40ef-8728-f4f6f6642415", "comment": "Malware payload (RedLineStealer)", "value": "6f2dc101d99f3b38540c1bf0bebb4764", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245384, "uuid": "67ffdd95-c0c3-4fc1-8493-3a469c29f6aa", "comment": "Malware payload (RedLineStealer)", "value": "38b2fbe91ff70f66fb585cbaa15360052d817e608a004a4c87deb50a76336067", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245384, "uuid": "9dd1a841-15bf-439a-b6a1-2950fc1119de", "comment": "Malware payload (RedLineStealer)", "value": "0305f4401fc01678351929ebecc2b82f5c68d768", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245384, "uuid": "3790cd59-031d-41c2-9899-ba5572a683e3", "comment": "Malware payload (RedLineStealer)", "value": "8b66daad75a7549a859aca06f51478f80193e6491041da0c1f63d9821914846e221d36a432787002ef16da42c3059ab6", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245384, "uuid": "77dbde1a-58d8-41e6-87b5-a0de0ed4f398", "value": "T1F7452393E2E480B2CDA64B7018F653935B37BCB1D9B8866B6B891C574C722C06677337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245384, "uuid": "92907ea8-fa69-4a2f-81d2-eb507ae84896", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245384, "uuid": "f8f26b18-61a0-4410-b13d-6a2991de5688", "value": "24576:PywzckmO8clN9kS1n0FG38YbojqHBS9Eyt3yPNgD2vmwokG:awYkmfclH2wdo9EytiP+C/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684245384, "uuid": "16a830eb-274f-4478-be0d-d7a3e04f0abb", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684245384, "uuid": "b2c1bcf6-9f1a-48d0-b7f9-bf6601ffcf3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245384, "uuid": "d3e4e087-45ed-46d9-8b6b-421bee1316f8", "value": "download.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797749d3-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684234229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234229, "uuid": "26de0386-3a6a-4f46-8e1a-a66d3047673a", "comment": "Malware payload (RedLineStealer)", "value": "a1d3c9874698bc70f2df99e3b8f7fc9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234229, "uuid": "3c3d3b7d-c687-4e5a-8069-51611dced2ab", "comment": "Malware payload (RedLineStealer)", "value": "3acdadfbdcabba14d128fcbf5e81b7b9b86c4bc333cccf09ed9b565682deb5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234229, "uuid": "7802ce37-95bc-4439-9a00-4579acbb8a05", "comment": "Malware payload (RedLineStealer)", "value": "2f3d2e7a533b1515c75d5d979f8ee852f77f9094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234229, "uuid": "05c15911-1036-4202-9ea2-cd6c77926cbe", "comment": "Malware payload (RedLineStealer)", "value": "f926e05b8fbb0cef39d6c60bd4a3e32a3ddb1339a086a0229cbe20f8367fee2d85c3d09c6ae6abf67535bcae89a30d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234229, "uuid": "58681241-7b94-4f06-a601-e6718f94d2af", "value": "T15E45235AABE59431DDB617B058F303530B327C615E39873F3640989B08F3AE0A67676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234229, "uuid": "620a792b-d890-4d92-87f6-e060c7bcff78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234229, "uuid": "74f02f05-470b-467e-a692-fd1679e7e805", "value": "24576:ZypaSX7RdKnL1BhBwaOqryBsXpYpY/8O41O2PNYegDDsdwDk:Mpaq7g1BhkqryuXpYpiYOGODIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234229, "uuid": "7484d037-ffc2-4d2f-b936-7d98d31213d3", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234229, "uuid": "32730189-8991-492b-aa30-8be132233dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234229, "uuid": "a5e4c954-fefc-46dd-a2e7-9918b190e55f", "value": "a1d3c9874698bc70f2df99e3b8f7fc9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30380b7e-f407-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684254722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254722, "uuid": "7b392f64-149c-4387-9d03-a2657cd646cf", "comment": "Malware payload", "value": "1d7c420e4618044184ebfd7b98ff3bff", "object_relation": "md5", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254722, "uuid": "90d3134d-4870-4523-af1a-a22d43fba918", "comment": "Malware payload", "value": "3b9b3b1df35f8aede09768db8f7a8e6e2bc1aa5b1f775790fdfb727b12aaec64", "object_relation": "sha256", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254722, "uuid": "93d81745-4941-42c9-8b25-cd8136fcc99a", "comment": "Malware payload", "value": "8839a5aaf8de670cf11f2deeb242059996c5c8ae", "object_relation": "sha1", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254722, "uuid": "d6b0e761-7e37-4999-83ad-49cbd7216cc4", "comment": "Malware payload", "value": "b3d97f93271b932b2c10811605f6c00a08c63b405ed8c7f801b6e7413570601970773fa6c1b7e5e7b84f9c82471a1669", "object_relation": "sha3-384", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254722, "uuid": "ae9a0737-9304-4981-8e50-d2f37798c069", "value": "T1A9447290439568B69B4B7F26AA74C4A1DE7F0EB896CC568BF45E3248F1DE5CCC8D1320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254722, "uuid": "c18ec896-ed0f-4869-b428-ae20640c59b8", "value": "6144:plCVCI8N8qeBdJScCbAFxo61umQtWkkgfXMaq:LI71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684254722, "uuid": "bb116455-ec2f-4845-9e54-42940c5db20c", "value": 277953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684254722, "uuid": "954d4ada-a618-4765-8415-953649458067", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254722, "uuid": "425ebc65-92a4-4006-87f7-aba8f665dbc2", "value": "Petts.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dce2e6-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684234338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234338, "uuid": "af88b229-b219-42e8-b13b-fe8bc92c36a6", "comment": "Malware payload (AgentTesla)", "value": "ddd696091679e615c91d196a56be93a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234338, "uuid": "30089e85-4d2f-4c67-be1f-e2246b7bd2c0", "comment": "Malware payload (AgentTesla)", "value": "3c25129891ff7f42d7e9f551289e6ee945386a41c8de364b43258c77d19072bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234338, "uuid": "7ff898e8-a73a-4704-ab80-56a269ef979b", "comment": "Malware payload (AgentTesla)", "value": "9b798ecb5e47cab6c7edb61386ba346dbf93f8ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234338, "uuid": "2072df36-5cdd-4785-8d1c-46d1dfdc8bf7", "comment": "Malware payload (AgentTesla)", "value": "eee1df3adcf2c6aed69077f61fedd4eee14d95bdccbfe8aecf0a75e326ff80bc794a4225b6bd13e739a19cd6b39c4042", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234338, "uuid": "66ed5471-b53d-4073-82a3-d7b6b8ddfb67", "value": "T16AC49ED0B3E84685F8FA1BF55435892003B27E9EA878E61D18E138DF3AB37825451F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234338, "uuid": "112a4f8b-9fc4-48f6-b4aa-f14c629da6f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234338, "uuid": "db88ce97-ca71-4deb-8bdf-1369d13a0b81", "value": "6144:+CvZQF89OVamhgTXTS2hLYvoN7kr+WAOABpZFpMHoHS+guQzCbzVB8PQqZzHbHIM:+CuFjGTXZL407krCFyz+ezCn2b4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234338, "uuid": "527d57c3-1e39-4e9c-963b-6e0a03e3fea6", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234338, "uuid": "7941836a-65e2-4102-bcbc-4a2662e01cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234338, "uuid": "ad41157e-30ae-4c59-a24d-7724e07fd8d2", "value": "PO 2537284 16-05-2023pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c8da2d-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232774, "uuid": "e83cd2ea-2eae-43f4-a593-4eb3e2e1c44a", "comment": "Malware payload (AgentTesla)", "value": "19b5bd5dbc998fdffd473773941904df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232774, "uuid": "9bc6ecc7-9927-41ae-91d2-91d61ddb7759", "comment": "Malware payload (AgentTesla)", "value": "3d9753ff3f750d10fb81a94cdc1fdf1b4c8ff0f2e3750e7bf93c4baa23c95ab3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232774, "uuid": "b767ef6f-2b28-4ecd-9a32-a2df626d8cd7", "comment": "Malware payload (AgentTesla)", "value": "d337cfaeca968e1c9fc35d84c539b75a7571aa35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232774, "uuid": "30974794-7f00-4131-8fb1-f8e2fb9ee4ff", "comment": "Malware payload (AgentTesla)", "value": "f79ebd19713844264d5bc662d75e2e5cb066f9ee8ff4254c0ac956fdefee7093322e373f50d040f1c23a9149b406cb35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232774, "uuid": "323bf355-4bdb-4e21-857d-6d6786002062", "value": "T12BD4F169A2FA0F67C37943F655B426420BB471937D27C93C0EDE34C9EA17F600968A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232774, "uuid": "33284c6d-2b91-445a-b1cd-fc3ddffbc89c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232774, "uuid": "685077b0-6e55-4a2a-8fe0-5ee8801057e8", "value": "12288:JrysSmnXQGsZ1rF2C5p52WU1OwIGX7IhXiukBEIqzNub:9sbbNhdGX8tiuG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232774, "uuid": "44d25fb0-3e19-4dd6-bda3-ec5fb7d189d4", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232774, "uuid": "9c8604c1-75c5-4a76-86b0-fa3d1ef7a33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232774, "uuid": "0c0f8a0a-4cdb-4839-8f0c-3ab122edc852", "value": "SKCM_20230515_009892823055402,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06d1b54-f40b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1684256709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684256709, "uuid": "6db7b083-eff0-4564-b0c6-44484e87eaad", "comment": "Malware payload (CobaltStrike)", "value": "bccdade30ffc8d6af52592392edbd4fd", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684256709, "uuid": "7308a361-2784-439e-baae-cc4d725fb43d", "comment": "Malware payload (CobaltStrike)", "value": "3f1b98bccdfaef50f63b9752a50859e13c84f92821e38b3403399a9b11cbeed2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684256709, "uuid": "2ed0f96e-eadc-4d43-87bf-5db58a2e6899", "comment": "Malware payload (CobaltStrike)", "value": "a59f0c9ca4f8d95c2008d345c1e73c5a13e1add8", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684256709, "uuid": "142fdd56-f421-492a-ada4-da4415f3528d", "comment": "Malware payload (CobaltStrike)", "value": "feea14923c0b20275c0ebff47c30883d5f874bfb02661cce43aef55da6701b916aba1b491fbcd6ee3fa1b87196b25770", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684256709, "uuid": "ace4a06d-7709-4ab5-8470-73406409fdaa", "value": "T1D7C3191AF3A320F9C15BC17456E753B2F872BC211221AFBE8394EA752F64E906B19710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684256709, "uuid": "0f790572-24a1-474c-b38b-356c6bfd7b32", "value": "174b815bb197d8bd7399754d213ec18d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684256709, "uuid": "0e4971ab-82b7-4e0d-9b02-b7cbbee22cb4", "value": "3072:F7UtSEuxWA62hLRrFjl5pFWlPXkPasK3jDzTDQVtESU9:67ANhLRrMf3/zqK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684256709, "uuid": "3aa80f1d-dfd0-4601-8b52-3d4367929e8b", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684256709, "uuid": "a17b9a8b-052f-4a6c-88c9-c22d440cf82f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684256709, "uuid": "65b7f3d3-86d1-4dba-9db2-59e33218a403", "value": "bccdade30ffc8d6af52592392edbd4fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3170f8-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684232488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232488, "uuid": "08657842-adc4-4d72-9a47-389484c6f4b0", "comment": "Malware payload (Formbook)", "value": "b7dc4b65e6239c0d20bcb4b59f5c644c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232488, "uuid": "2d713a3c-800f-44d6-9f38-24d4be8622b0", "comment": "Malware payload (Formbook)", "value": "3fc300b0b16fefb8d0dc08f09803d7dbff6be6ea2a4c87833fb285499a3fc6f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232488, "uuid": "11cb4cec-a6a9-4be7-b98c-f1b9b2111349", "comment": "Malware payload (Formbook)", "value": "e166cebfa0fb6e9e04f64f2f61dca71b49ef9e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232488, "uuid": "0e9b9840-2aed-4992-93fc-3ee1cdc5b7b3", "comment": "Malware payload (Formbook)", "value": "0e2086daf9809b2a021a5fad6b04262429ee4da0efa28c76cbca953f6e8fcf0409a527b457c74115b53bf892726668cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232488, "uuid": "8c1bcab1-f0ca-4bb5-b2f1-d5b064d900a3", "value": "T16695563211DB1CDAE162BD76A7C0B12ACF5DFE7F063FA4A55491679A913F880CD40A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232488, "uuid": "fbbad9c6-b8da-41c9-a488-1f37104faf13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232488, "uuid": "cde573ab-b813-42d7-9bb7-701d7c7f26a8", "value": "12288:D/cOS13ZjYXegrTuXXlC+pEXdOMnmfVWWd8wWDOZQgOxwr:afPWDOZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232488, "uuid": "db885d04-012a-4174-8303-3ea6a8df84ca", "value": 2057216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232488, "uuid": "b5613beb-ea26-4c5e-8b60-df97148716af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232488, "uuid": "11087bd1-9821-4988-a74c-1b39a939b3f8", "value": "PO610008532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd187100-f3fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684250288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250288, "uuid": "927c9134-aec2-4c4d-b407-7887d88c452b", "comment": "Malware payload (AgentTesla)", "value": "705a1f88a8ef2568280a84efb1977e3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250288, "uuid": "dfaad811-08c8-40e6-b02f-53b6f9d31ecf", "comment": "Malware payload (AgentTesla)", "value": "405c9b3fbe1d2a384a8405eaec58eafe116b839170879773ea056bcd86dade74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250288, "uuid": "55544f1c-313f-4485-82af-8c73906cd870", "comment": "Malware payload (AgentTesla)", "value": "57bd61ec710fb92b26b3dfaab4cb48a714defe45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250288, "uuid": "c7307084-bb7f-4ea2-a429-d1ef93df21ee", "comment": "Malware payload (AgentTesla)", "value": "d0cddfdc17f0d48c31f5b934171f47fee216a9918ca8bed5350e218d766423e1578d758bfebddbdc4e6189696749dbc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250288, "uuid": "e47dec0f-9451-4ca7-99d8-31fd1319a9b7", "value": "T1FBD4E17060AE4694E02FCBB169FCFC72037134F3A9E5D9750B65A1C4CE2AF506E8895B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250288, "uuid": "b20872a0-6e99-4c29-b085-15e1c11d17f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250288, "uuid": "2099cbfe-84b9-4eff-a8c1-533546109a80", "value": "12288:zY6vv55je7F8BQuS7fjH85XtmRW16PlNovfoEIsylU:fHra7FKQukHQtmRA6PlNogt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684250288, "uuid": "4f3d26a2-2680-43ae-b0d9-09e21ad3c6b4", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684250288, "uuid": "d6914646-4677-4337-95b0-064861a4cbf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250288, "uuid": "3be79a9c-74de-4846-a2e0-3736e282b173", "value": "Order 403971529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734a3447-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684233360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233360, "uuid": "57ba61bb-a36b-4455-b3b4-2a9fe412e94a", "comment": "Malware payload (GuLoader)", "value": "097f98896bd2acd2b22db0fc6be81131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233360, "uuid": "d0ea2138-4117-449d-a23b-9ca7cae628ef", "comment": "Malware payload (GuLoader)", "value": "4188db231e5fa097c0b0e1a93a59ead87260d7439a8e91319ac3c58a158f0046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233360, "uuid": "f9db9e54-e165-4f8c-ac0b-77267610d916", "comment": "Malware payload (GuLoader)", "value": "335e2520e460f85babbc04e74e2ecbf0397813fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233360, "uuid": "f56db3d0-e47a-4fc8-a4e9-10eb60b1b26d", "comment": "Malware payload (GuLoader)", "value": "08be30d986178362ed9add8b726a337ec0353a0caf0034b337b8f89031b018b030b837b42ca0f2b4b7c0d7faad31309b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233360, "uuid": "248e80d2-d8ba-4a44-8ac5-3265cd0e50f0", "value": "T10AF4135AFBD005D6E3DA4BF68627027553636C28F225AB4723F37F226F31391A80E156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233360, "uuid": "c28178d6-c86d-46c8-a2bc-e81244896cf8", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233360, "uuid": "22175f1b-9d8a-4446-b387-eb63cb15a817", "value": "12288:2RekxhkCXDgklVRL7D0+3nkg/QC0cHwZ6lVKrwrBizfyxb:2BxhkC08PXXkXcQZ6l0rwrBizf0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233360, "uuid": "d17fced6-f51b-4e63-a97a-67dd37e861ac", "value": 765597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233360, "uuid": "c5299be9-552e-4e41-a905-7d203028b4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233360, "uuid": "720e596f-72a1-4eb2-9a64-de9b9a1745bf", "value": "Jalousiskabes77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e78f65-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684233586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233586, "uuid": "96ab5444-e4d4-4a40-b532-26c782004fec", "comment": "Malware payload (AgentTesla)", "value": "02d87cb40d9d9c093f3abd910549ed97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233586, "uuid": "911b40d1-b779-42b8-abe9-bc9a3a82ad70", "comment": "Malware payload (AgentTesla)", "value": "4279e95d6e73bfee362446cb9c60671a50847f6830f990b085b1c91e1491d9af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233586, "uuid": "7bcf3223-92c6-4d03-b3bf-8756d136bb35", "comment": "Malware payload (AgentTesla)", "value": "e2a620feee97d74db0c9ef2b8a508100b3131bee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233586, "uuid": "061e5ed0-307a-4b45-8758-1f39ca58dfcc", "comment": "Malware payload (AgentTesla)", "value": "3c708a32074d576b9c304b757011abbe1387e237a3e5be175c04d9f167c3329275f0fb64ae428504fe34e9782cb2ac07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233586, "uuid": "8fda74c1-9308-4090-beaf-6e1302eb5718", "value": "T11AD4E026B1FA687BC71D12FA0848054507F456A36D1BDAF81DDF75CAF9C6B802E898C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233586, "uuid": "cf8bb087-2be6-4055-8a7a-1b23e544407a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233586, "uuid": "84a3a717-9fe0-482f-a098-71e47f162b57", "value": "12288:6MIQeysSPFsa5cqBek0oc/sKHQURLdpua58nhaBFZEK+GPaJV:HF/cqBCkpU9N58hqEK+Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233586, "uuid": "89cf7c6e-a24c-42bc-87fd-0648d20e2f51", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233586, "uuid": "ae704c3a-de94-4b2e-a34c-650870401579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233586, "uuid": "7634b308-dbb5-48f2-8d45-3f418996c090", "value": "Pending Invoice 38129337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de194314-f40c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684257162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257162, "uuid": "a5302098-121d-4f1c-b217-53972e4c8089", "comment": "Malware payload", "value": "451ca952846ef937b770953c978aaca2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257162, "uuid": "9dc2e67d-c34d-4209-9f8a-8fb31e4311d5", "comment": "Malware payload", "value": "4295ea110481268b1aab0a3a7eaf208500e52074d0f764d657faefe278ef3c27", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257162, "uuid": "0b8d332a-2254-4376-b227-08c20a4d9bf5", "comment": "Malware payload", "value": "f9e816a6c8557b72236ba74fe3ae4eb5fea4cd7d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257162, "uuid": "f1cbec4d-0a71-4e84-ba51-ed9b447e303e", "comment": "Malware payload", "value": "6bdf6ac8e759dbbeed6052a773be9257d74114a211ecf6893e6a726c5e50f83a0bf4c1c2e580483eeca76c1b7ae818da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257162, "uuid": "4cc20c2b-a801-412b-94ef-8d49f03dec12", "value": "T132344398429628719B5B7D225A70E5A99BBD1EB083CC574BF89F3240F1DEE8DDCD1320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257162, "uuid": "099e8117-a9f2-4386-99a9-f35cb1a54d06", "value": "3072:HWUnNo+BefAAvIOwpgkuYHCLBeW3pOGHvWxXzWVm8NZhB+fcR2MV:HjNoLfHIrp1lHCLBeW3pOqvW4jhB+UpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684257162, "uuid": "453d6498-eaf3-4d62-aa6c-f41c34e36c2e", "value": 235141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684257162, "uuid": "64a3c4e0-91b4-493e-9cd6-310d05de5a9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257162, "uuid": "b6f66f9b-b604-43bd-ac20-af96f971ba83", "value": "Mjsbrn.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d753f9dc-f3e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684241688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241688, "uuid": "df8486af-2d96-4289-ace4-8416628b13fa", "comment": "Malware payload (AgentTesla)", "value": "45de8c4dabfd5e7345c181a38f62d21a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241688, "uuid": "8c5d6639-19ed-42b9-b0c3-350fba084588", "comment": "Malware payload (AgentTesla)", "value": "42b2bd90ae4218ed27c9366d54c43de67877b9f974c9231810000275c746e9d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241688, "uuid": "2908ab80-b52b-47d0-83ef-9753b2c6fbd9", "comment": "Malware payload (AgentTesla)", "value": "9ce690508c31a3bcde54a27819106ebefd03172f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241688, "uuid": "80bcff3c-e187-4ad7-a559-1ef81ba6bc61", "comment": "Malware payload (AgentTesla)", "value": "fc032d1d684dd8af2cbe4a5f379abe98130b79f5e940bbffda03ea32f7eea14f7089b0f8e8f0ccfd0647957e8b1a5dce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241688, "uuid": "ae6d263a-079e-4933-ba26-994bae3d3c0f", "value": "T1B5D4D07460AE4790E41BCBF165B8FD72037274F3A9D9C9740B29A1C4CE2AF506F8495B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241688, "uuid": "1c7c02e7-7cdc-4e1a-acca-75526b0273d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241688, "uuid": "77e59849-33b9-4790-a31a-ee26ef639ab0", "value": "12288:9YRv5h75b/qGPDYdsW1RnsDLxX0CpxzEX0Ja7okF:IPZCGPDYeW1R+1XLxzEX0JatF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241688, "uuid": "a37f857c-29a4-42f9-9116-c56b14e8a2a4", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241688, "uuid": "cc54a6b3-5d00-45a6-9a40-2df998184006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241688, "uuid": "5514e4ba-4dd0-4ef8-a797-b77ad3086d9b", "value": "SecuriteInfo.com.Win32.PWSX-gen.15720.2188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1872354-f400-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684252013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252013, "uuid": "0a0ff318-dff8-4916-aee2-82fba936f72e", "comment": "Malware payload (RedLineStealer)", "value": "3864b447df6ca315564e87add13fe2be", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252013, "uuid": "d4a9dd7c-936a-4edf-9c34-c4f54e348200", "comment": "Malware payload (RedLineStealer)", "value": "42bfbaf39d36e70f0aa9793a5f96c989a9ad52397716414377d17af3b0b97715", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252013, "uuid": "24094c93-3361-4113-99cb-e27d7008c60c", "comment": "Malware payload (RedLineStealer)", "value": "7f5923296b4d1619d78e456b991dbfebf7db76fb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252013, "uuid": "2ad3243e-23ed-490d-ac4b-6c4c6199cb38", "comment": "Malware payload (RedLineStealer)", "value": "915f59416386408c3d7069d1f2a7361f2db20d4c7ed0791bece1ddbb5ec94e4c595305e9ef4a1c5fbb2c1389ad100b7c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252013, "uuid": "aedcff8c-6878-4cee-8d6c-2ec6dffcd362", "value": "T19D452316BBC845B5D8B92F3118F342972E30BC924839932B3697999F0CF29D5987077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252013, "uuid": "7a8b9ede-6b9f-4e67-8f01-0f5f40470b90", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252013, "uuid": "0e24bf7e-ecb8-4985-aa68-c6220c9d4649", "value": "24576:7yYOBIPQr6CxKkzeiTsDdZKrQBuXstudkQm:utBVlxfz3uTKrQUXSuKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684252013, "uuid": "fa60f087-4acb-4a5b-897e-0401aa3e27a0", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684252013, "uuid": "14756450-1cbf-4bd1-9c1e-c17e1cf94e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252013, "uuid": "80eb21ad-23ae-4d25-ae7d-4697f634f087", "value": "999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749ab5de-f3db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684235939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235939, "uuid": "58b6d66f-85df-431c-a8d3-724f12625c85", "comment": "Malware payload (Loki)", "value": "934a33b25ecac3e1ed21cb2cb1bea48d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235939, "uuid": "38e3a819-8bbe-4ef7-bc02-725cdc4e7da2", "comment": "Malware payload (Loki)", "value": "4344b2c556cd47929c098414e69ab9e9c8d3a192258d84e990c32417ee728d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235939, "uuid": "c1a8689e-4f3b-4c04-aa63-c7afa7042ccb", "comment": "Malware payload (Loki)", "value": "a562900140b000454dc23d3b9b1d9a2972973116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235939, "uuid": "ec903ce3-1961-4ff4-bbaf-9bcd9ca59a67", "comment": "Malware payload (Loki)", "value": "0e0e6ec58f7e6834cfa193379eaad1ef20a62fc21ca9d2d24a64ac3820565c9311ea7d227acbaec409aea1a6bab5b5e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235939, "uuid": "04265e89-ff7f-4c57-8983-0b42c7774d2d", "value": "T11EB4E069A1F90F63C77983F654A825411B7462A77C2BD93C0EDE30C9F957F101AA8AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235939, "uuid": "f4ec2d82-6046-4a40-a138-925a43c86af1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235939, "uuid": "ad87a6ee-b855-4d60-a061-cdf24955a534", "value": "12288:3hysS4SBcQ0A+SQBI6zxBkEnT2wM0xWd0Vd5:Z0j0NDBTzxBBawM0Ud0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235939, "uuid": "92ba010a-6def-4648-9489-1534ffaacab9", "value": 531456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235939, "uuid": "dcf23b2a-7374-479e-a39c-2d9f52a34106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235939, "uuid": "3ac91344-a668-4092-a76e-7f67eb20371f", "value": "quote scan copy-JPEG IMAGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65411cdf-f3e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241497, "uuid": "240f472f-5381-4ff3-9126-163a3c30a6f9", "comment": "Malware payload (Mirai)", "value": "c8d0c79beca5ce8b32cd966e36c09e65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241497, "uuid": "070c10cc-cf3d-4518-8581-92eb3cca7a20", "comment": "Malware payload (Mirai)", "value": "449ec33956a59fef8f73afbe9f80ffa1668d88c8a67e5f37f85452761699b55a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241497, "uuid": "8a399c15-27a7-4827-b96c-67daf4d0ee1e", "comment": "Malware payload (Mirai)", "value": "7edaa7a55adc3cee66cd1d165f3748600b3c27c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241497, "uuid": "b3ecab57-9e97-4be0-8040-61c6fc5ceda9", "comment": "Malware payload (Mirai)", "value": "7a5d9fbc4347d4738b21075000fbeb54d9dea441eaf15d00c782113562b5cb28366ff12ae5c5b9e4ed07423d5849dc09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241497, "uuid": "e9835726-e930-4aca-99ec-efa4192d438f", "value": "T188730856B8814B12C5C512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241497, "uuid": "26dfac6c-dda4-4ef0-bccb-18499fb757f1", "value": "1536:2ln25xPBXk1wnnkL7+KEw073jfdEya6t0bIeiNNfsvHTGcV5GYIWV3:7xpXCMkMT9za4NfsvHqcVERk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241497, "uuid": "420e3c1e-4aec-4cda-a1e7-0d87a159b465", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241497, "uuid": "98ea95fc-8ad8-43c8-8c10-5f81fa5d5081", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241497, "uuid": "af6bd49d-10ea-434e-96e3-4cb5e7400335", "value": "c8d0c79beca5ce8b32cd966e36c09e65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ed6e19-f3ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684242605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242605, "uuid": "ea56e8d9-36a8-4916-8f65-c8deed70fe14", "comment": "Malware payload (RedLineStealer)", "value": "a9cc8a6f5ba6d65d9d05fac3d6967c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242605, "uuid": "9e71960a-b310-44ae-8468-6091dad34b98", "comment": "Malware payload (RedLineStealer)", "value": "46014c170ea305219338090d42375c14ba1cfaaf520b6124b0b7ebc540620d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242605, "uuid": "885e821e-3760-4120-b104-867b6da6d7e0", "comment": "Malware payload (RedLineStealer)", "value": "fba72d063038b974bed397c957c540e13a7ffbd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242605, "uuid": "f40ed1ca-e8d7-4265-a0bb-7fd04ddcb759", "comment": "Malware payload (RedLineStealer)", "value": "3db51158f853fdd83523f256459822fc10ceba7c2f3f9210a3f8a1576d98d396d3a7fd5af280e8c3ed81d1d0fa202db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242605, "uuid": "bba63860-8b3a-4e9f-a065-5a334194d88c", "value": "T1C0749D0070C49538F4E6ACB18CC5AB7259387EF1EBEF91C7A395356F891BED53A60281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242605, "uuid": "031ebfb7-fcc4-4ad2-b677-6bef5d392f49", "value": "46c74cf13312d6259105eaa206ede1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242605, "uuid": "b30f66d8-f693-41cd-afe9-d603274e96ac", "value": "6144:Xf8RV7Ngl7RNH40arFTBL/Qc70hALufCyKM/o3g1Oht26XZFK:XfuRNgp4nrFtLKhmu6hM/olAME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684242605, "uuid": "46e6df06-71bd-4b02-b6d1-ef7a5f01344d", "value": 357000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684242605, "uuid": "9c6889e0-2624-4e70-a531-5bbbbf480ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242605, "uuid": "b048d304-d087-49b7-907f-a37f53b54931", "value": "a9cc8a6f5ba6d65d9d05fac3d6967c30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98531769-f3d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684231275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231275, "uuid": "b2737be5-5743-462d-affb-39e05c5617d6", "comment": "Malware payload (Mirai)", "value": "938d5a25bc32d60f52355f01d256fc9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231275, "uuid": "30f8c369-4f08-434d-acb1-46faaa50d255", "comment": "Malware payload (Mirai)", "value": "4756c600a4c51c2b6d484612401992fad17bbcb78ef41578b7aa9fed2b0a03d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231275, "uuid": "aaa88a0d-ca10-459d-bf63-77ef19b12c01", "comment": "Malware payload (Mirai)", "value": "c24a9623f56fead962c67ce362e8e0e59bb3fc25", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231275, "uuid": "66c5f2e3-244e-4115-a216-1853f64be351", "comment": "Malware payload (Mirai)", "value": "a535b82791f4cd9e241a42c43d54a9c4992acf2a5b4b41e1504cb5c265a9f625b4c141af502e47a285d72879485e081a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231275, "uuid": "42115e31-4f22-43a0-babb-dc16f5b64bd0", "value": "T10DC2F1BF76996A67FA5C233DE035801F0395F52C97AD6B8B57404032E98E42D3932CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231275, "uuid": "0df8408f-3f62-458a-a489-16854828d948", "value": "384:Mg1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHEat9q9:RMwxdyoEUnDz+Y8tqHWXmkatowr0NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231275, "uuid": "086f35d7-bf1d-4fea-8be4-53af2cf7ebdf", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231275, "uuid": "4828e64d-dc67-45df-a483-92cbbd0803ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231275, "uuid": "d7333aef-f17d-4e31-b7f7-d6eadd560e7b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bfba09-f3dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684236936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236936, "uuid": "154a29af-f793-4ea8-afa1-baa9c7df1d3f", "comment": "Malware payload (Mirai)", "value": "3caba48e6f05d1e9124e2e4b09c14895", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236936, "uuid": "9037c28c-1981-4a2d-af6a-9eee0f24bc83", "comment": "Malware payload (Mirai)", "value": "47a5210fe3978a8f7e860e23d25ba3ce52cb07e068e852271b0a52124cc7e46a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236936, "uuid": "b84f7ec8-720a-43d5-a893-6142e93df547", "comment": "Malware payload (Mirai)", "value": "a48d4e88ba369d0deeddea29ce1b4d7a3bfedc39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236936, "uuid": "eb23e6dd-cbc1-48bb-b648-bbd7b233f9e3", "comment": "Malware payload (Mirai)", "value": "339f528f1577b0aec68d3f422ef2e239ed465e1071c12cb6b86fc40e0b637b840f927c99654dd7c87b7d3171328089e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236936, "uuid": "f745c399-5a25-4379-b0c6-b4199a343257", "value": "T1ED434AC4F643E8F6DD471174147BAB378B72F5B92224D743C3B99A31AC92602E616B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236936, "uuid": "6fdc4ece-e498-4dd2-92f3-46e8118cd05e", "value": "1536:xd0CKdYOCWNXSW8K7DhTAGs7W71DOehMuG/DBvrIMv:r0CKdYOCWMF4TmS71SehMLB0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236936, "uuid": "7e96a813-4941-4f0f-99b6-e6f57cb90544", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236936, "uuid": "c49791f4-092a-44a1-9ceb-1553a311c74f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236936, "uuid": "eba64376-4a01-494a-85c1-aa8eada99481", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49584e46-f3cc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684229424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229424, "uuid": "a0af08ce-5fd5-47b8-9030-3608a93b63d7", "comment": "Malware payload (RedLineStealer)", "value": "4062798373f09703240132422f71f42b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229424, "uuid": "b4a5f510-2a8e-4ac2-bc3a-4bf98c0b495a", "comment": "Malware payload (RedLineStealer)", "value": "48569c05a6f31b23b4b43ef1f008ad6dce82f4c93d7f0673779c590521fbf272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229424, "uuid": "d015d266-56ea-423b-bb66-79f11edca780", "comment": "Malware payload (RedLineStealer)", "value": "aa981f1f0bf9a686e4622ad008ef5606fc7019d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229424, "uuid": "dc5db7dc-b2eb-4b57-a800-f454653d65be", "comment": "Malware payload (RedLineStealer)", "value": "2e48e8af27cc4b824abec124e7cfa333326a71eab894938232042fc6e7a505151162ae26e0504c24089937c2788b7b65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229424, "uuid": "7dad3540-a138-492f-ac27-2220ed109ea7", "value": "T12C45238376FC4636C9F95B3058FB02970B3ABC7A487C521B6349DD1A1CB1699E132B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229424, "uuid": "2c20ecc1-a819-430f-b401-ddf1edab3286", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229424, "uuid": "4844c63b-6897-4871-91bf-aeebfe6bc968", "value": "24576:fyRFJD9HMTkv3UDjP02Jpetznb/nIOlt1WQTHVaSyfoz:q3HMQv3UHP02+bDlt1zV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684229424, "uuid": "bf49f2c7-9342-4e8e-b2c9-3042a1a2e509", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684229424, "uuid": "3d2bfc74-38f6-4fd3-a5f0-d2e033ceec52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229424, "uuid": "5eae0879-28f0-4975-8439-8c6bddab4f6c", "value": "4062798373f09703240132422f71f42b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25e3803-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243747, "uuid": "cde2ea49-44a2-4b72-b410-93ecce69fd31", "comment": "Malware payload (Quakbot)", "value": "82f25e1e16c36fa12fdd942c73b36dec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243747, "uuid": "9d33d5a0-2e67-42e2-b576-b9a6540856c6", "comment": "Malware payload (Quakbot)", "value": "48e34084e4259e7f998634714e6beba5a95b7477fab723dca4bf8246d025bb7f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243747, "uuid": "67f893a4-5844-4657-881c-cd4d00ee8914", "comment": "Malware payload (Quakbot)", "value": "663e0bd6bf77824e141ea2e33afda2c185afb529", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243747, "uuid": "3188d1e7-957b-4596-aa03-91dece273110", "comment": "Malware payload (Quakbot)", "value": "8ce3c7c7a1b791fc99c2f43ce7a86c59cd22fba0081e7a8f2d28971d1d7357400d626bbc9bf77fb97586bbf56be3bd5c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243747, "uuid": "c917f111-3c0c-4cac-b912-47ddbf0589e2", "value": "T11E2442D8475228618B5B7C22BB20F4A9EBA91EB4C2D0468BF89B3361F1DFD0CDDD5614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243747, "uuid": "04d86b2b-ca66-4258-b468-73bc20a8d017", "value": "6144:t3LF+261PwEqVk3GObd0041yvtlhyEWG+yULXkTW81sDLiIBFSmyly:VR+2Iz1Qy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243747, "uuid": "84a98de3-7da1-4e79-9eb5-a7c2710c6292", "value": 216675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243747, "uuid": "d4cc0485-f75e-4e2b-b3f7-8050831a2866", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243747, "uuid": "dbac5f0f-935f-482b-aa50-1f182bd96d3b", "value": "Ckqdkiyu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93bf79e-f3d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684231867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231867, "uuid": "47df900b-5e26-4056-bbe2-2f1f0366979b", "comment": "Malware payload (Mirai)", "value": "f7b6022b024aa668fe913844cf12c7f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231867, "uuid": "b398fc2b-0ae5-4c64-9a4a-b086ab3bf7a6", "comment": "Malware payload (Mirai)", "value": "48fe6e5eef0990bb055de7b455297998f058bb46b36e62432bcfa50af34dcdbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231867, "uuid": "6e9601bd-7e19-4ad2-a2e5-f7e49393dfb8", "comment": "Malware payload (Mirai)", "value": "92dcee4b90c189672f1bcc2ec0c32ccbdd7dfb55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231867, "uuid": "ddb5dabf-2c9c-4d5d-81d8-3c019f8f7e0b", "comment": "Malware payload (Mirai)", "value": "31c32378a7f461695945b83b75a46a309d70d29a67604b51e42f9699939047252b00e34c90e25c280100acfd35dfadd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231867, "uuid": "53f3cd96-12db-4893-ba00-6ec633d0848c", "value": "T187C32A46EB808F03C4D61775BBEF424933239764A3DB730689189FB83F8676A4E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231867, "uuid": "98a67223-d7c4-4a7c-9dd0-25cc77d3f13c", "value": "3072:fIDLzZFrMpCP4dujryRgHGNkDa50TKJov+uwhsgu4maUgjbcjfHDjdM/9Jdc3j:fIDLfrMpCP4dujryRgHGNkDa50TKJov1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231867, "uuid": "513240cc-ca16-407f-8a2d-48e5c4bc6cb7", "value": 123017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231867, "uuid": "84aa7733-b3e7-4aa0-ac0d-ec4b3cce891e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231867, "uuid": "1de5affe-38bd-4538-8fe4-84c0109f5dab", "value": "Fantazy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca816d4-f3b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684218612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218612, "uuid": "4165ae99-1a73-40a1-a938-88be2072afac", "comment": "Malware payload", "value": "7bd481ef9b51ce6696d0eb4497ae90c6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218612, "uuid": "59d95485-3012-4afe-bb7f-8272cdd150ca", "comment": "Malware payload", "value": "49bbcab0cd8e68fee1eb218cbb863bf201eee9e696a8a24bdb20611cca2dd872", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218612, "uuid": "465e23fb-7e7b-418d-96df-6b1dffbbf3ec", "comment": "Malware payload", "value": "2cee38ee6dd9eacfaf1a90411e1b815159ea2ee8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218612, "uuid": "c44e1dd6-debf-47c5-a3da-4f048b179821", "comment": "Malware payload", "value": "71716d968a340c0155db71ea07ecc90511f03855202a8a732dbfbbf953ebcfb190ae8eb3254015b50ff2ffb5f7345ad4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218612, "uuid": "483aa381-8907-452b-8256-818eefea22c2", "value": "T143A319A1CAD5163D0A031BEFEF028162CCF8852D6362856DE7AC876E511386CC77F799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218612, "uuid": "3bdbe9d2-2c4c-438d-8ca3-4d6efc91aef2", "value": "1536:ojmXQzZNvO4uhw3GSztugofFoRFHm50OnZegYaVoaclaN4eot:ojmXQPAhXSztr+10IZe3aOasaN43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684218612, "uuid": "2058765f-4d2d-42e2-8341-dd2375420097", "value": 99212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684218612, "uuid": "c1927670-2c2e-4801-b25a-7b06c2fa07f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218612, "uuid": "06719b32-2c5b-4003-b467-91e360a6c22f", "value": "Omnormeredes.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad7f973-f3b2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1684218555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218555, "uuid": "b9779066-64f6-4026-a388-2bdb94251094", "comment": "Malware payload (StrelaStealer)", "value": "328b725b116f47d648faf7f7ddbb5188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218555, "uuid": "8a4ffd71-7a43-4f1e-a0cf-e4918a37dd80", "comment": "Malware payload (StrelaStealer)", "value": "49cc8ff363544178e9b08989622638de92ca05aea3f8ba50be8257afae02b340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218555, "uuid": "f558232b-4a52-453f-a906-637a059d29e6", "comment": "Malware payload (StrelaStealer)", "value": "d5a1d8e599d397cd53abd160086aed6422177539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684218555, "uuid": "644c7d74-15a9-4538-b9ed-a907b14d2b75", "comment": "Malware payload (StrelaStealer)", "value": "699c048ff84d9cf03927b292336c7d9a6abccb01c55eb1193a89d770532cfd676c112c404340756a52c90740161026d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218555, "uuid": "89c721e8-4193-4654-a91d-14d8a85c5b2c", "value": "T19E14397C2F8664C7ED90F8B46BF55664C62E14259D69E2E404F8C3A0392C0F1BF1B6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218555, "uuid": "b2c6565b-77fc-4c23-a5f5-aad64fec4317", "value": "1e3c4e072d6a52ba210cdd5519484719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218555, "uuid": "d75ddac9-66ce-4f17-96a1-440af9e51c10", "value": "3072:EeEdAwOZs0vupaEJnnjzmqBLmgRTVKvAoAt5RoDuK4vLn5d079cAbu:E3Oq9DVbvRoDF4vLE7fbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684218555, "uuid": "9a17aaf9-a9b1-42e2-acf3-3114f40ae989", "value": 193416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684218555, "uuid": "626a1b4e-7298-43c1-ba52-d78909bcfa3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684218555, "uuid": "f9a5993b-2747-4ea0-885d-98dff01a7314", "value": "FATTURA_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845704f5-f40e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684257870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257870, "uuid": "b0d5b7f1-d50b-4360-9072-468b677e7fd6", "comment": "Malware payload (Amadey)", "value": "e1434049d3e061272f965104e0d82fd4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257870, "uuid": "f46045fb-c6a1-4073-9c37-375924c89351", "comment": "Malware payload (Amadey)", "value": "4add0ade44a64fe535f79c5891547fe633d6227211385bde10cd90620304f9c2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257870, "uuid": "26671f5d-9c77-42c2-ba36-3a52c7e50699", "comment": "Malware payload (Amadey)", "value": "edb7013c2249c05611baf098d28c917f107e2f15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257870, "uuid": "5c909b4f-ebbc-4a61-b288-c6591c4b7a08", "comment": "Malware payload (Amadey)", "value": "cadae79b80e51273d9f85d1fdf03224aa86715b23f87c86e4fe9a545d6870f930f0e942b37819c373d51079e13eaf1de", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257870, "uuid": "6c08920d-f269-4a6c-b4ec-d76380f2c430", "value": "T196452302ABD99D32FDF51B384CF507C74937BEA12A61A79F2215AE0608735C0A57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257870, "uuid": "79caf4d0-bb39-47ce-b453-665db6851e9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257870, "uuid": "aef0a339-7041-40d1-89fc-cd560eb22c9b", "value": "24576:wyE2zpUDgK1M+SDo9NVoD622BoE63qvP99:3hK1M+SDAmO22V6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684257870, "uuid": "e2f8e7c3-3e5c-4d9f-a229-0f46713cd2bc", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684257870, "uuid": "c594832a-a22d-4e80-98e0-45f8f0578aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257870, "uuid": "418baf29-a7e8-45a6-9c02-2e352dabeb10", "value": "MemeMachine.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55eb370f-f3e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241471, "uuid": "a2dc36af-5a00-4ec6-bd4a-176078dd6a7c", "comment": "Malware payload (Mirai)", "value": "5ef3eb331c32c7b90026fc5a26291f7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241471, "uuid": "20bccc6a-8be9-46bc-a946-538230dc7906", "comment": "Malware payload (Mirai)", "value": "4c4938f0f7b2104a6be4e4c2201ea31cddc5e340834bc940946e4a58c7e6a0a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241471, "uuid": "879321d9-f7b5-4c9e-b687-d04bed62f2d7", "comment": "Malware payload (Mirai)", "value": "dcea8f23da3a974947238d56e65a5df3d5782777", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241471, "uuid": "206a4558-8f54-45a1-8656-fc47b569561f", "comment": "Malware payload (Mirai)", "value": "47a4a952c30a4e1bd6f8a247d9041708e75c7087d90f7d18fc555439295e56e5919651b4edcb3cdbb2ff40df8d9011c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241471, "uuid": "078e66b6-9acf-4c0d-b141-a65b2a26d684", "value": "T18B83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241471, "uuid": "dff9aa89-9361-42de-a547-ea97a13e48b5", "value": "1536:iVLymx1Kn1kj752dCexuV/8UZlDwfkJ4MYfWg:iVLyIU4Fezxu5VD1eJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241471, "uuid": "2766b996-122f-4969-9bb3-2a9c17f682fd", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241471, "uuid": "14816ed9-bd89-4b9d-9964-606b03dae43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241471, "uuid": "cacf42f2-9fba-412c-8bc4-8d773aedf706", "value": "5ef3eb331c32c7b90026fc5a26291f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3d4700-f3cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684230929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230929, "uuid": "6190423f-73f6-49bf-b90f-6c8cd5acea55", "comment": "Malware payload (RedLineStealer)", "value": "5909866e5282fad5a81274fb3c16299d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230929, "uuid": "22f47bb0-ee48-4020-9a00-d364e47b61f1", "comment": "Malware payload (RedLineStealer)", "value": "4c77f0a6c86f534485f28c73963f05dcfb03818b8b92852b54a56e7a4d70fe8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230929, "uuid": "eeea68b9-f66f-4630-b7e0-47c92134615c", "comment": "Malware payload (RedLineStealer)", "value": "739300c664de78fa103bb8835167eb74f7ec4462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230929, "uuid": "5783ec3f-ae89-43de-a79f-0b59efa76d6a", "comment": "Malware payload (RedLineStealer)", "value": "97bae1323ab65bfafd9e7401d2ff15b35f7d2890d6f37fdc32fd282442549f1fa5ea89583aea3696237eb2bd73a3a6f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230929, "uuid": "8f8da00a-6499-445a-8382-42b69e5edcb7", "value": "T12A4523C6B6FC5072DDB2277044FB01830A337CF1AD60922B6A40AEA95C72BA0F57575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230929, "uuid": "c345f980-b549-4ade-8af4-4d80e44cb5c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230929, "uuid": "6b37fbd0-7ef7-4e92-9d53-b6b5e749fd80", "value": "24576:XyhmSb5fmNeiByMU/Ii/SvYMli1mmvhxHyQP9QdZF3Sk6Mv:it5e0iQM+/ccmuhx1CdH1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684230929, "uuid": "6b51817f-0d45-4a20-9faa-694aa7726220", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684230929, "uuid": "11c252b6-4d1d-44e4-b853-e5fab289e011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230929, "uuid": "caba9888-99de-41a8-a8e1-62e958dfd580", "value": "5909866e5282fad5a81274fb3c16299d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662ca8bc-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684235486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235486, "uuid": "3b0fb20f-7359-4a5f-b952-0863bab619dc", "comment": "Malware payload (Formbook)", "value": "0b68dfdfea6616fd9cf35ecbe948596a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235486, "uuid": "c50595b8-c677-4138-a34e-d5654c0f0b9b", "comment": "Malware payload (Formbook)", "value": "4c8180c106fdf8c5c144e85b22eae0ce157372378310a1b7252326e6521a1b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235486, "uuid": "9c575c10-c5bf-461a-b297-57b5425c24d2", "comment": "Malware payload (Formbook)", "value": "6d259435293da14917af177a63783e18b574f577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235486, "uuid": "783f9017-5ffe-453a-b632-478d3f0eddf4", "comment": "Malware payload (Formbook)", "value": "ed57fc254a4e5c6276aaf20567cefd6498872726a976bfb697780b7cd1bc94c710c7e1ea4476f5f8530bd2ce1ae9a58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235486, "uuid": "9349c97a-2b3a-4530-bc31-d8e2c0980374", "value": "T1F2D4E07021DE8A84E41F8BB175BCFC31437230E3EDD9C9751729A184CE6AF646E8895B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235486, "uuid": "e0b8095d-6a7a-420a-8d68-ea55f42e3867", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235486, "uuid": "cfcf219a-414a-4f5f-8eb1-9fc29b394da5", "value": "12288:wyun1v5XE9qzZzI+xX5eZ+HuOF+UPbu6PwhGRsPpAz/RC:liFK9mNp++OOF+AbfPFuPu/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235486, "uuid": "de860bbc-6fe1-4582-bee7-820b275870fc", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235486, "uuid": "08aa56a9-f14a-4c6c-bd88-311c42f8d833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235486, "uuid": "1c9afd60-18b4-4ec8-b03f-7f4c46b4ac6d", "value": "rOrderDetails_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffc3775-f3de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684237113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237113, "uuid": "88f18f95-a57e-4c55-9185-a0524b07f9b3", "comment": "Malware payload (RedLineStealer)", "value": "f4914769f31003d45fbb333b94200e6b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237113, "uuid": "c2a662ec-71d3-4778-93ed-036acc295cbb", "comment": "Malware payload (RedLineStealer)", "value": "4c97559004eb03f2c7fc65b95eb5d5eac90dffd9b5698d36ae2aab4f135a8340", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237113, "uuid": "07325614-4cf7-46b2-9e6d-5f3f4070f98c", "comment": "Malware payload (RedLineStealer)", "value": "16c312daaf11f37750c07cc008998b484f543ffb", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237113, "uuid": "a4f69b01-d8c3-41ce-aca5-135621306144", "comment": "Malware payload (RedLineStealer)", "value": "1e1122c1f6afcbb2d9b1c06ea6ad36d10b2049f8592c02005579aa08bfde79e8f2221004cf5816a8dab55bac90887d15", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237113, "uuid": "0e7cac80-10cd-4225-86b2-ff06b8abb56a", "value": "T17C452326EBD850B2D8F403B478FB17D7193CBCC25968936B724D9E9A0CB2590693173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237113, "uuid": "1c4c1324-1c2f-4cd5-bb32-e85d59243a9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237113, "uuid": "c27a3951-9ade-4211-826e-fbe7ebbf2ef5", "value": "24576:JySqiau5CW4fSUcO7lY23pcPqOseAhzzHqwIn/9a10sy:8Sqian3mBYVhzbq5Va10s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684237113, "uuid": "805c944a-c73e-4caf-ba0c-45bbc7e5effb", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684237113, "uuid": "fbbba8fa-50f8-4848-b640-9500c3c4ba92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237113, "uuid": "573fe7e5-f2cd-4a29-bed5-c54ab3083e5b", "value": "Pepega.py.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c08f0f1-f3e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241884, "uuid": "0c471d90-f1de-4a62-8c21-df671a8104e3", "comment": "Malware payload (Mirai)", "value": "00abeae16f8be31fc229fd52bd3617d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241884, "uuid": "137af662-6bdb-4ba5-8ab3-0d9f4bea986d", "comment": "Malware payload (Mirai)", "value": "4d0bd93e1588d8a36dc1dffafb555f4fc0d3ea087bdc71bf01340f3895973d42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241884, "uuid": "08f5ffe0-1c5f-45b3-8f50-61635d179f3c", "comment": "Malware payload (Mirai)", "value": "6a674c90242d3ad7cce82e5463718435a034ff9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241884, "uuid": "8737a756-9ae8-4612-ab2c-6e9f6cd71b36", "comment": "Malware payload (Mirai)", "value": "e77200f60a531ae0146eb2bb10a1157f2a6a1a23a93fc1e414fb69df8346e56a9aab1124b00e51a17f69a55be993c8ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241884, "uuid": "585ca9ea-af31-4653-86c2-9243d4b732ee", "value": "T1CC03E751BC829A37C2E1137AB6AE4A8D336163E8D2CF7217DD204B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241884, "uuid": "b8c9fcea-17c2-402c-bb5a-b534cf5c65e4", "value": "768:kg4QCbvsG5f0OlnlUlQOBFdApwAUb9z/W56v+bgO73HUXoTs+/NwwW:kRbEG5fXlUlbH4aScv+7Uj+LW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241884, "uuid": "2f7451da-4326-4a02-afe1-a372841be630", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241884, "uuid": "80c219da-ad5c-4425-b962-3c20bf8970e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241884, "uuid": "47a82670-04ec-4284-83fb-a3917978eb3d", "value": "00abeae16f8be31fc229fd52bd3617d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3916189-f3d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684231831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231831, "uuid": "72d0568f-57b3-4597-bcee-c4a61561e8f1", "comment": "Malware payload (AgentTesla)", "value": "bf09aa86c3678da42cf9049ced279f28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231831, "uuid": "b45f7155-b135-4562-b76a-a0812109fe35", "comment": "Malware payload (AgentTesla)", "value": "4ea83aefa492b4ba2b49e13e34023674ed8b50373a9f521dc887178f60b60965", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231831, "uuid": "c00b0bb2-eca4-45c3-b3a0-1feec0596a5e", "comment": "Malware payload (AgentTesla)", "value": "1efede88f2b4b36c4e3e78bc9971952ee4ad3cf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231831, "uuid": "26b6d293-ecb3-4151-beef-0250c9247166", "comment": "Malware payload (AgentTesla)", "value": "44903c62d7ab8f602b03549192aea37a9ba4177bde3ff841141ff60b16794e0ac95b598a4b036f345255d95821d5ebe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231831, "uuid": "11f2ab9d-bc26-49b2-a10a-00436df51280", "value": "T15ED4D07050AE8790E01BCBB165B8FC72037274F39DE6D9351B65A5C4CE2BF502E88A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231831, "uuid": "8ecd832e-38ba-4487-9734-436901b79bdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231831, "uuid": "8d2d229a-3605-460d-b976-f04fd66cc85a", "value": "12288:TYyNv5jISxRaLH77uNSFOZ6KWm7cns5dxYbJmflbhmnxWdT:PtDxObI+OBcs1OodFuWdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231831, "uuid": "94f8278b-1a49-456b-8382-977945e95dda", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231831, "uuid": "3c04eb59-9058-43c4-9bc8-80bd62fa9511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231831, "uuid": "6a29fd53-501d-4570-a0e2-5ee0f7caf8c3", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPMENTS OILFIELD EQUIPMENTS & SUPPLY.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0123e3-f3cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684230024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230024, "uuid": "ecd00dff-fd69-4592-b307-27f63540ee5d", "comment": "Malware payload (RedLineStealer)", "value": "29e0671b7faf3326bc82cd9bbd8d6bae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230024, "uuid": "e7fdd2be-4096-4068-8b43-535d41823f0c", "comment": "Malware payload (RedLineStealer)", "value": "4f128b91c01128157bb0138805be3648391f98804223ad3f63eecaabc135959c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230024, "uuid": "5c3e3f98-669a-4b31-8ece-3ea6be523685", "comment": "Malware payload (RedLineStealer)", "value": "8e6e7ef9658ee98fa0f11231afd78ea01b7a5df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230024, "uuid": "bf9f92db-5c3f-499d-a88c-ef7fff54424a", "comment": "Malware payload (RedLineStealer)", "value": "5524539e9c03152b01a91be7b31472fdf6cd2fadd3492adfa6181e35213fcc2d68ae0cb3b658abdb64c52ab5caf9800a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230024, "uuid": "4e7afeec-e677-4d29-8fc2-0c99048854c6", "value": "T12D45232673E58076E87153B08CFA02D30F38BE660D74535B5A5BDCB62CB25D0A8367A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230024, "uuid": "5d1f1cf5-dc1f-4c3d-903f-e5c3f0bfe420", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230024, "uuid": "cf17cbc4-af68-4c50-84a2-f7ddc2817c9a", "value": "24576:Hya9fSBbVDetIg/S2dY1Z9y/NFR7wJWCXOMIDGJ92k0L8K:Sq6vDq/hdY1D4R7jHPb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684230024, "uuid": "86b29736-c303-4a06-86e1-1729bd45fb55", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684230024, "uuid": "55c98d0c-e1fd-44ff-91f4-cf661ee37586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230024, "uuid": "22a2c592-c463-4f8e-b854-7c7257b8b574", "value": "29e0671b7faf3326bc82cd9bbd8d6bae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d6481c-f3f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684246699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246699, "uuid": "1617f788-03fd-4ded-9b2c-b2076bf93dd8", "comment": "Malware payload (Amadey)", "value": "13a690fe055f14a73a4f5aeed93d3c22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246699, "uuid": "eb676808-52da-4094-ad12-ce540b9db625", "comment": "Malware payload (Amadey)", "value": "4f281f432a48b74432684038534ee47804cc3b8892374d9bba470fe9567aaff1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246699, "uuid": "2eff16f1-2239-4da8-975b-99c497e52d32", "comment": "Malware payload (Amadey)", "value": "4fca4152612389c1bb4c01e1f4f4057bab33feaf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246699, "uuid": "d316187d-fa6e-49c4-b333-14c2e25c2a47", "comment": "Malware payload (Amadey)", "value": "04a94d8decc7bbd145787b256d934d917f943692bc96d2626bdbaea148283a9c0f0fa569b5d3037abeacc2541261d484", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246699, "uuid": "ab554093-e475-4bbb-94ce-3de2e9f0cafd", "value": "T17C452347FBD080AFE8B547304CF613930933BE525CB4E2532A49886F19726D4A675BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246699, "uuid": "4ee53600-96c1-4ce8-badf-e400316bde6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246699, "uuid": "9eb99b97-f10c-4bcb-aa36-e50a16a448d7", "value": "24576:wyAnnHsAnLgbA0J140IG6hLKuFwnvGrajqh1uzBZ4ISEQ8:3Ann/MU0o0lcL4O9fUjS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684246699, "uuid": "c3da5066-da57-4d22-94ad-60d0658037ce", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684246699, "uuid": "cd8b007a-12b0-4a26-88e5-42dc58015702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246699, "uuid": "2347d9ed-6b48-4135-97ca-64fea50bcd01", "value": "RickRoll.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0addbf2a-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684234044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234044, "uuid": "25167360-a9a3-48ad-9f5b-bec1236052ba", "comment": "Malware payload (Formbook)", "value": "40bb98fd28ddc98102058340372887bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234044, "uuid": "22e56415-19e5-4efe-81f0-7327249c1e65", "comment": "Malware payload (Formbook)", "value": "50cdd51095fdcef2b731f6fa30952916f37782b1a9a5778556347e338cec85aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234044, "uuid": "2bca0509-b142-4533-9822-28555abc12fb", "comment": "Malware payload (Formbook)", "value": "e6b0ff0326fbf4ad5579366e396b871015d5c66d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234044, "uuid": "dbcb903c-c32f-469d-805c-a7d781939ffb", "comment": "Malware payload (Formbook)", "value": "5f35fc506a73c8f8005915694a550ef0b93d46eb38f9267303cb6e3b8856d5b6ad4489c2bee81dd31f61ca8d9dd3693a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234044, "uuid": "f2a60a93-f648-4bd6-9d14-72e82c21de6d", "value": "T1F3E4E120B1FE0477C76943F502491A490BB951AB7C27D6F84DDE70DAFAD2B020B52EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234044, "uuid": "febb5e35-54db-4623-9dfb-e1c67e74619b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234044, "uuid": "9185c048-80bd-4b46-a6f7-4c76a0f96e1a", "value": "12288:wysSpPyNU9O055VQ7Kih04czIM71mhbmqZaaWCgMswxn5YXj:WY5H1gQ3Qhb7a0gMswx58j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234044, "uuid": "6fd9f7e5-7707-42e2-b0ea-a02d7452e0c3", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234044, "uuid": "9dcac5f5-9eb5-4335-945e-4da8e2642eff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234044, "uuid": "0b6feaed-c248-4612-856b-50a5b0ebeadb", "value": "MT103 USD COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb544c8d-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1684233562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233562, "uuid": "b5ae3212-c6b0-498f-8cec-9b1fd533f510", "comment": "Malware payload (NetSupport)", "value": "34481c45a49e5e74ea3fe84d78508a5e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233562, "uuid": "398215b6-c992-44f3-9481-0b602166abc1", "comment": "Malware payload (NetSupport)", "value": "51119ab340012b6c1aaeced1e4ac7343575666c69ef88ac562afec5aa42060c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233562, "uuid": "fb31164d-d47f-4541-a853-960ddfc66562", "comment": "Malware payload (NetSupport)", "value": "6f7bb101dd991d4880fbac9ea8635160fabdb0aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233562, "uuid": "0e2787b6-dc36-4433-8dbc-2462f01a5257", "comment": "Malware payload (NetSupport)", "value": "70e14f52312ced99deb1114b62d70676865f187cf61961a361045f1f5a80dcd3cc9c856f4a2273c6b181c1b38bed876f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233562, "uuid": "7f1768f0-4485-440a-974a-b48e27d0605e", "value": "T133E2FF9826C3B053965FF03A775E9CC5D5AD59020BD6680FB81D6278FF82C3CCAA4768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233562, "uuid": "298d40c3-7fd7-4578-843b-f8f44b8fc263", "value": "384:y1USNx9JMzun+9roYx/eeUMJEIwakuWFq9w5LHPXLuYv5jxtlsjUCYO8LqpJ7iVT:yRxHm1pJmaNWFq9qFvUxYLWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233562, "uuid": "550e3191-cd4c-4bd6-a2fb-3c4bd54d09ed", "value": 33867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233562, "uuid": "fe5cdabc-76ee-4d19-94ec-f9e084d2ab3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233562, "uuid": "f074da5d-43a7-4362-8c71-59e270a2374a", "value": "5900799_6426344_8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1deaa24d-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219043, "uuid": "8d0bf7f8-103f-4cce-a97e-7efcc4e843b7", "comment": "Malware payload (Mirai)", "value": "f11898eded92bfd175bbfdd9199a3f27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219043, "uuid": "68b1702e-1f41-4017-ac6c-83e97273675c", "comment": "Malware payload (Mirai)", "value": "51e364bc46d78b8a13cc5b9b3fd2fcfcf18bdc872cd63443d9fe036d159617f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219043, "uuid": "16b26382-6c62-43d7-ba10-2e41b3ba2b79", "comment": "Malware payload (Mirai)", "value": "299f9d3f24d379d671a9d662315376174da56b7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219043, "uuid": "7417f921-9291-4652-b70a-5316fba1f15d", "comment": "Malware payload (Mirai)", "value": "3b71871d3b05313314de723a1855e4239b3d0bd9556c7fd2b240fb1498b6394d3dc1b04f250fff7d6979a2bc8c095963", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219043, "uuid": "0e1c78c1-d3ab-44bb-b167-45b21db84e51", "value": "T109C3842E7E12BFBEE668863107F35F70879521D227919382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219043, "uuid": "825138bc-0891-4276-a5ff-7f5d121c4c67", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBenEdaAW/GrmW+IR:Ted0W0MZQHrdaAW/GrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219043, "uuid": "faa2c214-37cf-465b-9d4c-cc444e7c56e0", "value": 125959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219043, "uuid": "586155ac-d8c9-49de-87b5-d41ad34e618e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219043, "uuid": "39555d7d-89b2-4b4d-b5fd-33448e7e53a4", "value": "f11898eded92bfd175bbfdd9199a3f27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30dba5f-f3d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684231776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231776, "uuid": "5b8c1d12-7aa2-4ad4-a4e0-ce4a6b318363", "comment": "Malware payload (Mirai)", "value": "d398625c2c35460d037ec93b9b54776a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231776, "uuid": "8be47b1e-25df-4ea1-9363-553322f311c0", "comment": "Malware payload (Mirai)", "value": "55b5f6596994fbaef8be464a88155716926c4ac6c2339ce4310c9fcc099f63e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231776, "uuid": "7883c894-8d8a-4f13-991e-008e79a6155b", "comment": "Malware payload (Mirai)", "value": "2332b34fccab8d7d48557d35897a35fdcb829d90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231776, "uuid": "43fac90c-234c-4602-b7d4-1f9bdd65ac49", "comment": "Malware payload (Mirai)", "value": "1365a949bd6ad928b4ef9aae6408355f578815b5ed763ba0a31e9ac09b6f40ffd9660aac2927fc84cf025ba78d9dca9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231776, "uuid": "9a5628d6-1865-48fa-8b1c-70c46cd243ae", "value": "T1A3331A0BE94180FCC196C53853BBA57AE8397EAE023C7A9B2B94FE321D21D61171DE45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231776, "uuid": "861814b9-46c8-4237-b599-4d72d0e14fcb", "value": "768:BJt9wi+KzTy+YtsCTMryGmWFg94SHq6DUUMoF16JkAc3Fzx3cizCLI/:B1TXy+YtsEMryEanHIe16yAc3F1dzCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231776, "uuid": "617fcd69-4df4-4afd-91b6-167a1df0d0c3", "value": 51880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231776, "uuid": "a2df6712-1547-4598-bdd6-94bef450f17a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231776, "uuid": "f38ddddc-4ef4-4325-9dc6-076d2510973f", "value": "Fantazy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca13ae05-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684233935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233935, "uuid": "adb12aeb-97f9-4362-9bf0-c0ef83daa62e", "comment": "Malware payload (RemcosRAT)", "value": "54fec9c648ca8fb236a1b99e02a1e07a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233935, "uuid": "bdc8835f-b838-48e0-bf82-cfb5f04d0568", "comment": "Malware payload (RemcosRAT)", "value": "55df8e9dada4df1e4bc5e5f7022de2e6153edcbe00a585bde840020a71ae3fc4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233935, "uuid": "2942d0c8-8e19-485a-98e7-6ff9df28c0e8", "comment": "Malware payload (RemcosRAT)", "value": "446277f5f6088d3731b296eff118220b059533cd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233935, "uuid": "f6f4cff1-975e-406f-80bd-e0b8cdb9c845", "comment": "Malware payload (RemcosRAT)", "value": "6642e959b22ed9dcfa30cd4a30839ffd1e0da3362cdcba811d1ad1e557dd13096cd11e49ada2f8513eda92130ee3de3b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233935, "uuid": "bf443a18-9133-43dc-bb24-7c870eb0bf76", "value": "T1F7F21A5EE78B02648F410373631B1E89A6BDB23EB35151B178AC837433E9C3D06666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233935, "uuid": "08c88939-c898-447a-8bfa-d3938c7ec651", "value": "768:HFx0XaIsnPRIa4fwJMYjMsAIQOcywOYmDPdm24xi:Hf0Xvx3EMMMsncBOYmTdmVxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233935, "uuid": "7679c432-8076-473f-9347-40b98c498dfd", "value": 34541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233935, "uuid": "d9dd4dba-129e-4712-8ee6-e9cba4c5b984", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233935, "uuid": "64df65b6-8c4c-46bb-ae93-5cf9ff1ec0b5", "value": "TT copy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf83245-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210184, "uuid": "30b5b93c-d7b7-43c6-b32c-e35f9c29f9d8", "comment": "Malware payload (Mirai)", "value": "265a8e672fc39dd09746b4e2df2b6e94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210184, "uuid": "d68538ec-a951-4d5e-b784-59c5cb0b3f62", "comment": "Malware payload (Mirai)", "value": "56ecf1a8b530aa68294db54ccbb7318d208ac20ea534cd9693531539335c654f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210184, "uuid": "4b6442e2-bab0-4143-82f9-00a8452ac287", "comment": "Malware payload (Mirai)", "value": "62a3fb25eab5e7d7b7cd2f7e352e4312d6369364", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210184, "uuid": "06cdf731-d042-4d51-8270-dacd57572d10", "comment": "Malware payload (Mirai)", "value": "61a42a49edeac3f7a7c10a9322e4c52589eb725f690336154f48bcc147cf77b7fc78e38f5ceab8479140c13f7252bb89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210184, "uuid": "896becb6-396a-445f-9d57-f972caedd45c", "value": "T18BC3F731E8044B1BC2C223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210184, "uuid": "0fd8f104-b8e1-41a8-b478-14d516d3fce1", "value": "3072:6jVlyaL5JCrIpv04sibttiEiTmP46aQyfPlfKsNb:yoCJCN4sibHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210184, "uuid": "f9ca13d0-fb46-4962-a7fe-8102e12d0206", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210184, "uuid": "b9496778-5a86-47cb-93c0-f146fccb0034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210184, "uuid": "c216ff8f-3ef3-4d1a-b2e0-69b89449d274", "value": "265a8e672fc39dd09746b4e2df2b6e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1fa53c-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233024, "uuid": "f5e75c73-52bb-4369-9de8-b6eb48524f51", "comment": "Malware payload (Mirai)", "value": "c56bea5c9afb2f4a388d81b4feb85575", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233024, "uuid": "d63d5092-e8c3-40bd-94d2-a94fa36ff3ad", "comment": "Malware payload (Mirai)", "value": "579ba5a9a6361f0bab106ff1408bc3c703729fad5651a9a8e3d03bdcbe4f67bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233024, "uuid": "b32ba5aa-c62a-4c0a-b0b5-321987f61b72", "comment": "Malware payload (Mirai)", "value": "ecd8c3ec2b5ed9050ae4bb06bf0b88aae403c104", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233024, "uuid": "92418235-bf78-4bc4-a194-2b4027f2ee95", "comment": "Malware payload (Mirai)", "value": "59e2368e71ffb62240358fbcff6efa5852a49450664058b1b03a4532c0cf8f53a4f71a95124c462a4857eed899004207", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233024, "uuid": "e6da94df-6c58-477c-bf20-e60b23f772de", "value": "T1B8535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233024, "uuid": "3134da54-db19-4588-8975-855c9daf2a84", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E87:N1GjR8EVGOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233024, "uuid": "0e0c9b64-1671-4ede-9680-15bbd62554b0", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233024, "uuid": "607d7ccf-1acd-4981-8cbc-36b20da9f2d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233024, "uuid": "8bd06588-7850-4b97-ad48-8b34984fb9f4", "value": "c56bea5c9afb2f4a388d81b4feb85575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351d1e68-f3e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1684238839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238839, "uuid": "ba2fbcae-c089-4130-81bd-755dd24da2a6", "comment": "Malware payload (LgoogLoader)", "value": "c56622a2e329adf8167d71814e8c92a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238839, "uuid": "05eb3271-534b-40b3-bc52-2e847cf86e38", "comment": "Malware payload (LgoogLoader)", "value": "57a58ba29a3ed07f244f57276d1d265c9ab1aee6d9ac6f1d84b24c6561fef589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238839, "uuid": "29f4f759-cae2-42c1-b371-7adc8eb6e666", "comment": "Malware payload (LgoogLoader)", "value": "e02cf71f24e10383b526181f86591a041b1adeb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238839, "uuid": "fe80c5dd-65d3-495a-a829-0807573e79af", "comment": "Malware payload (LgoogLoader)", "value": "e80814d73879bb33724e846f85867155f1049fa4920ff12d2366c11c7b2a552f5f3ebbff77bf4b504a00a6878c068efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238839, "uuid": "99517661-623a-42c4-b490-4d170fc3424e", "value": "T175C4E05833F78D84D679ADF795A0D1D187643B823C74F20E4E0A58697A387C0E912FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238839, "uuid": "23f9ebca-0787-4cc0-8eab-8ce8d4a6397e", "value": "12288:agkutuPWb+52ms4yzpebC7LLwpEX/Yxx6EzgbBQS5O+w2q1ACirGzCnDPdvV:faF5XslzkO7/IE2QJVQS5O+w2q1ACirj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238839, "uuid": "9237b5db-27c1-464f-b076-efa58eab0d59", "value": 579944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238839, "uuid": "44da629f-62da-488a-892e-4530cfc172bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238839, "uuid": "f0fb3731-557e-415b-b21f-e02465a35e6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a39814-f391-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684204019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204019, "uuid": "b8b21e2a-71fb-434d-a0b3-3e4223793f70", "comment": "Malware payload (GCleaner)", "value": "0154c82e0b1e12aa13869ac48dfda0ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204019, "uuid": "2e294391-a487-4e6e-9764-fedbce55d9b3", "comment": "Malware payload (GCleaner)", "value": "59107004f27aec78f567ab4ef6aded8cf101d2d18ec3c00cb6988e3ea96280c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204019, "uuid": "6600b6e9-5b3d-4196-902d-1c686f00019f", "comment": "Malware payload (GCleaner)", "value": "c2d6b41db4f0c1fe5bad224939a694ee58487839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204019, "uuid": "050896e0-9128-41df-91d2-64435ecf1eeb", "comment": "Malware payload (GCleaner)", "value": "dc3e91cd4c79f187eeeb31c5a4aa06ea19e8cb1b947e36b75088764de9be170e0b5e5a58e934803a499fc9371764521e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204019, "uuid": "dae0f304-1a95-40b1-8a49-c8fb6858be4b", "value": "T16395334FFE7786F9C401DB785C6C85208A1BBA81E9E9D82371E9644C2F7F74A540076A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204019, "uuid": "79da1db2-9126-485e-80fc-d7c695f559ea", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204019, "uuid": "63f9dd45-da04-4f2e-ba97-4939dd44a4e4", "value": "49152:QsqfeZGHGZvZCKaNnk7v1r2saPYM4Lptoq1d5QUEAG5c6:QTGZwGZveNnk7tr2saPYVLptoq/EXc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684204019, "uuid": "51258aea-c671-4bf6-bb83-ccf3dd4ad903", "value": 2004209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684204019, "uuid": "4bd58e44-c713-479b-ac12-f6cf96c09717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204019, "uuid": "3a5d7f9b-d28c-4427-a1a3-2952d4d6a7e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c191c26-f388-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684200116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200116, "uuid": "50cf76c6-dde5-4e9c-9ac3-353e687915c4", "comment": "Malware payload (GCleaner)", "value": "3d60a32cd22699ff371b91f03b5db1d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200116, "uuid": "023579e4-0f17-405e-bd65-d228b511e036", "comment": "Malware payload (GCleaner)", "value": "59253db1356c4e57c47874d64601bae5eec65241d59642265b8219308d55ea41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200116, "uuid": "a7578434-f577-404f-9011-c56f607278ba", "comment": "Malware payload (GCleaner)", "value": "646c4470d8ab99968b249d5a2dbac9495fe603a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684200116, "uuid": "71ca6c08-66ba-43a1-a195-8ab224cf0326", "comment": "Malware payload (GCleaner)", "value": "623139d51a1896755b6b67335ae955ca97a4b23af51ec620d63df40bbb3bc35a6b0394338796b3d8ea5f0e472e9d1ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200116, "uuid": "d6ca1a2e-4915-4562-a1ee-750b407eee61", "value": "T18F953342A69B8334E4524EBD8D9B8B60C5773B7A05B4C42E23D905CDBF37C622D609ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200116, "uuid": "8a5eb098-8c07-4b69-85a7-a75eed6a3d1c", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200116, "uuid": "aa5f9976-0305-4f19-8089-94639ce84d55", "value": "49152:sVKlvUVsB/pvs2tfoUQQkRHYCfwRN9I9k3dIGIcI0oqOW0rAG5ck:s0cVs7vrG1QkvfqqtcaqwXck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684200116, "uuid": "d50974da-bb77-45de-beaa-246352419ff8", "value": 1987566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684200116, "uuid": "75512417-5dc9-4ebc-9db2-a101331b6a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684200116, "uuid": "6b2367fb-c549-4fa9-9917-c829a407ec41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fd8485-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684233989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233989, "uuid": "8028a33c-426c-4464-9eb2-ab029c4cee89", "comment": "Malware payload (SnakeKeylogger)", "value": "1b9f7cde7c3581a5daabf5be8f76786c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233989, "uuid": "acdac073-794f-4a6d-a119-f949fe748ee6", "comment": "Malware payload (SnakeKeylogger)", "value": "59c2f70e5cd0cd6c24c2ab51aaefb332d12dbb46dd9ffdd84d4848dc290476a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233989, "uuid": "cc7621ca-b79e-4bb4-ab35-198430b7ab35", "comment": "Malware payload (SnakeKeylogger)", "value": "a97b8fbb06dc402ad4abd6308a40ba6a0279ade3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233989, "uuid": "7e85fb47-0cf1-48da-8373-1c40d9f421d3", "comment": "Malware payload (SnakeKeylogger)", "value": "f6542c40f0f6ed87a9ca70909a68b9af9fd095717eeb890d16449151709637fd20e34238dacbf37c1d5d9252a8cbe5ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233989, "uuid": "a383a863-acc6-4539-a124-1770abe3beb3", "value": "T1DDC4D070619E8AD0E00ECBB165BCFC72437170E3EDD9C9751729A284CE66F605E88E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233989, "uuid": "2869c713-1fcb-4628-9f47-3dbe02d652d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233989, "uuid": "c39b47ba-330b-470e-8013-0837e1b4fb97", "value": "12288:300njv5cTwAJ+56Pisju8XQyPviPyjei7NOtxDJYywwk/:k0baTwd569b1v9Otp4wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233989, "uuid": "3564702a-0033-48e8-8b48-14e85c5a376d", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233989, "uuid": "f2f0e065-6606-4457-8334-62a01b03a6c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233989, "uuid": "7a3b2de6-da0e-413b-9425-cd9006477167", "value": "FACTURA R-40479671.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8178f31d-f40e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684257865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257865, "uuid": "f8aea964-d6fc-446a-b8dc-1ac59188f1ff", "comment": "Malware payload (RedLineStealer)", "value": "5b4ba28231c0ce979d695d91cc61d11b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257865, "uuid": "8292457f-8b0e-4342-8a6d-3d1d9a739c5d", "comment": "Malware payload (RedLineStealer)", "value": "59d409b3c9830f472f399360bd066e5d3f34c10aa104d9a06ebad9b9cfd94353", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257865, "uuid": "82741745-25a1-4da7-b242-82b7938d5789", "comment": "Malware payload (RedLineStealer)", "value": "afb32011f77d94a3ac0e12c4bce267828c32e565", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257865, "uuid": "bd008e9b-476c-454c-9741-43c424fbbbff", "comment": "Malware payload (RedLineStealer)", "value": "1f0fd79200dcac79ba186810799027ad34f96e0eec0868eb49776e3f6556a776454644ee710008f704b171833507cfa2", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257865, "uuid": "ff778dc7-e421-4fb0-8e17-71ad5176e079", "value": "T17A452323B6D08037DCB66B749CF986531A3A7DB19939C31A230ADA1D2C717C2A132777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257865, "uuid": "af289d98-7ded-4903-97a1-906d3018f65c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257865, "uuid": "ca745a55-2fd8-484d-8703-531b9a2ba3d2", "value": "24576:8yMe9Fx+ndw6BQ+wwLVpzDXqvQ03a934QISyCl0:rtxqu6vwkpCjUfzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684257865, "uuid": "d1e30b95-2b67-41f4-be34-dd9a4123da49", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684257865, "uuid": "3889c90c-84c9-434b-bfbc-ed3fa16410a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257865, "uuid": "b2da9e2e-ec45-4dbb-8c16-63e8bbeb5323", "value": "ItsNotABugItsAFeature.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2b9e50-f42e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684271525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684271525, "uuid": "5871cdb4-848d-4dea-8c2e-fa7880671f62", "comment": "Malware payload", "value": "95565c3d368291de61992d557e9919c6", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684271525, "uuid": "9d84d0c7-ef6a-42b0-b80a-f3cd70e5652e", "comment": "Malware payload", "value": "5a7654a9233906d0852ca21ab8666f0ea5fd7b2515c87f1e2f52186305bc08b3", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684271525, "uuid": "4d240e12-602e-4ab6-89a1-7f2afb7a43d2", "comment": "Malware payload", "value": "d0242d8e9f7091150416f76db9a8d5dcc4ae8abb", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684271525, "uuid": "5dd805a3-29ef-4fd4-ba5e-ed109ca83ea0", "comment": "Malware payload", "value": "17f0fd6fb1790ff6240889329b8852d8eec94bfe3add2a2cb25ddfba17a3924326dce737c18d5bee363df76e36e2cd26", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684271525, "uuid": "eacca324-7f43-429f-a15d-2933e7b6f437", "value": "T1C551851AFC47D14C6B79236BED878A62FF1B801B5DA2104C75ECC2495F20809A7ACF5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684271525, "uuid": "c99e2566-7a9f-4653-977b-dfe6ee4c193a", "value": "48:A04POjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQBozl4X:oWChrffoypvK0elkEYZa5ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684271525, "uuid": "7856010e-d7e7-415b-8ede-63c5d666fed7", "value": 3168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684271525, "uuid": "7c62b922-9a72-4b9c-8093-71e3b5fb9689", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684271525, "uuid": "6006634b-f93a-4f80-95a6-8a6a9b3cbe29", "value": "1ZQDtSTY.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdcb3f0-f3c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1684228437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228437, "uuid": "9c649c38-4903-4f9e-840b-35fdb22b9341", "comment": "Malware payload (zgRAT)", "value": "96806ba99e9e85d9561732521cbcb587", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228437, "uuid": "ae4b9f4b-ed60-4d02-af78-1f7814c87cd0", "comment": "Malware payload (zgRAT)", "value": "5b405dbe70d390102eff963cd3ae7616d412c9644739ab79697b75750170f794", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228437, "uuid": "05d943a7-979b-4a8d-82fc-8a3c3d8d9d5e", "comment": "Malware payload (zgRAT)", "value": "a81b89f8dc5e21aca41b7207800d92d55ff1a67e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228437, "uuid": "fd5e4286-5f4d-4e55-b40b-9066a329266d", "comment": "Malware payload (zgRAT)", "value": "3ed0b535547e079408c5740eeb9187f77a4593e53dfe76340cacbc350f76433ab4c6e38aa5200c00f955cdc50cc524d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228437, "uuid": "42fc82ff-3b06-44fc-b01d-7c5d344ef190", "value": "T13A34E1087BC3021ACA5999B142E34A7403F6B3C729B3D6D73A8887865F427D5DE8D79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228437, "uuid": "2cba9c9b-8db6-4840-95f0-39138727c6fd", "value": "6144:fENWk3enpKUz1JOCiMOmtePGTdJRPHonewGn4:C8pKEuCipKePGT1/Xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684228437, "uuid": "dea2d156-f7ec-4d59-98e7-f93803eb7cda", "value": 232520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684228437, "uuid": "e186db38-b00f-4e2d-bb27-b19137a544f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228437, "uuid": "025f96b4-97f8-4ed8-a66f-6850f4902422", "value": "1402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e8971f-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684235316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235316, "uuid": "8bc4b739-31f3-4cec-b383-9f6b21c0c220", "comment": "Malware payload (SnakeKeylogger)", "value": "58d456f97f54cfda39bd01159fa5795c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235316, "uuid": "0ef7548e-28e6-4e20-8674-5096e998305a", "comment": "Malware payload (SnakeKeylogger)", "value": "5b67a54df45cc6e181388808f9cb35b0c2660d27b895889da37938408fe22072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235316, "uuid": "6094b8fb-5d9e-4207-a6f7-490a2d2122fb", "comment": "Malware payload (SnakeKeylogger)", "value": "ee224f8e2a01b12aff75c22414f835b4b530dfb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235316, "uuid": "98b9c7e4-9f04-46f1-8dce-bcdc18c00c55", "comment": "Malware payload (SnakeKeylogger)", "value": "5d18a1c924de24dab43dfa8547c0ebbfd2328bc520fccfdfaacc31539a5eb49c3cbb03e8f42da3dad896ee18c1f3e7e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235316, "uuid": "3234dec8-3e19-4e39-98cc-89a8120f0921", "value": "T115053CE1B09488DEE85B49F1AD7DBC3010A37DDE95E4410C166EB71A6AB3342249FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235316, "uuid": "1b304738-f5d4-42c5-9119-de84a7c6fb8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235316, "uuid": "ea06e545-1cd4-4ba7-889c-554da2599ee0", "value": "12288:gv51Z2pNKbO4NW87Jz4XPD4ukjuZM/LBxKQIZjU:cPZ2pgbOKx4XL4MZM/LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235316, "uuid": "c792652e-70b5-47e2-bccf-c5bd0c4231b4", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235316, "uuid": "00c6703c-2a05-48dc-b8b6-c93250101e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235316, "uuid": "9696248f-18de-4502-90af-7554ebcd762f", "value": "Halkbank_Ekstre_20230516_0819705_452378.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2c0d65-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233613, "uuid": "b5d1fcc5-4088-45d2-a896-1f8977c300d5", "comment": "Malware payload (Mirai)", "value": "07186d67839f2845095b669c87984721", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233613, "uuid": "be84a3a1-af6a-4e9f-88a0-78c2cc870c9d", "comment": "Malware payload (Mirai)", "value": "5bb6277cd6d0b9dfda2653f059f81a13d6daad05ad32b439effec4885e60c641", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233613, "uuid": "c3b6c149-4936-4848-9e0e-5a9bd8a4c4ee", "comment": "Malware payload (Mirai)", "value": "63f7315f42e2f01a7db3704611d53eac221cc694", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233613, "uuid": "f76e742f-a49f-45e2-abfb-603ea85ee8bd", "comment": "Malware payload (Mirai)", "value": "a5363f734f709e33db33edd15267cb5a7f0e2aa76e94f7cd60ebdd4ba92b5c6b7d64ce30e6037c33a09029ae15fccf7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233613, "uuid": "8d845996-6830-4af8-aa7f-96f473450521", "value": "T15BC2E17092ED2CF2C7500532E6786BC9AA534F7CE6FE3C90124057BA7941C0669ED9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233613, "uuid": "c9a876b4-35d8-4a75-8969-b9972ab02f98", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEsPcluChymdGUop5hu:A8soTAZ3alkXLvFh8nNEsPcts3UozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233613, "uuid": "b297a416-6df5-4c99-959f-bc65916488aa", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233613, "uuid": "762c7e87-1f8d-4549-8f26-0ed85b6c47a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233613, "uuid": "77748420-cac8-40b4-8521-f2565f986016", "value": "07186d67839f2845095b669c87984721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0f4102-f3e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241889, "uuid": "38dccd55-a588-4f03-8a47-3382d9acb3c8", "comment": "Malware payload (Mirai)", "value": "3636b4e93f5c33e31d1178e4b64c95aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241889, "uuid": "eb8f4647-207b-42f1-938b-afc40e49e8b3", "comment": "Malware payload (Mirai)", "value": "5d1ae9677a6a449f5011363438661e94be6f1ca872c431d3b8e82d368ac78e79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241889, "uuid": "1d7d8285-443e-4395-a1f2-e5d19f201853", "comment": "Malware payload (Mirai)", "value": "159eb5b29692d572977a9f804ebd361ac5fe7610", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241889, "uuid": "640a0e6c-e062-4078-ae8d-72921e7dac66", "comment": "Malware payload (Mirai)", "value": "8234eec989c421e942e50a822a1c3de48f3fc6695c76daff0712384e8a892575fbb65049f97a647d33af15f69f21da02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241889, "uuid": "71a0a702-3a54-4a64-9687-260498389b48", "value": "T1DD632851BC819A13C6D1127BFA6E028D3B2623E8E3DF73179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241889, "uuid": "3597d730-fc7e-4fa6-a6f1-298b194216c9", "value": "1536:iNSlxAmiik110lOO//kWIjc/+isI3AA8PNRu5AvbWQ:iN/CbkZgWisI3/+Vbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241889, "uuid": "45bc9601-a88c-40df-825d-43f6b977edfc", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241889, "uuid": "a625f57a-05f7-4a49-bab6-2f03abeb0f71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241889, "uuid": "1e90261f-b3f6-414c-a6aa-ba46fa0c97fb", "value": "3636b4e93f5c33e31d1178e4b64c95aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79ef5b2-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243756, "uuid": "2e105ff2-3461-4037-a636-b75887672408", "comment": "Malware payload (Quakbot)", "value": "2d1f168846fbeabf2194d3f5c9106b7a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243756, "uuid": "f62b8eaa-950d-42ff-a909-ee27fa5dbdf0", "comment": "Malware payload (Quakbot)", "value": "5d911daed9539db7ccb787f97cdfb9a76edb772277c94b5f1b6046ef6bd9405d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243756, "uuid": "46033cf6-87c2-451e-bd62-4e5c372b32d1", "comment": "Malware payload (Quakbot)", "value": "414b7da40525c0129429c2275a6f71913af4a5b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243756, "uuid": "c5ee6e06-c52a-4a17-b3d4-18bf47e86e08", "comment": "Malware payload (Quakbot)", "value": "ccd35090172c49181a6f419f34fc51ad74d57b0417655ec3d1572e4091a618df44b65afde0c024ed383bdea35c80ea3f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243756, "uuid": "fedf8df6-2b32-4e43-bc9a-20a1a3a6e864", "value": "T1C3341FD04B5154769B4BBC22BB30E5A1EBBD0E708288938BE45F3365B2CE68CDDD5724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243756, "uuid": "42b3e08a-5198-44fc-9aab-408e15fee850", "value": "1536:mDN7+9pdjVZPLTcFzDVOEUozx8GL6q3GeRmUj6heYtMBFnHpI01GhvVzxPCI+qbA:y+3rjQRDlg9SqbvW17dzM1mvph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243756, "uuid": "c75af985-d1e3-4c82-845e-b46715c0b3a5", "value": 244464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243756, "uuid": "8bea6ce2-8b75-4933-8bf1-95443fd0ba07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243756, "uuid": "799532bd-b5b6-4b39-b7b8-2c026a4ca732", "value": "Xgwrndrv.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e704d6d1-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684233984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233984, "uuid": "f53d2e16-b850-413f-8415-e965c461bb01", "comment": "Malware payload (SnakeKeylogger)", "value": "1436f910ff222cb17c6a5e96d7d0a69f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233984, "uuid": "5a019585-d8d6-4761-9856-378b37037b5d", "comment": "Malware payload (SnakeKeylogger)", "value": "5d9bb423fe6b1cb4fa77edde15ac108d779750606fe6dc904c3190af91b4af75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233984, "uuid": "2e61d1a9-95ce-4d5b-acd7-74feb455c51c", "comment": "Malware payload (SnakeKeylogger)", "value": "cba67e2d2247e0474cc0267e9660f203ac1904fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233984, "uuid": "c48c9226-f53f-4c48-9a6c-4116590fab89", "comment": "Malware payload (SnakeKeylogger)", "value": "392b51fafa1617a33cd96b85a9a1cd6cb620a1924ac3193ca81d6d0478b616cedb7eca9b3570cbfd7ffb4eee6a2e4f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233984, "uuid": "3775660e-d79c-4b86-96a5-1c1552067ada", "value": "T179053DE1F19488D6E85B4AF17D3AB83014A37EDE94E4811C56ADB71666B3342309FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233984, "uuid": "a1f965d7-19d2-4273-a8d5-cd4a08809566", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233984, "uuid": "4838945d-598d-4355-9c26-b9bd820c08f8", "value": "12288:lY8v5vljUqYes048f+BdY2spdbBJolfK9MpCPJcXbMoY:J+esj8fkS2wpBJJMpHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233984, "uuid": "02ca08b8-ae2c-42f5-934c-7aa861294e44", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233984, "uuid": "6c1b92a8-ffcd-4cfe-a7fc-25b35a753f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233984, "uuid": "8c089729-e0db-43c8-9c0f-8877a314869e", "value": "MALZEMELER \u0130\u00c7\u0130N BELGELER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f165d5e4-f42b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684270508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270508, "uuid": "5081e99f-47ff-4894-bf23-a597b9cc1aa6", "comment": "Malware payload", "value": "b4e51be87029e822bf6e3b463da29d79", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270508, "uuid": "578b3ea7-8b34-41c1-897a-6f990ded3387", "comment": "Malware payload", "value": "5e1fe72df804272ec2938d6a56a454ae5b6466a5c15131be5ded03b88563a7c9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270508, "uuid": "800a462d-e55f-428e-b398-894d1ac1a284", "comment": "Malware payload", "value": "081171482c1ecd673ab9918b301bf22ad6c0697d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270508, "uuid": "a2f8dfb1-9762-491f-879a-10318a50cf11", "comment": "Malware payload", "value": "f3ae94aca8cf45c4d88fd4c236ace711b5e837c71746de61cef9e89e2c5b64ef65c9a0ea0f04de81a9a679195a632319", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270508, "uuid": "8397c320-c75d-40a1-94e6-e8ab4a4e09bb", "value": "T18B64E0463AC70912C5559AB191D3092413F3EB9B67B3C3DA3D4C429A2F037D25F8ABAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270508, "uuid": "c5b691ff-914e-45c7-931d-f6e77cdd5201", "value": "6144:FelDePKKBOgB5lvI0gbiM/BkCV3xVN/qPJt9Bo15qtwNn4:EAPTOgAuMpV3dg04w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270508, "uuid": "4f7ec0dd-9442-40a0-b9a1-61d887efeaca", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270508, "uuid": "9b7b5491-3add-4396-b9c5-04b8dec6de00", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270508, "uuid": "889ab1f8-ea9a-468f-80a3-6704f12c9392", "value": "Shipping Details_PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7664344c-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232077, "uuid": "f40d0791-e017-4938-a652-3a0e37b8456d", "comment": "Malware payload (AgentTesla)", "value": "ff18c94e0d030d8d1562b76d71589be0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232077, "uuid": "ea410d5e-e767-474f-9aab-7a57a288eaa0", "comment": "Malware payload (AgentTesla)", "value": "5e84db608773bb4a8f9c328de74464ec5bb3862e1f1d12fc074cb292c0ea8da1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232077, "uuid": "3b8d9238-bcb9-43c4-ab68-1dec4d1cdf3a", "comment": "Malware payload (AgentTesla)", "value": "e17a1ac115ebe4530e48fc7b4f954bfc654827e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232077, "uuid": "bb7ffb98-1f8c-472d-98f3-76cf91ab4bba", "comment": "Malware payload (AgentTesla)", "value": "a1e9216828d47819d8384d189b681394a10b3b43aea7bb3e9f554c065df2f21663107986501f39ae341f29b8db3910ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232077, "uuid": "7e48f084-5c7a-4328-8ed2-e52de5932bb7", "value": "T1D793F8356B49CDF3E5A85A79EC4204F4B678AC16DB22F32B46403D5D2D773F8093129A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232077, "uuid": "6a77e963-87aa-411c-8666-bcf21b3fd2c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232077, "uuid": "9d361760-4242-4edd-92fa-f22129bbc42f", "value": "1536:y5PGyW/roDMxoBl5JG9vRx5hZGm85wZOYlmDRVOP/pa7zgD:ybW8DTudRHPZUR8PhaYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232077, "uuid": "655fac24-0fe3-447c-948d-11a4684cf916", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232077, "uuid": "cf51eb27-5e45-49c2-9882-8a10c254b4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232077, "uuid": "6f9bb4da-da80-4f9f-a060-d961a4f480a6", "value": "Ovnemhfto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb15ace4-f3b0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684217670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684217670, "uuid": "f733e15b-028b-4e5e-9981-74d994cb89ff", "comment": "Malware payload (GuLoader)", "value": "c872967e9175a5345d11a0a7ba1a2240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684217670, "uuid": "c43cc663-bde5-476c-9720-94d86c536582", "comment": "Malware payload (GuLoader)", "value": "5f6366e20fde275710415f996748edb9f1091c0b0e47bf2ddc91a59ecd90d54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684217670, "uuid": "b4ab182a-cc06-4495-a95a-08090dc4ddc3", "comment": "Malware payload (GuLoader)", "value": "1a7a1388ee67fde14c22a38f9a630aecae796272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684217670, "uuid": "8078a21a-15d9-4f2d-8375-706201e28043", "comment": "Malware payload (GuLoader)", "value": "69bf67c4fbaf252402dbc798e6d4091c02a8dc375a0ca1b50eb777d056cc53bb58a5a58018928ad51606515027aae3e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684217670, "uuid": "5409bf31-d475-4c96-a705-3db91a55ee1b", "value": "T10D1523621261D6F3E1A31971C4677FFCEBA8CCA1E7455BE313807ECB7C782120A5A526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684217670, "uuid": "e10a2eef-99f9-4136-b54f-1c1e07778047", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684217670, "uuid": "1e3e1455-2f35-4302-84b3-91541a36755b", "value": "12288:wrRquUH6UROvPORRu4B5jPlxxsUzZbhuOWzM6QnVKEYyO/7zieeP:j/H6URd/B5Zxx3zZ9uFzTEKE7Oaeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684217670, "uuid": "a0dc0bf6-6885-4a52-a535-2b0944e58a7d", "value": 875072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684217670, "uuid": "af02cb9f-a7ff-46d2-a049-f1e55d74612d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684217670, "uuid": "69e04e21-b2d8-47c9-92cd-4d03368ede37", "value": "RFQ-78803857.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798f8abb-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210178, "uuid": "33379932-4406-4398-a9d6-7fd187fd74fa", "comment": "Malware payload (Mirai)", "value": "a8806edde0c74b6a4ce56af7332dbd79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210178, "uuid": "ff17e6d6-ac83-4603-bbff-db5dd8ad1903", "comment": "Malware payload (Mirai)", "value": "604e90436af6703de1e844bb4efd038b251fcf20406346d7330e1d32a6f152e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210178, "uuid": "defadecc-1358-4a37-a825-cb83b49fcd2f", "comment": "Malware payload (Mirai)", "value": "64c245be6f987213547ec655ebbebe66a780a7ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210178, "uuid": "a279cb59-6dc2-4b32-8efd-ff357b0b4883", "comment": "Malware payload (Mirai)", "value": "77a19a38597cb3d61e460ffb377e6b6f36bcac9038e1d80be8369b5d624a29308bffccb6e3e6fb2db1127369590c86bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210178, "uuid": "36be7cd1-6523-43c5-9438-6a55671f4fec", "value": "T1A2B32A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210178, "uuid": "86cdb7a7-c502-459b-a95e-16c326a906ec", "value": "3072:pC/4rdZHsXsZwwR9GNk5mm/QcuLmHniPNb:pCwrvHwsZwY9GOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210178, "uuid": "33a96bfe-3283-488c-b8f1-66104cf4b7b3", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210178, "uuid": "0f8e7651-d0a5-4b79-8da7-e8f1c9791e15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210178, "uuid": "c5e209ee-1cc8-4b1f-8b6d-8a9635e3c9b6", "value": "a8806edde0c74b6a4ce56af7332dbd79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dead53-f430-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684272388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272388, "uuid": "c5fc33c7-c329-4ec2-8088-141ae9ad05fe", "comment": "Malware payload (Formbook)", "value": "5ca240dfc2102f78c9a95a5b38d61577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272388, "uuid": "cb370653-8556-49e4-8b00-ad369d343b30", "comment": "Malware payload (Formbook)", "value": "605f71ec40753fc1ed109e605c82d7817754acf6f2ad10adf0699aec99173609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272388, "uuid": "0db42f5a-94f1-4fa8-acd0-fae4bc4dd77b", "comment": "Malware payload (Formbook)", "value": "c244a56d0bf282dafa76daa0dae83b42d0562bae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272388, "uuid": "44ddcbfa-0fc7-4dbb-80ed-de4275ef7959", "comment": "Malware payload (Formbook)", "value": "31640f75204c8f5dcec0a3b8c6633ed5cf5da6667e164218a17898352a0e3920c39f2d049d01c53a7f753dd8718f63ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272388, "uuid": "221b6ea0-b4df-40bc-af02-5154aef8e63a", "value": "T15FD4D07560DE4A90E41ECBB265BCFC72433170E3EED9C6750729A684CE27F602E48D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272388, "uuid": "ea5df806-538c-48e7-b554-e9556f26783f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272388, "uuid": "b86439c3-9054-4f91-890c-79782815aefd", "value": "12288:hxUnJv5JwMSzoTylq/YvEa1cAk9r0hmY34:3UpbwMSzoTylqwcehmu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684272388, "uuid": "a525965e-c5e0-48c7-a626-3ccf1820b89f", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684272388, "uuid": "e51c645a-b77d-4803-8651-63d6452f334d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272388, "uuid": "21278681-be2f-444f-9fb8-c79467d4317a", "value": "Request for Quotation_PDF___________________....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c8af24-f42c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684270843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270843, "uuid": "2201e116-9215-4bf1-8ee7-dcef82bac45b", "comment": "Malware payload", "value": "0c6c529ac402229837a07c0d09d4b841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270843, "uuid": "7e1b7357-eb54-4bb1-95b4-72a785738bbe", "comment": "Malware payload", "value": "61242d372c2335940696dbf6d7ea85fbd95bd192d40a2e347faf43d9cbd04c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270843, "uuid": "e2d04746-55b2-4690-a9ba-6d0199d071c7", "comment": "Malware payload", "value": "79e24c6f76464478bd88c45b0d0dd50296d5fd07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270843, "uuid": "8d91920c-d7ba-4781-9499-343f23ac8647", "comment": "Malware payload", "value": "4289212cdbdb14d6aefce59f852f8d1ee2aceb4299d53e03bba83c294c6823028890d4b8cb3a20f7447874560066d2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270843, "uuid": "d2f05250-4080-421e-b3f3-29d354251fbb", "value": "T1D6C4D070909EC690E01B87F165B8FC72023134F3ADE5D9351B59A2C4CE67F58AE889DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270843, "uuid": "139807bc-d621-478a-afe9-2eda4395d9dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270843, "uuid": "fe40550f-d9b5-4c65-b2a5-aa96804f3bfc", "value": "6144:PYMbsEvycCJULPWzt7dfzWrrl1K7GPy9hXwCI8rpYeCBfPc7e51SLK1kF0mpk3A:PYov5+UzAWrrl1fyrXwb8QQe1kF0Ik3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270843, "uuid": "09b57442-d704-4868-913f-cb992c909aec", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270843, "uuid": "16ee0803-8990-49e4-be03-fa3117bd53f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270843, "uuid": "4da2e541-1536-48df-844a-9ab54d8009f2", "value": "fatura_25148.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80a429a-f3e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684238227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238227, "uuid": "39b61137-12ce-4e0d-9432-8c3659c7c2aa", "comment": "Malware payload", "value": "e0751a20e60b94f0aa80289f542fa352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238227, "uuid": "bdcfb46f-771f-430c-a479-06ceefc28b32", "comment": "Malware payload", "value": "628c37ac8ec4cddd94c9286a0e226b4e2643699be8c23a2e17930ccec854765e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238227, "uuid": "aa5fb648-f208-4066-b173-9fed27496b09", "comment": "Malware payload", "value": "3a70b19e5d1e6e95af7fb6fe00752fef57e27259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238227, "uuid": "8e772401-b1d0-4a8e-aab7-0e6e1f68e981", "comment": "Malware payload", "value": "42e9e1f7742bb2906eeac22b73be4792e8cfb5bf7005536fcc2b391addeee796a0433759a89b88a3fd44a2e3756bb42a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238227, "uuid": "37d98e51-c709-46b0-80de-a34e561b2664", "value": "T1F7856C10B791A128FCF702FA4AFE217D953CBAA0075890D741C865EE862ABF17D32757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238227, "uuid": "988ce981-6e99-493d-9a41-f088b95f9162", "value": "dc1fa078c578afa275126bafde0ef2f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238227, "uuid": "f6808462-28a4-4836-8db3-d30a54fdc367", "value": "24576:DTjFmn+8zkEC+XnjVUfnZP7jdM6fH73btN+dYVB:zFmxzfC++dRb7VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238227, "uuid": "eb8c801c-73a4-477e-856f-abdb67422465", "value": 1856128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238227, "uuid": "8c87b5f6-42d5-4c33-a91b-0b23069180bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238227, "uuid": "70b0ed31-e9aa-4b84-aae7-429869570831", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffac42f8-f40f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684258506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258506, "uuid": "3c1b5651-cdd1-4efc-9c08-d60c50d19efd", "comment": "Malware payload", "value": "8a2a0a7444eddc8095bc89ddc519ad39", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258506, "uuid": "18a4e544-cb54-4e2c-ad4f-1b5b5880625d", "comment": "Malware payload", "value": "63db95659a9d76271313f51557092c97d4587aae45337e1087e58620480773c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258506, "uuid": "a39ec9fb-1dd1-4ada-8efb-4806830ac89b", "comment": "Malware payload", "value": "430fb8653f73634a3508180bc5f6f8a6cdd9b582", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258506, "uuid": "22c0f99e-c6c5-4d87-b52c-9f3f6c225c8b", "comment": "Malware payload", "value": "ff338ca21b52e9418a32b2aa560c35c6973bd56d1b644dac048f993813a883bd413f34fbc06a81f0d196a3b8143d2c0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258506, "uuid": "d16979ba-1d54-4bf4-84b6-df05a10b245a", "value": "T10EC254437B9BAD33C59C87B83897DB2C91B3D4B446698F47156CD21508433C89EBBB2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258506, "uuid": "76fbe73e-31b7-4b58-b095-9b37e88f857a", "value": "384:4uwuOakdInuPPPPPPPPPPPrrAhnxuMegb/g:OJa7nxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684258506, "uuid": "768e4c60-e945-4b98-9999-88c4a5e6606a", "value": 26440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684258506, "uuid": "aab6b50f-43ba-4c20-b982-312d00952d93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258506, "uuid": "c5fd18fa-8c83-4057-832a-6187c475b318", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7a1ec8-f3f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684246640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246640, "uuid": "6d736fd0-409d-4dc5-9896-301d8dbc83eb", "comment": "Malware payload (Formbook)", "value": "d35fc5185c8a58731cc0b8c4371e6c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246640, "uuid": "5a86016e-15b6-4e42-a390-1c40731abbb1", "comment": "Malware payload (Formbook)", "value": "642b58aecd23773984d262d3ec75346a5ed4f5409ef9aaa5babc4dcd0619b427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246640, "uuid": "406e9ee6-3510-4205-a14c-eb836fc750f4", "comment": "Malware payload (Formbook)", "value": "0a49e4e93331b618a952a0435b587e4811de1508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246640, "uuid": "038276d1-7b79-49ca-a796-3c33aa7fc84d", "comment": "Malware payload (Formbook)", "value": "6a2d954f1b4ead04790138c7bb2987a8f05eec1a574fba6d1fa7ae6ba6668019efa39c02bd3b74007ea46ae34f4fe697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246640, "uuid": "f34ceb35-5d0d-42f2-b68f-6fe778ddbbde", "value": "T17544120536B8C627F0E146734D761A2FAEE9EE0B08B5570B1B900F913E33091BA29777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246640, "uuid": "c0f7cbda-222c-4942-97d1-160db6119bb8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246640, "uuid": "1908f8f5-0027-426e-9501-836396f8c3da", "value": "6144:PYa6xhzbisGPq9rYlK9Tnb2hF2HWxp7+yOyXe:PYLhzbZyE8OjbsU4p7+TyXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684246640, "uuid": "23686733-8f70-4aa8-a0fc-d3913df6f9d4", "value": 255334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684246640, "uuid": "5d3342ae-5a04-4bc0-9778-aaf9768fcd02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246640, "uuid": "0e5067d3-1489-4c2b-9828-9c2fda424ebb", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.22806.13866.12295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a48cb36-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684233291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233291, "uuid": "4c2f90d1-0f92-4039-990d-c716681a234d", "comment": "Malware payload (AgentTesla)", "value": "ac74d56a65891302802f0494f52daaa6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233291, "uuid": "cd89d5b8-1400-4314-83ee-12a1b35f58ef", "comment": "Malware payload (AgentTesla)", "value": "6567b413f1b0eb59524bf558b8ad889510132c063ffde1c2729b036dc4cfdaa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233291, "uuid": "ccac0364-ed8f-4bd3-8962-02e9575b89d6", "comment": "Malware payload (AgentTesla)", "value": "287f1058a3272acf3075777ef523d1d9a93b34a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233291, "uuid": "b2678ea7-9171-4e81-bf57-017a535dbb14", "comment": "Malware payload (AgentTesla)", "value": "0f9fc8249542085d5a8ad8f7ff28e2fb6da51642532d0a774aad67768d83fed021ee224f4adbd2ad5ea026fddd8943e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233291, "uuid": "b7cf95b6-5151-46d1-be1a-efe156de524d", "value": "T155B423805786FD03FC56C32E1BDD2BA426152DB787C99B75BD4B01ABA58C9398238373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233291, "uuid": "f8254112-6809-4f5a-883e-e14be904bbb2", "value": "12288:NdZFs9z7ifkTCduZCbXFd390uyTBrOJc6YkkcZNrsjFGS0:NLFs9z+fYOuZCbT39PtPFsRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233291, "uuid": "f99a38cc-a094-4887-bf5d-717bfbbaae42", "value": 509805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233291, "uuid": "65fec1c4-ced7-4fa9-a9d3-f752eaf3e0e6", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233291, "uuid": "4c921ab2-e576-4b2c-993f-25d701d949f4", "value": "TransportLabel#8000766_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb92740-f394-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684205538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684205538, "uuid": "841c2f12-364b-4e99-832a-509b84347045", "comment": "Malware payload", "value": "c185ea44ef581879ccd3ded6aa6d6938", "object_relation": "md5", "Tag": [ { "name": "More_Eggs", "colour": "#238A65", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684205538, "uuid": "ea396b36-1108-4dae-b92a-3b17d29a166a", "comment": "Malware payload", "value": "65e1a42ef32ccba14445b71394ba679c09c2f5dab0cb5ddfbc7574993acb28f5", "object_relation": "sha256", "Tag": [ { "name": "More_Eggs", "colour": "#238A65", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684205538, "uuid": "24949eba-187e-4ef0-a34e-50537017cfa6", "comment": "Malware payload", "value": "1579fe46f0cb4f8b8349f74a54837e7629830934", "object_relation": "sha1", "Tag": [ { "name": "More_Eggs", "colour": "#238A65", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684205538, "uuid": "a58f4fe7-d3fe-408d-bf25-0276597613f1", "comment": "Malware payload", "value": "1f076a22a20e10a62e9e2aa4c140c25528bed386d6f4b9e01fd85f27e0257dbbdeb8435bed4850c98e275c3b3b06aab3", "object_relation": "sha3-384", "Tag": [ { "name": "More_Eggs", "colour": "#238A65", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684205538, "uuid": "a56bdedf-0b03-47a4-8afa-29cfb4d86187", "value": "T1E7234FE2769E944FC3C22309403D5848DC7CEDB1235DD8ADFE95E4E8B0A4A1CA3669F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684205538, "uuid": "e6e41cc9-bb74-4b12-a7b0-51091836d6a9", "value": "768:JhW58JSxSEyxtGBo/5uzwDp2dAB3pZiXvMgRDXH4FykEC:JhW5ySxSpGBo/12O3pZi/bFXH4FykEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684205538, "uuid": "9c0471b6-2204-4500-8f47-5e4693177e7b", "value": 47404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684205538, "uuid": "ef869e81-351f-404f-8256-f1455cc89c66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684205538, "uuid": "86f02aaf-ecd1-403e-900e-be5076377606", "value": "more_eggs.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ce5e68-f3c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684225523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225523, "uuid": "103397a1-a363-4104-85c4-36ac4b84a2fc", "comment": "Malware payload (STRRAT)", "value": "a22348f93f4df059f8b025fcb9ba08d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225523, "uuid": "32e3f82c-5d28-487b-8a0a-14307eca55f0", "comment": "Malware payload (STRRAT)", "value": "667b366df07423e6159ab793376345a1b494d16729650e9912ed2cc734bf74c1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225523, "uuid": "ddfbfd9a-7cf5-470f-9963-d0bf6e79a161", "comment": "Malware payload (STRRAT)", "value": "15d30f7a301fa65e728bbb7ef373a315e5eca673", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225523, "uuid": "3d6ffa03-f433-4998-bdb9-fc9fb76b0ffa", "comment": "Malware payload (STRRAT)", "value": "079d12df2888cd0f044a664f5655a9174e25b4aa3dad358d27ce5346fa91035970ea2ef07bfa1fc42ea851d9644ea778", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225523, "uuid": "4e06198f-e3cf-4794-965c-295d5ed1827b", "value": "T17B749EA6758E3F6DED74090759F62339A1E1E5473201D16F613A3F8EBF22F0A1839609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225523, "uuid": "d57d30eb-872f-49a1-ab48-ba4acbcf16ce", "value": "6144:Nho1w2DIGuwNwmCWJKj1xa6t+jY6xufvNTd+sIW4QNJcGUwWVVjd2jyo2Xet4jzN:E68IRmC1xa6t+ThQNJ8VZd9ClxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225523, "uuid": "441c93ac-7c38-422a-a2ea-99aa97ebe899", "value": 358528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225523, "uuid": "91e47ebc-b66f-40f8-82f2-4bdc286163a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225523, "uuid": "52ae7f9e-14a7-4df1-a7d1-0f1319c2a816", "value": "PO.No.660240685.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f55f47c-f3cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684230696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230696, "uuid": "da247629-882a-468a-8295-ffa7ddac2e84", "comment": "Malware payload (Loki)", "value": "bf336ccdb32c0945d4c4ae5622daeae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230696, "uuid": "6c84fefa-93f0-4669-aea0-55134abda2ae", "comment": "Malware payload (Loki)", "value": "66b390d754492159e474e9860d5431520b5d674150865a1e61377644a528da6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230696, "uuid": "1e7b8da3-73f2-43bc-8531-8f1ca3087d2e", "comment": "Malware payload (Loki)", "value": "6b4e827d3b25271c1b30c33ee32a2371442bf49f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230696, "uuid": "4aa0641f-4a11-45d3-86cc-2d724e52729a", "comment": "Malware payload (Loki)", "value": "1f6e8ba302c46dd728fbb3cee48500ef2b36ea2cdfc84b17400ce95cf11598df59b2888a4a888a391541b4688facc830", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230696, "uuid": "a437faf1-db86-40a2-b28e-c4487d6527bf", "value": "T15BD4D020B2BE087BC7AD43F2454816490BB451AB7D27D6F80DDE74CAE9D3B011B52EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230696, "uuid": "d40931e3-51aa-4c88-a3cb-8ebd8c0fc9f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230696, "uuid": "63381588-f9ff-4225-960b-2d76988e4342", "value": "12288:kysS5cSd3JcFNmEFME9J4bkBR/liTY3ynm1g8o:fzwLFME9VL/liTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684230696, "uuid": "9885a040-78b5-40fb-b963-7443e74a9044", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684230696, "uuid": "9f49c738-cd4b-44cf-a0dc-905169271da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230696, "uuid": "17830eab-fe93-41d9-adeb-ff410f0c5b15", "value": "Awb# 8457108962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7129be-f428-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684268921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268921, "uuid": "ca28f2d8-6033-4245-b32a-dbad00c3ba16", "comment": "Malware payload", "value": "5a5a0d8b61bc950f573cd349badb4200", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "timer", "colour": "#BAD549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268921, "uuid": "a4cb61f1-e9a2-41b6-94c7-1692b6cdfc46", "comment": "Malware payload", "value": "66cc81a7d865941cb32ed7b1b84b20270d7d667b523cab28b856cd4e85f135b6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "timer", "colour": "#BAD549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268921, "uuid": "fa77cd9a-ea53-45ae-b3ec-be0ea305d510", "comment": "Malware payload", "value": "a4ce53a56d0dda63ab2dd7b2af95a9a3bb569455", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "timer", "colour": "#BAD549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268921, "uuid": "04f2c19d-eda9-4613-ad25-b246edb1e3fb", "comment": "Malware payload", "value": "ea513cd9b96d298c4f4dd9e3a463a921b1e3998d5d27a1bc3b22679a538b4581ba31aac6441d40aa404f6008fe3851af", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "timer", "colour": "#BAD549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268921, "uuid": "c913d497-bacb-4a65-b44c-acb56cb0bf2f", "value": "T150C171277391EDF7DD5C723A03DF831063A579914E819B03E25CEA25AE1724C2C39AA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268921, "uuid": "7ad9f4db-c93b-45ec-bcc1-675cb62c6644", "value": "96:V1FXhNRVEn5Imj+u+ymEWdE/kJ39SxxulqL8pHyPCHL1ki7xCcVN:VnhNLptu+oQbXSPCJk6IcVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684268921, "uuid": "63a9cf6f-b0f3-4bac-b06e-5823a6022236", "value": 6007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684268921, "uuid": "19d3155d-39e3-4c69-9061-c0baff02a5ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268921, "uuid": "63db318a-7e6a-4d22-8c6b-07e5d0321302", "value": "66cc81a7d865941cb32ed7b1b84b20270d7d667b523cab28b856cd4e85f135b6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60f3fbf-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PandaStealer)", "timestamp": 1684238733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238733, "uuid": "529cd7d9-f9a7-48dd-ac08-0d52954563d3", "comment": "Malware payload (PandaStealer)", "value": "9a407b5481db5b6c67a1aa48c753a460", "object_relation": "md5", "Tag": [ { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238733, "uuid": "ed0157c6-a2ee-4885-b9bd-b1b77c56bad8", "comment": "Malware payload (PandaStealer)", "value": "66e9f4eb1c260fa1b7bc83e6554b211523baf67a8e09f9138af2ea8bc1d86cba", "object_relation": "sha256", "Tag": [ { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238733, "uuid": "2d3b36d2-6580-42e5-a87e-214e35c60916", "comment": "Malware payload (PandaStealer)", "value": "9f25c8725dfa140a271851c4f5266518dae8b762", "object_relation": "sha1", "Tag": [ { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238733, "uuid": "762b1851-6dd7-4b5c-81d3-112fb62f7286", "comment": "Malware payload (PandaStealer)", "value": "75a2f617f80057ce5e3d2085fe612dda9221fa8ee61b19144ac75083f2d6638c908cda21cf947da0bcb51be52b70c48a", "object_relation": "sha3-384", "Tag": [ { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238733, "uuid": "9adfdb2f-69c1-4128-ac0b-6447c62720d7", "value": "T1B505010070C4A835F9D6A870CCD59A754E7C7AB1D7DFA1C3A786366FC81AEE03B90295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238733, "uuid": "31d5b0c5-d3ab-4653-a38e-41b03a5489fe", "value": "46c74cf13312d6259105eaa206ede1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238733, "uuid": "890b0bc4-34bf-4360-9c06-a6b286a2c4f5", "value": "12288:d46/NuXgBsdxdDD5Mk/fVI5Jh6opxu1Ue3B4shD1izX1SqrR4xKU4VR/V0f20PZr:y6/NMdtIFXpqU27hD1clr2S0PZzm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238733, "uuid": "38492b4a-6a5c-455f-ad12-ed83f4c8db66", "value": 832136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238733, "uuid": "b930e591-d27d-436b-9a69-7d0589bd6cc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238733, "uuid": "0a5d1501-8c58-4555-8506-5b4c62ecfc2d", "value": "99242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82a1fb0-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684238737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238737, "uuid": "bd13b0f1-8014-4dff-be4c-c67a44e156f1", "comment": "Malware payload (RedLineStealer)", "value": "a5f8768a97c74ecc4c26c402f2bcef11", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238737, "uuid": "0111018d-d225-4cad-b66a-d418bdc352f9", "comment": "Malware payload (RedLineStealer)", "value": "679ecde4cd6afa60eaf6ab07179310def1cc22b0790b1efeb52ce1d80b06531c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238737, "uuid": "efd47e25-5776-4be2-aad2-4d37abb3f6c8", "comment": "Malware payload (RedLineStealer)", "value": "d234ce957544025614d49e1e18f3bac6352ca994", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238737, "uuid": "44ca5a4e-cb88-44b9-8653-358b2c86bfd4", "comment": "Malware payload (RedLineStealer)", "value": "f894f6981fc63f054c257b40fb0ddb5115447b8d633e8c5797490b75eadb7acc5e573b51b960bae5897bcb678a5237ba", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238737, "uuid": "841d9877-800e-4e9c-a076-aeaccbf05285", "value": "T1C4D42935A1895BA1DAD32D791B8DD443D19A1933ABCEB0D7D3E8F62603EE2C111E4C78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238737, "uuid": "634039c0-9864-4ba7-8468-c9069d631910", "value": "dcbd28be44f0e2127bf110a0addf7a87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238737, "uuid": "dbaf44ed-d220-414f-87b0-6379699587fe", "value": "6144:jS6d7abcho/OiptVSaPCpikafd5Y9k1WeR7LSxDxpaG6WiX22QbjMrgXScKl+mH1:W6dvhop3zlEyLeKXo8r2Kl+4mW/QKU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238737, "uuid": "26545d7c-493a-4ea9-bc4f-e5bfd7b8cb2d", "value": 606344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238737, "uuid": "036aac95-22ff-4c9a-b8dc-373b6d9e8f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238737, "uuid": "9f850148-df18-4685-9548-992c0296fc8c", "value": "KeyboardRGB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6755e9d1-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210147, "uuid": "707d0f69-e9ef-49aa-ae1d-7e504f249472", "comment": "Malware payload (Mirai)", "value": "46ec0197e1b117121809c396298bc8ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210147, "uuid": "f77109eb-9018-49bb-9716-31b75924ca62", "comment": "Malware payload (Mirai)", "value": "68b71274a431eb9b84d8fab7fdce73e7c7b6b1fc20e380168ed36f9c8424bf93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210147, "uuid": "fd4fee1b-0c77-4e2b-a6ce-01923af7f1c6", "comment": "Malware payload (Mirai)", "value": "c9b649dd36b99313e6ac992ce4fa27982f6460fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210147, "uuid": "e658e3aa-fab0-415d-ba87-37dd650d95ab", "comment": "Malware payload (Mirai)", "value": "07bfebd2da44dab7c33f0e93d1bfd902f9911de7428ce3c56be1679682d81385a676eb52922fbcf23a3ca536c93bf224", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210147, "uuid": "a4b86e5e-22dd-457c-a956-bd834a5bd78d", "value": "T1F1E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210147, "uuid": "0e82da1e-7ea9-455f-898b-b1191d2b1503", "value": "3072:Cv/WwsLgaq353qHiCOvhOpOqkDQHbeskmhxQwoVSUNu:KPLaq351hOpOqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210147, "uuid": "f12c75e2-517c-443e-ac7b-b0d282e90a3e", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210147, "uuid": "ae8b1fcd-3a25-41fb-9659-16fcb7b44469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210147, "uuid": "b9999bcb-8012-4f75-8c93-633f5e8ebd90", "value": "46ec0197e1b117121809c396298bc8ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135ffe37-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684235347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235347, "uuid": "ff877b69-3211-4465-85a4-45ef04415f0f", "comment": "Malware payload (GuLoader)", "value": "bbd1e6d9b49df8ccdf3f905613b251b4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235347, "uuid": "b2b5026d-4263-42bd-ae0c-c9a22c9ba399", "comment": "Malware payload (GuLoader)", "value": "6ae1f465cc7f3f76050a4dc053e821ba8b798e323ebf7d8237c9f98b59447061", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235347, "uuid": "9ea23180-18cb-4455-94b7-454cc47b357f", "comment": "Malware payload (GuLoader)", "value": "56712634146c53ebb6a52d12af386f9ade039f11", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235347, "uuid": "b80972ff-84b5-4f48-a351-95acaeacdf0b", "comment": "Malware payload (GuLoader)", "value": "2ad5a8151fa26593256ab55e66dd507cf88f2399543d330b2bdcce6af775ec226cc2329aff8613062e3531d434ec5ca0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235347, "uuid": "e684c8c0-7e0a-4c7d-8f22-69bcee1b2941", "value": "T123632B54CFE916390E072BEFBE01555084F896AD822580BCE5ED077F5113A6CC7BFAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235347, "uuid": "5f5857d5-9e7b-43fe-a9d9-678fc95f83aa", "value": "1536:7EzWS9zOHmu8cAoNTx9DJGbcoQYf03+G2rzK+:IUHmu8cAoNTx9DJGb6Yf03+G4zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235347, "uuid": "c8e745c5-9f06-4a51-9a2a-45c5720dc0c6", "value": 69811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235347, "uuid": "37e221fd-aa47-4abf-9ab1-eeb767d9aec3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235347, "uuid": "f18d14db-9b0b-4ddf-866b-5b5de81113d7", "value": "MT103SWIFT_83738883746467_737466477282736637.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549327d8-f3db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684235886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235886, "uuid": "caf51389-1a17-4363-bbf3-c682b318fa7b", "comment": "Malware payload (GuLoader)", "value": "aa301dc0c7fdbb92f975d9eb7e8bdd99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235886, "uuid": "5b3116dc-4cf6-4cff-a663-12fcdbd8af91", "comment": "Malware payload (GuLoader)", "value": "6c06c5e878ce129c3260c2fa7869410c5aa9cdcd0e929933c221e4e847df4376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235886, "uuid": "9d3d333c-f52c-4222-84dc-9c36ea33a738", "comment": "Malware payload (GuLoader)", "value": "d328bf1f349b89a881c14e1a7d6e5263801f2263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235886, "uuid": "bbd1a07b-5c86-4a8e-a625-20447f134306", "comment": "Malware payload (GuLoader)", "value": "8c87c9a7339d3eac18c7182ba3c706da879bd874d4130c063c05907127683a1021c8afbecc391a7b434dd5d334a7c655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235886, "uuid": "9d051637-61ee-4666-be54-78bc890544ac", "value": "T18AB412133EC4F0B3D44E29B12AA3D646A674AF11ADE157073B51BBAE0C38F819932D5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235886, "uuid": "3f240717-8c93-41cc-a83d-e1b62884b94b", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235886, "uuid": "c9fbe513-45f0-4b2b-8dfd-abcb240693f7", "value": "12288:tEu4mI4d8CgrgCQvQyflYebLk0oLydotPuqB:pJ6veJflYeHkQdIuqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235886, "uuid": "7471f934-db1d-4e54-93bf-2ae9b9478049", "value": 531120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235886, "uuid": "015d7459-8b3b-4396-8056-ea5961a01909", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235886, "uuid": "82d3ca02-026a-40cf-9dcb-0ea740f62cf6", "value": "Ordine_0117291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b851af9-f397-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684206638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684206638, "uuid": "735f1e52-d2ac-4a1e-8fc7-0a10e159a8e6", "comment": "Malware payload (Quakbot)", "value": "15266524ccbd3259f971743237baee63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684206638, "uuid": "e2529305-c09c-4955-baf1-062d2611cd2c", "comment": "Malware payload (Quakbot)", "value": "6d0797aa364d6fdc1aa3a6b4ba318a2dacea72239f381b038385013876c39815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684206638, "uuid": "379f9905-0bcd-40d4-bc6a-1ee1087a305f", "comment": "Malware payload (Quakbot)", "value": "052df73996115fcd656eddcba6d3f722c92c8668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684206638, "uuid": "9cfcd99d-5a6b-43a2-b14f-6e8931c0f915", "comment": "Malware payload (Quakbot)", "value": "3d20603054162318040ee93e0e908cbbbed4e859e9c4ecab14e2ea8101ec18515f004b8d3f109b3c153951ad7a045213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684206638, "uuid": "1032ce32-362f-4fa5-83f4-33fb90e5987a", "value": "T115651A53AA8B4DB3CDD227F055C753766338DE618A26CF6BB608C5329F936C16C8A701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684206638, "uuid": "e909ba4a-2727-4cbd-8fb6-56d346768347", "value": "3aac27062a825c121bf0b5ca94880353", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684206638, "uuid": "85b194b0-4020-42df-b460-e56a6f0750c1", "value": "24576:t5A9hQeWK5c0gWWpwY6oovpZMFjX3wO0vOnbhBwIASvrnv3h3QM0NK:tw9WK5c0gFpwRmJ0vuB6M0NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684206638, "uuid": "598d6917-50de-4b8b-b3ae-aff3005d4a82", "value": 1478934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684206638, "uuid": "e6b3215d-da91-4c4e-bd6a-0e52513b1944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684206638, "uuid": "d9f915b1-0679-4668-918a-5330257c2452", "value": "6d0797aa364d6fdc1aa3a6b4ba318a2dacea72239f381b038385013876c39815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f68096e-f399-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684207664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684207664, "uuid": "aa7db11f-8d1b-45e9-b9c9-6a956ce47c35", "comment": "Malware payload", "value": "0a860a93ae9eb2e07609e0657a93ff2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684207664, "uuid": "f59d6ee7-b3aa-47dd-b124-d62c5e9abcde", "comment": "Malware payload", "value": "6d0a669f7f63fc35f798c32dacd661db8ab04bfe43154cc41bccd7d9737d3266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684207664, "uuid": "37611b9b-2c1a-4a34-8d00-355343f9b50a", "comment": "Malware payload", "value": "037e7fc7f0060cdb21c9f5d4f4c84c22980dcca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684207664, "uuid": "3fab2a5f-c824-45ba-bd4f-85adfb82da41", "comment": "Malware payload", "value": "85869cbe67cf475b1a18f05fe283c4feae311428f0824a14f10eb17aae8e778e1398c5e51b35cceb4a333528b58a0082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684207664, "uuid": "188c4921-bd7f-45f3-827a-fc6d470d107a", "value": "T1B735AF66F78399F2DE1305F1488BB3B55231C70C9826CE5FAA48CD74BAB3C6229DD254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684207664, "uuid": "b29a2422-0aa4-4352-bbcb-d5659f32838c", "value": "fd741f117aa1c8c7e0fca77803780232", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684207664, "uuid": "03f4ed25-6b3b-42be-b1d7-3c09cec6910e", "value": "24576:E5IppXxWAeonmFM/pzKV69lFKASinin8B7etThN1zm/rHhRBk8NA:E5o7WAeonmFM/wV67tuU431GHhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684207664, "uuid": "81fdbf18-8bcc-4500-af56-d6eef4e2e885", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684207664, "uuid": "cdd555a0-676b-4070-9b0b-0d274b457fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684207664, "uuid": "4522edf8-6158-4a60-b7b8-b7b5234e2fbf", "value": "6d0a669f7f63fc35f798c32dacd661db8ab04bfe43154cc41bccd7d9737d3266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608a4452-f3df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684237624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237624, "uuid": "8b4fc862-9810-4827-a902-eb2f3cabda41", "comment": "Malware payload (Mirai)", "value": "5d48542c85cb00041e5f25192ad2c82c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237624, "uuid": "ec97db24-4803-4d6a-bd5b-5c722a6f7f27", "comment": "Malware payload (Mirai)", "value": "6d3788349f3363d315949de7ee42f39cb6012def2c8816d12bf54bccf864f0e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237624, "uuid": "d93cb988-bce5-4993-be55-84f4fe91e1d6", "comment": "Malware payload (Mirai)", "value": "d30baa63898c289be3ff73b539e1de584b7fb1ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237624, "uuid": "ac0f1c82-b72f-4e48-ab32-190d2c0310f0", "comment": "Malware payload (Mirai)", "value": "738c45ef090b2a6a36ec88a43740880d5f47b798f391d9d15d33c334fb226be0538a3acae520dfd0b6367955f3521e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237624, "uuid": "720433e4-2161-42fc-a93b-7d12db53b961", "value": "T146334AC8F543D4F9EC4715B01136FB379A36F5E91229E743D3A8DA32AC52A01E906ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237624, "uuid": "4f346454-ef39-4425-ba1f-07e7a27bf97a", "value": "1536:XNBX9Z/DtwiLaiAl45GGVyBSNWb0PyBSLyg:XNBX9ZbtEVuGiaCccyQyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684237624, "uuid": "178de07e-02ea-4a89-90a6-8e40a08b6787", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684237624, "uuid": "acb8aecc-07f1-4e4d-b0cd-211eed0b869b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237624, "uuid": "b061aba8-3186-4788-b773-c008b8257715", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fadb67c-f413-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684259849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259849, "uuid": "b43846e0-927e-4f4f-876f-a3ef9c3a3cc9", "comment": "Malware payload (AgentTesla)", "value": "14be2b5dc881490daf3decda116502bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259849, "uuid": "58b276e0-cedd-4bd6-8bd4-5c3a156defe0", "comment": "Malware payload (AgentTesla)", "value": "6d87c74eb3dace534095ff7d7c69413382d5cce7ee977ffb77e5ed9d0b849bba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259849, "uuid": "8ced3721-ab11-47a2-9243-72b0cd5e0fc4", "comment": "Malware payload (AgentTesla)", "value": "3a8bba6ee1d88d5ca46e7bfc59d8cee96f8482fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259849, "uuid": "8725633b-e389-45bc-ae3a-87880e50103a", "comment": "Malware payload (AgentTesla)", "value": "80318090cb71a4fcaf700d3263aa64c5374e7d4fb6bb08b4c1345b5bd6f6c0b0ab1d74947b85939e9fcc7408420061e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259849, "uuid": "285172f2-c778-4b1b-b2d7-9b2087dc9c78", "value": "T13BB423639993F9A8CA03B3CAF97C50DA8B472145BA46E002C5D1E1F1B932F5C867587E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259849, "uuid": "39b5cf32-bc87-4d57-a883-008dc257cf50", "value": "6144:GcRdB+0Y2akmkgsMa5mdGeC9OgHGFTd35bSNlTrBrOPuQusgjWSWzA0MSnVkIiYv:KClnmdiOHSjr4OsSs95mB5UZKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684259849, "uuid": "137bb74d-aef7-4bd2-9018-800d01c4a595", "value": 520074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684259849, "uuid": "b4d5cbcf-7ec5-4a9e-80dc-890aa8f96ac3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259849, "uuid": "e63e3984-e638-488f-80ee-c236e165423c", "value": "watcher.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac464410-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Godfather)", "timestamp": 1684235174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235174, "uuid": "64a42bc9-5129-4284-bb6e-a29dd6dc9407", "comment": "Malware payload (Godfather)", "value": "dfb59aa18633530f29a7fb27cb156187", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "novirus", "colour": "#5D246B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235174, "uuid": "d658d292-8910-4470-8cc0-5f7d8efff5ea", "comment": "Malware payload (Godfather)", "value": "6e0d01c4c547d235c247a6d0719f2aca2d4996ae78df4b671275914a9e3fd2d3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "novirus", "colour": "#5D246B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235174, "uuid": "076144b3-9e51-4e1c-8ce9-08a03300c3a4", "comment": "Malware payload (Godfather)", "value": "ed6b9ce8013ca13678a77e1ce53100ddff392c92", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "novirus", "colour": "#5D246B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235174, "uuid": "c4e6d7eb-5a9a-4086-ac94-c33271f5d1d4", "comment": "Malware payload (Godfather)", "value": "4a1aaa11e7b16075253511d7845cbb6f37e1a18665e1cbafc085ab874a5d3891c3f681b7a7f571f5a5c1e3444fbc4e70", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GodFather", "colour": "#AA86FB", "exportable": true, "hide_tag": false }, { "name": "novirus", "colour": "#5D246B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235174, "uuid": "6eeb4e49-95ed-47a8-8122-8956f09e8ee3", "value": "T15626E046FB44AC7BC4F3833246355626553BCD298B43D6875A5C327C18B7ADC8B8ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235174, "uuid": "26979be9-0265-4557-8621-3f269054d077", "value": "98304:k4Y9fsk3NdWLn5JuhaSjYVMvbAukWlpbmdyEdGzfrX4oD:k6cNdWLn5AhBOMvbAtWllmdyQuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235174, "uuid": "9f842da6-8afa-491e-8f4d-fe6c1ccb1564", "value": 4577162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235174, "uuid": "8b835f68-55ee-4364-8271-f85859e82fbf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235174, "uuid": "4924cfe0-1b63-4dec-a6bd-6620a5415174", "value": "MarMuzik.mp3indir.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24e7ea7-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684235291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235291, "uuid": "7b3bf06f-204b-4763-9daf-4f605bbf5f50", "comment": "Malware payload (AgentTesla)", "value": "65b33732613d7cb843a670f9785758e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235291, "uuid": "9bea0ec2-26d1-477f-93d6-4c97514e465b", "comment": "Malware payload (AgentTesla)", "value": "6e3e359cc194330109d69cf1327bd806135195bed196e3fabd14f6ccf9d3e79d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235291, "uuid": "0cea618b-d592-4fd3-a233-87e26f18de65", "comment": "Malware payload (AgentTesla)", "value": "dd016c0b438e9978e490a4255f58166a2058b029", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235291, "uuid": "c8c0571c-b0bc-4bbd-aa36-e7704039e86f", "comment": "Malware payload (AgentTesla)", "value": "e30412f7a83294a9cfc289c30b8f5447379c8fdc0d90e4e19c13143f8ab486d5624c69fe8da1c269c835a657bf93af9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235291, "uuid": "7f18c311-d554-4090-840e-f2b800c77832", "value": "T17BD4E070619E4690E41FCBB165BCFC72427134F39DE8DAB50729A684CE27F606E89D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235291, "uuid": "3be7a4f7-636b-4ac2-968a-96e5ff39e36f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235291, "uuid": "6a491de9-0570-45a2-ba72-092580576f1e", "value": "12288:OyanEv5phjWGT6M/odn6JCZqOuNeRvvI5tA550QGjNnoRs0AeAimvkj:TuQFjpT6r96ixvI/Aj0/e60AYmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235291, "uuid": "62ce0153-21de-47fa-b0d7-b0272837cfc4", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235291, "uuid": "c200ad1d-0f4e-489e-8be4-08aec4efe89c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235291, "uuid": "99b92755-8c97-4827-81f7-81e29c523f8e", "value": "DHL EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eda33c-f42a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684269954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684269954, "uuid": "b695347e-ba2c-4f54-a9a8-22aee0ba1037", "comment": "Malware payload (Amadey)", "value": "fb32ce419c5bea931a9e3c4ad70dec00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684269954, "uuid": "7cc55285-7d6f-4a5e-8b0c-ed78893206ad", "comment": "Malware payload (Amadey)", "value": "6e77875e1ef76b39cfc68d919b4919da77d320bf208d826b643bd7ba48a5b38c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684269954, "uuid": "70cc7c5b-dd56-4cec-a830-f43d0d101f9f", "comment": "Malware payload (Amadey)", "value": "e1ca25f572063dba1d25e58929ddce168338998f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684269954, "uuid": "2950bb3e-e03e-4f9b-9b64-ca703395cb3c", "comment": "Malware payload (Amadey)", "value": "f6a7c34f3c4b0ee68c8397b550c0f8438b53bfbb8717cdeafb357051bdc096f6800fdd122aac5055d8b7f9ef6ae9b813", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684269954, "uuid": "79e363f0-9325-4459-8c88-baf4a5b3d8e0", "value": "T112936C1030D2C471D97E55351878EAB68B3CB914CFE08EEF27551A7A8E702D1AE36D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684269954, "uuid": "10ecf8cc-9697-43f2-8456-49fc875001f4", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684269954, "uuid": "7e8331fe-8baf-4e60-b419-493a1aca266b", "value": "1536:ao4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUe0aB89p:aoUCWbBNpplToUs1uNhj25LJULaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684269954, "uuid": "f12da1dc-322e-4d28-b24c-d972b815416d", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684269954, "uuid": "262bea34-1e9e-4fe5-9e88-9e6d85c432ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684269954, "uuid": "7df2289f-acd2-4e69-a5aa-33df051d153a", "value": "fb32ce419c5bea931a9e3c4ad70dec00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b20a383-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219066, "uuid": "d631423f-4d5e-4548-8b4e-41d40b4355de", "comment": "Malware payload (Mirai)", "value": "e27920745c841c5fde99c77e832e959c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219066, "uuid": "847d74d7-b474-4567-b386-eba9c7e905f6", "comment": "Malware payload (Mirai)", "value": "6e97579d97dcfce0ef1990902da225a60686305a70226811b077491009cabe33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219066, "uuid": "0cb382dc-679b-4f89-8d3e-dd75c4044893", "comment": "Malware payload (Mirai)", "value": "b2704d1cd112643c6eb3071f04122b54e6c63051", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219066, "uuid": "c6a5d021-278c-4a62-88a3-c1fb7fce2ed6", "comment": "Malware payload (Mirai)", "value": "4213cd53d9407dbe0db4e87a35cdacedcdf56f1e057725dbc936397b7da20e8f9ec7bf9fec073f3d5bf0a04183a84a4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219066, "uuid": "ead4d030-3b8a-4cee-aa1f-153b7ec54e7e", "value": "T14FC32805D5508727C2D3237AEB9E865D37325BA493DB33215A34BFB82BC278D1E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219066, "uuid": "390a41eb-c83b-4e5b-b288-4a1c934dea4f", "value": "3072:ekYPUfsgnsb0J2ag/VfxkDY9Ho+mTQOY5NX3cn:9YPUfsgEo2a0xkDoI+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219066, "uuid": "7080e365-dd97-4093-8d83-3914596e47b9", "value": 121004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219066, "uuid": "2c3af38a-dc32-4cd9-b58b-a182a54bf96d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219066, "uuid": "214002ed-512d-470d-9702-93a8e4665fce", "value": "e27920745c841c5fde99c77e832e959c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d67aa7-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684232804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232804, "uuid": "7285cf66-ce89-4043-8bbd-b84263144cb9", "comment": "Malware payload (STRRAT)", "value": "f8c4a9e4b862da35ef71561b554074d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232804, "uuid": "6efab3d8-e91d-4d20-b5c1-3fcd783552e6", "comment": "Malware payload (STRRAT)", "value": "7013cd71275ccdc3bbd9c21a043111507f17db8173d9723d332d1e11803feb5b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232804, "uuid": "8f210961-a526-427d-bcb1-1b75622b83a0", "comment": "Malware payload (STRRAT)", "value": "1ae85604c744b89b876454e8a315e5a366d56813", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232804, "uuid": "cf7d75c4-bbbf-49ab-94b7-3a9115e294e4", "comment": "Malware payload (STRRAT)", "value": "7f5c7f75e67a31608d16020fcf899c50743217e68825ec6769d4e9f4a5f91b9d47588c0bf793329b67ecf1d0c7ac005c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232804, "uuid": "efbebc08-353f-479d-8c9a-debb3dd28f29", "value": "T1A7747DD96586562A8A71520424EB1723CEEED747F1A45CAB13FF3BCF69226CE440F1C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232804, "uuid": "2c830ea5-50af-41d5-8fe5-315da1341ff2", "value": "6144:9xG6v+R0VRo9HC8PUYDvD9otmMmSopMauXpYb538jXCEzz+cgwt0+oaODwA6ycDq:Xvah9HtPqtBm53ijXCCMwWZiGqyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232804, "uuid": "990ac3f2-b119-4de7-a3f1-8b8e0475e56a", "value": 361784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232804, "uuid": "da2052ca-bcb0-454f-9184-8322da9a8fe7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232804, "uuid": "df7f78f7-6ff7-4cec-b4e6-6510666c2f60", "value": "PO.161015-AGS_510160523.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e903c367-f414-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684260616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684260616, "uuid": "4a7ee354-b76e-4cb9-b91d-121c0e667266", "comment": "Malware payload", "value": "4dfc45ac6adc94a9f366b38a8fabc807", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684260616, "uuid": "9a1964a4-063d-479b-82b8-c5da551c83f0", "comment": "Malware payload", "value": "71172d06ca49c591c79aa2c3b2dfeb705914a958b6d83b0d655c48e7e8e1cb2a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684260616, "uuid": "dddc8c6b-6be0-4d58-8119-5c2d64cdf64b", "comment": "Malware payload", "value": "1c609fea8d9f1f686aff3cbe9115a184634c3a6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684260616, "uuid": "638e61d7-4c57-4188-b3e1-a2afe013509c", "comment": "Malware payload", "value": "444db4289419f7afc3a6d294a71e4f9b6a13e9a9594268e3ee0b656dabcd3e15aa174e3fe3ad53ec96e9ac5d5058af2d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684260616, "uuid": "d57ac59d-f7ae-43d1-887c-bed4fa604943", "value": "T140D4D07060DE4690E01FCBF265B8FC72037170F3A9E5D9351B29A1C4CE6AF546E8899B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684260616, "uuid": "bbf196a0-31a9-4351-9996-1e2e71f6b9e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684260616, "uuid": "a3951c0c-cb63-4cd0-a79f-fcd40930cb13", "value": "12288:uYBvv5oPieo3tuC7/Zvfx86Pb1kjaUbo06oyjS:BHW3KNZv58wb12bo0im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684260616, "uuid": "0255ce9b-9439-4f59-abab-878d31a74965", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684260616, "uuid": "cea579c7-c89a-4de1-8cba-642d75ecd905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684260616, "uuid": "1d0b0f04-9fc9-4adf-a3f4-7490544a16bd", "value": "compress.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f958fee-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219073, "uuid": "81410931-8443-41b9-b98f-0eb7a89c3d48", "comment": "Malware payload (Mirai)", "value": "34c1dffa50cc3c0928259d4482c8d578", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219073, "uuid": "5ec1835c-1ddd-4e17-bc07-13fa94ecf306", "comment": "Malware payload (Mirai)", "value": "711e604928ba652d05aac0ecdfa609b10a0179d8e5fec35628f8add3ba2051a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219073, "uuid": "10c6b8fc-e88d-4391-8a91-55916f7a7d29", "comment": "Malware payload (Mirai)", "value": "4f86d0d26ec6a282a3fa9c8268dd69e92b94861c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219073, "uuid": "ba6a6c20-9075-47f2-a16d-58920b064386", "comment": "Malware payload (Mirai)", "value": "6acfd32bb5a8dac7666e4076cc410c13b0abd709924f57585bfb3e652532116ef1437452fdef48aab2739e4099680738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219073, "uuid": "0b1d47e6-efae-4963-a55c-11b2a79215b3", "value": "T1BF832B47E9A19FB7C0866AB565AB5E300B13E9912B4F1A4A313CA7F4434F4CD780EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219073, "uuid": "ecffa774-6887-4bf1-9bbb-3b382429e8c3", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC2S2pNmkxVqOEeofzee:g7OXmMSr4krG3J1/mkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219073, "uuid": "fa00f3f6-ad39-4d4e-839d-260e95084f23", "value": 88730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219073, "uuid": "e2d4c10e-bc26-48fd-abd9-6ed4a3043885", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219073, "uuid": "2682eb32-d6de-451a-9a84-c5dcc23c842e", "value": "34c1dffa50cc3c0928259d4482c8d578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433e3762-f3e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241869, "uuid": "f18ad83a-8dca-4b4b-9149-53248e3fb28e", "comment": "Malware payload (Mirai)", "value": "e3169f8232bf50bd27ed8e0425bf422e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241869, "uuid": "8fb9956c-3e12-4eba-bb02-9ea7a8e3b349", "comment": "Malware payload (Mirai)", "value": "7194dc8923c34e11b156328d8402d3d854b0272f658748b58acb08c81feb6404", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241869, "uuid": "879f0255-8b7b-4e2e-982c-ecf284ebbd4e", "comment": "Malware payload (Mirai)", "value": "5bb10062050e9f77623623a8a738c6b240148efa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241869, "uuid": "cc02856b-0c0f-45a0-9d70-9cf52ce551f3", "comment": "Malware payload (Mirai)", "value": "db2c2f517c3f1fd71e2d44b591c9805d10ec3543aa7610f32928867ed84dd50094cbfe0ada62ca707daf2b1a20dd699b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241869, "uuid": "e328b810-b372-448e-8cf0-008f0fef79f5", "value": "T160438D36E96E1E74C04641B074748EB56F23F4C893972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241869, "uuid": "3e3cd184-495f-445a-b995-068b1a821008", "value": "1536:9aa0brW/Od9hlCRDecvKQXACspfDCMx2+WU:9v0brWGd9XJcyQqpfDQ+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241869, "uuid": "51d142de-daca-49af-ac25-615d2157c389", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241869, "uuid": "2be6e39c-1bee-4ca3-9633-ca3f06f387c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241869, "uuid": "e3d9f468-7ecb-4531-8812-4bce66f2c608", "value": "e3169f8232bf50bd27ed8e0425bf422e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5126d328-f3dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684236309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236309, "uuid": "4fb46ccb-e236-4678-840b-8acbdb709cd3", "comment": "Malware payload", "value": "a5d892b2eef7f5e40ef996f64654211b", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236309, "uuid": "e2314ea8-28c3-4531-a616-3b7eaf2b3313", "comment": "Malware payload", "value": "71972c3ffccc868c32c8ae8b64c0770555f4e5841633344ecc8d70b317a734bc", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236309, "uuid": "e2b93a6a-93b5-4b1d-99d9-6f0793e1a97b", "comment": "Malware payload", "value": "69dc6f1bae7619b1d868119d72de36ac4feb32fe", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236309, "uuid": "c3acf70d-54a7-446b-ae60-89fb721ce707", "comment": "Malware payload", "value": "3d007b0529f6183a7255cd3c88192697bf29befdcaaa1ff2870734a310e9cac2ab0ab0dda8ff8b73ad4a552d86a152f9", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236309, "uuid": "86b90973-9252-4790-b2ec-6e679df8c2d3", "value": "T12545D070609E4791E01B8BB126B8FC32033170F39AD9D9752B7DA1C4CF6AF546E84A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236309, "uuid": "fc09b9b5-3c34-4379-8c3e-5608bc41ce2c", "value": "12288:mYjv5PMRJT8cjr9fN3AJfM0UJlkeEVcrgMqQb0jJmA1H:jpkQcjr9flAO0UJyJVp8olma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236309, "uuid": "d9f17587-0172-489c-ae35-4b067ce5790f", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236309, "uuid": "05ea34c0-f4ff-425a-b82a-fee4ca426477", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236309, "uuid": "741590e9-3560-4573-9044-ae5acafd2db3", "value": "nnew FOB order.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9178eff0-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243719, "uuid": "a403c045-1c6c-481f-a20a-26ace65d3f0c", "comment": "Malware payload (Quakbot)", "value": "06d051409feeb584f2705373cfa8f1a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243719, "uuid": "9f27ff70-7968-4253-a5fe-9bcfc20e8726", "comment": "Malware payload (Quakbot)", "value": "71c7000150a4ad024799f35488dd0da4624d93f8263ffd812f0cf81537eae571", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243719, "uuid": "b604b509-275f-4fd4-bc0a-02e257218aef", "comment": "Malware payload (Quakbot)", "value": "0c55474da4e1ef4202414ba26df72c2bf6ad67aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243719, "uuid": "26bc5dbc-cd13-4c3b-b5a2-bc2a89588e3d", "comment": "Malware payload (Quakbot)", "value": "3b84d134534239bc8a6f6412e928abf63e9bc8263d4554b3ad0a3969d40f5a49b8ca35afc74297a0be6d7aa631e817ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243719, "uuid": "79bd1a2e-ea10-47df-9a9b-1aee389797b2", "value": "T1C6440FC44F6528724B4B6E227A70D5A5EB7D0E6482C8588BF89F3171F1DEA8DC8D8731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243719, "uuid": "518b8a6b-80d5-4903-8572-97d5ceb27b84", "value": "3072:J8u+qtIyTmC/N64DSPo/lzfqoixP5mKQPhRX+spRnL:J8usyTF/N64DSIlzfGp5mKQ5RX+spRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243719, "uuid": "258675e5-aebb-4758-9e70-fc41023c6153", "value": 253411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243719, "uuid": "a01ccde2-3754-4e3f-b635-e14974f210a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243719, "uuid": "5701b3b5-d17f-4c09-9014-c3ebb6b2f039", "value": "Uddzaicu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd22d8b-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684233296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233296, "uuid": "184aa990-95a2-4f4c-8bea-4d7c46e4d5ee", "comment": "Malware payload (AgentTesla)", "value": "8875858b081b41cf54ca780eede82a2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233296, "uuid": "8b85d7af-9449-4d03-a3fb-01332f7609d6", "comment": "Malware payload (AgentTesla)", "value": "721cd7be724330f00dce933ea88b8a6abda0f2e83543a6c0f5bf0ce3754ccdbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233296, "uuid": "d31ba1ad-c8d2-4fdf-ba23-d5a994900159", "comment": "Malware payload (AgentTesla)", "value": "ac312605aeb0e36bb748acf32df5eb317437eb0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233296, "uuid": "d661d911-6fb3-4031-b6e5-585ba4febf52", "comment": "Malware payload (AgentTesla)", "value": "a8eb3af48aece5e21288f12db8792d8d45c1d0ec1c3ab728a1147fdbbc50928752c0d5ce0ab23377160b7503a28a80bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233296, "uuid": "77127c40-a1fb-48bb-9bfb-9d06db1ed2f8", "value": "T19AD4F169A1F95F63C37A87F645A826410B7475A36D27C53C1DDE30CAFA03F610A6CA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233296, "uuid": "0ca30b2c-e4f0-4bce-8a89-ea8e5bd7f4c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233296, "uuid": "39d060e2-769f-48a6-a72c-d57187611255", "value": "12288:h6ysSH9z7rsN7C1F6AQ51GbXF8390YbTMrOJc69aH5mtxw+UaMX1E8:t9zPGQcL1Gbu39Rvvt/MFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233296, "uuid": "596cab89-c6ff-44f7-82a2-a2bea1325e3a", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233296, "uuid": "9d13d5c8-0c0d-4edd-9a01-2739066471d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233296, "uuid": "82feb310-b043-4bf9-bee4-ddb75ba44608", "value": "TransportLabel#8000766_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a73ffe-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233607, "uuid": "aef462ba-e473-4dd5-98ea-90cd8975ee39", "comment": "Malware payload (Mirai)", "value": "84fbb862a00aa6979afbd4d30a7df2d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233607, "uuid": "0a102e8c-49d6-42f6-a146-0b4cb8e8ba11", "comment": "Malware payload (Mirai)", "value": "72ca6dc848a352f5f45bc46c153b15211c42ff78d6476eb6c48b54d6555a711e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233607, "uuid": "b52aafc8-b7bf-4f2b-a4c0-48a2fcb8e0d2", "comment": "Malware payload (Mirai)", "value": "d9e3b770bcf84d7f7f679af9f6218407c2395ced", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233607, "uuid": "e8ad14d4-9152-452b-9f0b-88c1a20698a6", "comment": "Malware payload (Mirai)", "value": "5ff1a29f9f3ce83783a59adc7fa1b4029b784eb5c0a3ac48b78def60e44812c63476207891efaff181f7476ff7d3394c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233607, "uuid": "2334030f-c223-4fd4-92fe-4e5ae2f14994", "value": "T19C53F985BDC59E06CAD4A276FB7E028D332653ACD1EA73439E126F24638B81F0E77541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233607, "uuid": "dd68d25d-1dd0-4559-94d8-335ed12cf607", "value": "1536:ChmQcQdNKjNkitff4NWbs5qXHe9sLah4vGMLSRgHmtx6bP9ZhZ5+BdF2QTwhhL:a35XekiV4NWbs5qXHe9sLah4vGMLSRgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233607, "uuid": "1bf89ed5-58b8-44fe-ac17-b191b4c3f51e", "value": 62588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233607, "uuid": "ed333fd5-a59c-4c7c-95c6-10a6ee15dcfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233607, "uuid": "f289f3b6-5821-485b-92b0-5d69511315d5", "value": "84fbb862a00aa6979afbd4d30a7df2d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e558367a-f400-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1684252020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252020, "uuid": "e631e832-880c-4033-b0f3-b563a11ac85c", "comment": "Malware payload (Stop)", "value": "669a891fe610e110917fad79b6876f55", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252020, "uuid": "00fa9ff7-555d-436b-b324-2f5f1d6b5282", "comment": "Malware payload (Stop)", "value": "733d197665d90ebcbe41ed14d872db66604706d8435e694985ad2c459ce59b70", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252020, "uuid": "d2e4e35c-ff9e-41c5-85df-8ae95703fc8c", "comment": "Malware payload (Stop)", "value": "a762faa446f6a8da5770ecca619fc2cffdf33ab1", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252020, "uuid": "985575f3-e101-436e-8094-04fb5ff30eed", "comment": "Malware payload (Stop)", "value": "3d6deadc02c4982bad4d260e41cefb5dd185924317ac5f4b7cce20126ebd2e14913b91984e2e640c0d8a9ab629d73163", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252020, "uuid": "8b9a1e82-5501-4b23-a435-61ea85b56cca", "value": "T1E4F4D013D2E13D54D967CB728E2E82E87E1EB5208F597B9E1118AAFB07730B2C572711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252020, "uuid": "a11a740a-6abf-4a8c-8a41-0b127a56ea2b", "value": "c3a2d6b32d97c9ca2070467dc08d5fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252020, "uuid": "3b93e2fa-1901-4f88-90ca-f604fcdf3fc9", "value": "12288:HYhoWg3wNMP0/JtiTYdmJDJtnee32UEMWOktn3dR/v2FvMI33knQCk/:HSdNMPoJEYKJweGdSKNR/vQvb30w/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684252020, "uuid": "9f7d10ce-6aa5-4c93-b50f-d03b87061f2c", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684252020, "uuid": "31f05b6a-fa00-4ea4-80b3-adb702014ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252020, "uuid": "39cee502-01ea-4926-bae8-ee0e6221d322", "value": "builder.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7079b652-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243663, "uuid": "b534d8d1-7897-4654-a871-c06fd11557c3", "comment": "Malware payload (Quakbot)", "value": "f846e46989de39162d0bb6c86fcb897e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243663, "uuid": "c9f33ba2-26be-4c4d-b48f-aafdc6fdf7b4", "comment": "Malware payload (Quakbot)", "value": "74cc568f340953c57a8e740ab157e6b0a2e05bf5c42a138cd27126fc57645580", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243663, "uuid": "aa28281c-d1aa-4aab-904d-e16fc47f300c", "comment": "Malware payload (Quakbot)", "value": "79b6f4d63feb6def30adf7082803d96dba995c1c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243663, "uuid": "dfac2420-cbc2-41a1-8ce5-4bf01bac3e2b", "comment": "Malware payload (Quakbot)", "value": "43a7c26e53276afdc6aa972d8ab1a91eae6fd30a1f32f93e9c6f210aedbd8eeffc8db8f0e12b9f0b0f771a50a252fbf0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243663, "uuid": "07c6cb1f-3aa0-4353-8165-c33876e71c07", "value": "T17E547694471528639B5B7D32AB24B5A9EBE51EB4C2D0838FF88B7361B2CFA0CDDD1111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243663, "uuid": "1b3838d4-1417-4b51-942a-9031e677bd2c", "value": "6144:ZaFYuadqYyKSMHos2Ede3C3u3M9e32l39wTMNQ2k8JMaPMQTd:jZqodeRA3k8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243663, "uuid": "7c188bb0-1eb9-4a8b-a5ba-e5c54a9883de", "value": 279609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243663, "uuid": "533598f4-07b4-4961-b364-c71ce31350fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243663, "uuid": "98d2bc3c-031a-4503-8eea-cdd015e0933c", "value": "Vuzovw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1a27bc-f42b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684270530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270530, "uuid": "4a9e57d3-cd11-44f0-a732-a8bdf05f169d", "comment": "Malware payload (Formbook)", "value": "844d534ed53e2ce289e54680908762f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270530, "uuid": "7833ce1a-6a07-4155-8601-33953b04ea9f", "comment": "Malware payload (Formbook)", "value": "74ed6e04325307fef674714dbd65803fe7a4d5d784522c7b65cf5f9953b2042c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270530, "uuid": "8d8eeb35-1ce2-4281-8a16-1acad5da14ea", "comment": "Malware payload (Formbook)", "value": "6c44532a512b208454e7f9c95c4e7bcd3acccd29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270530, "uuid": "3ef2f97c-5e87-4e42-8505-4eb2a1ae73e6", "comment": "Malware payload (Formbook)", "value": "9aa04817e64ae7da5b9567acc5730394f4dad91d29f5b379d0393ca4832866ee5aeb15443ee220c220c58beb0df3cfa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270530, "uuid": "694321a7-3a7e-460f-aaf1-98cb80ce5068", "value": "T132F4613D0AA58AEFC0BBD364A7CC4997FA739817F15C9BA944D6034272436CE60C61DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270530, "uuid": "8bb04c83-18a0-42d6-a1aa-eb0bfd80fc43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270530, "uuid": "39cee3bf-e980-427f-a658-af8702556602", "value": "12288:UfgZMSljShyNfDr40tw9TcXCN0nlE2pYUXcjSVub:IgZjIcDE0tw9T5IlE2eUXckub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270530, "uuid": "a6286407-3d27-47ca-9a18-805be5b6712d", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270530, "uuid": "2494b3fd-e46a-401d-bb7c-bdbb6fa324e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270530, "uuid": "01ae076b-89fd-4311-9e9a-7f26fc58324f", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34811a1d-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219081, "uuid": "42aeab06-c9ed-43a6-abba-dec26b117888", "comment": "Malware payload (Mirai)", "value": "cca3994723d7a76402633d557c852c7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219081, "uuid": "224b895d-eaa6-4a7a-9a2c-3be642c9ae82", "comment": "Malware payload (Mirai)", "value": "74fd57150a0969afa25f728112eb3bd1373fa0dcd28ca9ee07b3d2df192e00ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219081, "uuid": "48d446c5-d7af-4162-9680-9e5749f7e77a", "comment": "Malware payload (Mirai)", "value": "1eef49841b063f9716c75f05782d49a7eedfad89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219081, "uuid": "2e9b3b16-ad90-4e4c-95a8-f313d1925e9b", "comment": "Malware payload (Mirai)", "value": "62f97983dfce0c962ee367b0b59296ae4738423ec6ea697a60f14bc968d73a8f73f368e2a8dfce7dbb768979092acdd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219081, "uuid": "3ee4a11a-d0eb-434a-a566-c69a7a19b86b", "value": "T12B933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00376EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219081, "uuid": "0ffc9530-74be-46da-baeb-5fff5ffb08a9", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+82NYumXxVqDrstKfz9e:Q97vk51RcG7AIqumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219081, "uuid": "91e7074d-bd18-4dd7-9ac8-7c58dd811a6d", "value": 93904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219081, "uuid": "8e90b27a-dab1-4564-88ac-72222ef4c3ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219081, "uuid": "ba057812-ef78-4c16-99fc-28668761afa4", "value": "cca3994723d7a76402633d557c852c7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3b317b-f3d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684231231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231231, "uuid": "ba8e566f-92da-4ffc-82fc-e9aff698e7b8", "comment": "Malware payload (RedLineStealer)", "value": "84e30d076056fb6e08d745d8bc6789ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231231, "uuid": "badc7227-3907-418f-9233-dad1eb9ed790", "comment": "Malware payload (RedLineStealer)", "value": "7500557548ec11573337abf73e9ec7f1cce1651127228880b6a4d5ac38cc944d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231231, "uuid": "28d62b10-e153-4327-8709-4cee2b56784b", "comment": "Malware payload (RedLineStealer)", "value": "23331f7f945b3be7e8de6419b066e75d2f0c3f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231231, "uuid": "c9e0b4bc-a7a0-4b31-afeb-ef80549631e7", "comment": "Malware payload (RedLineStealer)", "value": "2f7c9a04e1b5879268d0990596e215ad588f4cc5e1931d9a34e7d0fb07dcc018507b7475782cc44ae552511229a03c2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231231, "uuid": "cb99f44e-2967-4ee1-a9d0-d7f77e14c2a2", "value": "T1CA452312FBCAE475DAF41BB009F647D31E313CA26C38A76B2682552D4CF2598793271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231231, "uuid": "4cf6bb2e-fde3-4fa1-8cde-d424ab571ff8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231231, "uuid": "a148e273-c464-4637-9d85-f6b07fad4b7a", "value": "24576:Cy6+vvrJR7dISGNbndsfKTZINAS3t/qGUx5sRdJYYfP72Z:p60vr77dSbd51S3tyGUxS/eST2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231231, "uuid": "a038cb43-0fac-434a-ac98-98a543ced267", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231231, "uuid": "10e3be36-6efe-4866-9a54-f7b020e202b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231231, "uuid": "645b8542-0519-42c0-b509-4dd4661a83ed", "value": "84e30d076056fb6e08d745d8bc6789ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c883e103-f3de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684237369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237369, "uuid": "3a2d1380-24e3-4614-ade4-bae0fe078ea9", "comment": "Malware payload (Amadey)", "value": "117bce2c7f9f110f1d89f208703eba7d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237369, "uuid": "78978ccf-ae26-4d10-847d-616e3b6f9c85", "comment": "Malware payload (Amadey)", "value": "7553285d86a73236790316a0e3451eaeb02d2c48928e416165d765b3b989413e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237369, "uuid": "09f92109-104e-4847-80ae-b25d78184344", "comment": "Malware payload (Amadey)", "value": "2731be2a56645aa34a92864e114bea3c45ea124b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237369, "uuid": "87d1e521-444a-4508-a8ec-a6ae9259d944", "comment": "Malware payload (Amadey)", "value": "70ff0c770d1f7d20dfc1aba56c7d97811b735cd1557f341344e420b8d4c799ea2567e8eb73edad9e485ec0039353d7d1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237369, "uuid": "617a203d-8f40-4a77-81dc-ca1ef9283ede", "value": "T1294523528BD99173D5B907B188F557830A36BE922C7483FB1F674D161C71BC0A8B8B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237369, "uuid": "16cf4ad3-ccca-4f62-98c0-0dcea848f83f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237369, "uuid": "e35c00be-43ef-4b93-ae43-12592259869a", "value": "24576:qymVk45xQ8xqTUce7Z4u4+/qKzpdIf0s34l:xKQ88Uce7ZH4e5cf0s3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684237369, "uuid": "50f72d74-627f-49db-b819-ed9657838550", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684237369, "uuid": "4ae745cf-ada7-462f-bdfb-e47e7a59a97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237369, "uuid": "b6cf494c-5b82-4bd2-be6d-174bc11ac070", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb681361-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232649, "uuid": "505d5e35-d813-4364-9728-ea91ebe378ed", "comment": "Malware payload (AgentTesla)", "value": "5ae72099c1398f68378aaf54dd06dc29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232649, "uuid": "4a97c3ff-aa5b-4ba4-a919-b238e45a3d42", "comment": "Malware payload (AgentTesla)", "value": "7560967ba08549d7a5048c6cc582b717f85392ff4bbbe39abec424416ba3755d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232649, "uuid": "5126ba57-5605-4d7e-96c8-96d8d9a29be9", "comment": "Malware payload (AgentTesla)", "value": "62c81d0c1bdaf0ffe4dce0214e909a98064404bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232649, "uuid": "2df3f49b-6bd3-4e7b-94dd-6b4ecccefea0", "comment": "Malware payload (AgentTesla)", "value": "851456955636fe74ea268df9cd6996af5c1516c5f8a30b8218953037126f05b0e9e42bb461a5398244458a965340123c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232649, "uuid": "e3bcae4c-3246-4ea2-8e44-6760ac9519e7", "value": "T1CCD4E074619E4A91E01FCBB165BCFCB5027131E3EEDAC9750725A280CE2AF646D88D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232649, "uuid": "f2f81177-a8b2-4002-8c85-28ffaf0b9e26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232649, "uuid": "4a46444b-502f-4403-ace9-d0779d329a44", "value": "12288:PnonOv5N6PThhh2d8cI/F3CsxtNtK5myF2yGfQ8QHQXQEm:f46fK77L/F37NtKkyFVGfQ/HUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232649, "uuid": "2c976802-67ac-432e-b89b-3185eb082488", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232649, "uuid": "c62434ec-b46f-4955-8cd6-463229f1e930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232649, "uuid": "695ed7d1-82bf-4496-8276-eb4dc9bf5419", "value": "Remittance Advice 71089426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4ba3af-f3c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BumbleBee)", "timestamp": 1684225565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225565, "uuid": "dcdaacf6-a6d0-4531-8bf7-4aa8511ceb42", "comment": "Malware payload (BumbleBee)", "value": "dd3ba73653522deb7b7bd760147b86ff", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225565, "uuid": "6be27b62-822f-4f1d-b9cc-17edf87eef13", "comment": "Malware payload (BumbleBee)", "value": "7876e8dc0a06ab3ffd61d0b040327ac960d33543beafa2761b69b7b6c7935cec", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225565, "uuid": "7b25e3f4-23e0-4d9e-8c73-59432b4c935f", "comment": "Malware payload (BumbleBee)", "value": "0166238f406ec79fb27eafc093d193fc85a0c32f", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225565, "uuid": "54f3b8a3-a538-4433-9918-a6d2a3e0a290", "comment": "Malware payload (BumbleBee)", "value": "eb59f5cc4c2f7f843b9616e84779eb38335f7698381d2a2757329553a7efca02c80946b3b65fd3ba9e9e5dfdc6996f67", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225565, "uuid": "dc14252b-8e95-408a-98f2-99ac06083a34", "value": "T192356B29AEAC81A5D437C17C89A7C582F7B278494F319BDB0791562E2F337E0563D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225565, "uuid": "1d22c167-83d1-44a9-8416-85b0ec166c42", "value": "00b1bc1f0a0db461b47660df1defd1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225565, "uuid": "bbaf3817-071a-47f0-8145-38f792777a12", "value": "24576:J3U9FU5g/dAFCeycmdopdEfrVDN6kBDLQ9:k/OpycmYUpDN6kBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225565, "uuid": "e4a8fb32-e37c-4b3b-ac24-419324fef0e2", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225565, "uuid": "bc5c8d91-e2f1-40b6-bb4c-6f52dc2461ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225565, "uuid": "ca047694-aefd-4727-bca1-9b4f8bb0317b", "value": "dd3ba736_7876e8dc0a06ab3ffd61d0b040327ac960d33543beafa2761b69b7b6c7935cec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc859eb-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Expiro)", "timestamp": 1684232166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232166, "uuid": "6652c289-dd9e-4762-be09-a677af43c977", "comment": "Malware payload (Expiro)", "value": "9f4025a30f1023db4768170c7084f49f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232166, "uuid": "b07f7f2f-5bb5-4270-a1b8-294f2d2b8fc6", "comment": "Malware payload (Expiro)", "value": "79105d7e93f40e7645cca097df1fe2ec3377f2ce05fb94faac893cfeafeb3e0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232166, "uuid": "b6903c0c-7edd-4591-b53c-9ff8e52edd1a", "comment": "Malware payload (Expiro)", "value": "8d47a7df7e3fc09c95ce670800a17232693db9f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232166, "uuid": "895f3f7f-7ffa-46a9-b31e-4959f568cf01", "comment": "Malware payload (Expiro)", "value": "a4f0a110f62792a8c5ba97c35b73ac9f2fa365f0ee977645a2183263ee95d013f0a1c4806e0550c7838ef6df00420afc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232166, "uuid": "890187b8-d5ce-474a-807f-2d4b1308aa7d", "value": "T11165127061AF4B81F01F8BB099B8FD3A037134E3AED9D9340621A1D4CE6BF546E4995B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232166, "uuid": "cc0ac231-6a5e-48dd-a34a-688e7a0c810f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232166, "uuid": "fd96af7f-af38-4903-80cd-a7f312092d37", "value": "24576:nQANjgNO12oGPMdZFbO5psInuIOBPaVXSd5mjw/FtWn1J:PAQD93OvsInuI8mSdgwgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232166, "uuid": "216694fa-5978-45c5-9780-c3657422a4e4", "value": 1477120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232166, "uuid": "7b6fb8e7-1bdd-4e0d-bef6-7317c94c7962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232166, "uuid": "9a3bd7c6-09c7-454a-9e42-389ff23e97e3", "value": "Urgent-Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044bf23f-f428-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684268822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268822, "uuid": "4e28c8b0-95f9-4fd6-aafb-e73afcf534a6", "comment": "Malware payload", "value": "ce34a0725360727c156cd7efc873ba1a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sheel", "colour": "#22E468", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268822, "uuid": "8c4b5889-2551-44bd-96c2-da315aa6e83e", "comment": "Malware payload", "value": "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sheel", "colour": "#22E468", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268822, "uuid": "3c06884b-5f59-431d-ab2b-e7217eb83e86", "comment": "Malware payload", "value": "7b4c932e1cfa4ae9bd63e282f15b6c5ca0ee6a84", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sheel", "colour": "#22E468", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268822, "uuid": "037a1f66-7817-4905-bd3e-3a585d3669b6", "comment": "Malware payload", "value": "03198a9fa17dc32f5fca775a44d2ba0991042fec9d68ea96e3c1b0e8aceaa580e185228c6520de8a3fbbd36a1b5497ea", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sheel", "colour": "#22E468", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268822, "uuid": "ba845f61-4ac2-495d-9fb7-f7ed95273e80", "value": "T1AAF1B34B7791EDEBEC8C83758BE3C3248375A1918E815343D70CF6A52E163092C7AB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268822, "uuid": "3b94aa2d-98f4-462d-9ddd-255e81a70613", "value": "96:ntsfhhNAVndNcjdvY7EsD1p6Q3epPxYGmHseuOuV2MxuR4BxOQGtwhb:afhhNyAWze9xSycQGtwhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684268822, "uuid": "5c2f0ad9-0330-481b-98b1-77ed68f4a808", "value": 8040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684268822, "uuid": "ea554503-4ac9-416b-a353-0b8d830225e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268822, "uuid": "c65d9fb9-028f-46d8-9388-bfd90f0c04c6", "value": "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ff477b-f3c8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684227961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684227961, "uuid": "fc7072ce-1447-4de4-80cf-41428a89deae", "comment": "Malware payload (Formbook)", "value": "fc56d2bc4fc963da5a949a38141bc549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684227961, "uuid": "beb87541-7c82-45f6-ba0f-f825fa44755a", "comment": "Malware payload (Formbook)", "value": "7af072164e5fc3c39c58fe100e422e079c2b98ab185065962569ac8b12c7517c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684227961, "uuid": "df42c8d0-ff70-4cca-804a-24aa47618d8b", "comment": "Malware payload (Formbook)", "value": "935336343125c22aa3227c26fb9014ae6576da61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684227961, "uuid": "00d69a33-6fc9-4c93-9d4b-b082cbe2cec9", "comment": "Malware payload (Formbook)", "value": "5878c4790f979107022a47f7e1893d635eda1e1622d418bee78d78265a0f0f57e6456bea3ea41f6a5ce6abad69e4a557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684227961, "uuid": "b0bcaf85-baf7-4614-8942-4b02009d4f69", "value": "T108E4E024B1FE487BC7AA43F202580A490775519B7D37C6F80D9E71CAEAD2B011B52FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684227961, "uuid": "ae9c2849-57d7-493a-acec-dec0bfa55f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684227961, "uuid": "93699bca-e6b2-4fcd-9b27-2d974e070273", "value": "12288:VysSrNXgXKcYQcIMQWytGtgZCItzqxVlHeU9MbnpHoc+:gNaK3TvsCgZCIwxbtMbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684227961, "uuid": "e386a982-d1d6-4d2b-b78d-2e99424c0c0c", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684227961, "uuid": "50e66e8e-2ece-4646-b041-cf0cdd72f0f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684227961, "uuid": "722c361b-dd32-4f1a-9cc6-a4bec0551a1e", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec62cfd-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243768, "uuid": "cd52365c-3e34-4b66-b837-392d25b567e2", "comment": "Malware payload (Quakbot)", "value": "f767abb0607c7060059c016b18d6e93d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243768, "uuid": "f87f8e6e-429a-42e5-8560-81c2221f5c37", "comment": "Malware payload (Quakbot)", "value": "7b36c2b8caa86f1d4dafec22b1cafcb9175f49425173e3f2158814475fd2db1f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243768, "uuid": "d4daf317-0589-4aa6-90cf-57ab0de756b3", "comment": "Malware payload (Quakbot)", "value": "88c0ed14379908ed18623fab71b28647538b23a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243768, "uuid": "5fc91473-1973-4ad5-b2b6-ff62af6d4564", "comment": "Malware payload (Quakbot)", "value": "17055e09210a520de0301662c6454f442477904db26cf3efc9bcc539f54c6bc718ba5214ce40b095a21f87a876ffd663", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243768, "uuid": "3bc46425-bd6e-4341-a86e-bbc8d06930bd", "value": "T11A34A69C475228234B5F6E32AA68D4BEEB791EA4E2D4448BF88F7150F6DFD4DC0D0612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243768, "uuid": "3c53bc63-c400-41fc-b87e-973a0f34fcd4", "value": "6144:UoVu36xOBs2LNhyZMwLbIi1tpJkY99MUdBH:uqxOBRv81lb9bdBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243768, "uuid": "659b8e4a-077a-47db-b26a-a1e6218a4aae", "value": 247167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243768, "uuid": "f02ffeca-a227-48c3-8c41-8dfa1e2c52fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243768, "uuid": "d38065c7-e5b1-4dad-9f1a-0e910ef4658b", "value": "Zvbtdnf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d09eea-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684232982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232982, "uuid": "af9bd6df-6d6f-452c-9a86-9843886f6139", "comment": "Malware payload (Mirai)", "value": "12bc45026e12b4e85e907e9be4ecd0d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232982, "uuid": "ba9b0379-b5f9-45fb-aa5b-f65505a44850", "comment": "Malware payload (Mirai)", "value": "7b5ca9aa58872eec903909439465a69f9cd4af8d098c19bfdaa3f41f81540e12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232982, "uuid": "0270fe80-b665-49bc-b060-0892202beb9e", "comment": "Malware payload (Mirai)", "value": "1528f840edee1019c2bbe1d65cc53fa36c877e4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232982, "uuid": "0114c354-f232-465e-8d44-213bf831ccac", "comment": "Malware payload (Mirai)", "value": "171f95ab290aee7f7fe12f83e70858aadd778757aba5995e25ed188df802be8b5d4888c968a8887d285df087cef87397", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232982, "uuid": "4eb8d4ec-6fe7-4ab8-a333-45360a48e65a", "value": "T1ED539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232982, "uuid": "2cd1aa11-c1c6-47a0-835a-c075d8070d36", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232982, "uuid": "7f0851aa-9930-4417-9d0a-c58955496d90", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232982, "uuid": "0ded48cd-c7f4-4a64-aade-9d2c1f4c6d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232982, "uuid": "ecad8109-84d6-4a6d-9a49-36cef380ff57", "value": "12bc45026e12b4e85e907e9be4ecd0d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269afb4d-f3c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684228078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228078, "uuid": "14211136-b961-4802-9697-09522688bce5", "comment": "Malware payload (AgentTesla)", "value": "e8c16dd88bb8a107d20fcef7e7e7ae43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228078, "uuid": "fa76a4ce-0636-40b1-8999-6f0994268817", "comment": "Malware payload (AgentTesla)", "value": "7c32af309a2521511d759a08cdc7cefc647e94cbdd590e7f7ef8ef24fa8b539a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228078, "uuid": "429c730f-b81d-4d0b-b36d-fe78a525370d", "comment": "Malware payload (AgentTesla)", "value": "1421a3ead0596c0fc83d3cc49ee7e604cb8d5da2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228078, "uuid": "8c4b52a1-77d2-43d5-a3b8-c03cbbf72f02", "comment": "Malware payload (AgentTesla)", "value": "a40391ca58950dcdfdaff400f3f8094af3d307cc99d8e06ee5e477bd77639bb916669a4c88fbcdb072e02ecae5586f5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228078, "uuid": "b85acb79-4d15-4d99-827e-cb9d12a47aae", "value": "T1EC05843D09A68AEAD07FC3E49BCC4957FABCD833B655D92F28C60746224164E61C21DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228078, "uuid": "7453c240-22e2-4ac1-bd28-94e296177790", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228078, "uuid": "b380682c-bd0d-4644-a96b-37b9bb377f64", "value": "12288:DQFHSljSlYsrj8MD8ALvOzlHHUv0B/Zd:D9wNrjLLUHHU8BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684228078, "uuid": "7a3ed8f2-2ab8-4e7d-b260-91d50f408283", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684228078, "uuid": "f9ca59f1-e2f6-48de-80f5-06fb83177b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228078, "uuid": "10ef055e-9a7c-4b7e-b3e5-c0629a054aca", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84f7a07-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233583, "uuid": "32026f8a-2ef7-422e-8524-b8912e3ba951", "comment": "Malware payload (Mirai)", "value": "79f5a51fe5f4cbe6ef943e64ed635fbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233583, "uuid": "f6fbc9f1-279f-411e-bdec-766e22c89f72", "comment": "Malware payload (Mirai)", "value": "7c5fb1fe0893ca00f2def061ebf8a2eeb7d1d46eab330855e165fa92dbc00afa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233583, "uuid": "4af5a207-c6fd-4b87-a456-10134e08dfd9", "comment": "Malware payload (Mirai)", "value": "e6e1c41caddf6fa3107b30ef6f8bd715f3530403", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233583, "uuid": "83a16611-d6e8-4d6e-a7c5-4a312b81db34", "comment": "Malware payload (Mirai)", "value": "0e63e7842c56d6003f51d99ab416265a64d6fe77422a677fd28b1b49cbb96711238946990beb316514d92cac8455a14c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233583, "uuid": "40a60334-12a6-4812-a811-07b22879f14b", "value": "T172C2E084F041CA45DFEA69F03D84CADBBBD06F1F6A668E8026A153925F5D3A34305ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233583, "uuid": "a3a6c993-aa34-41e5-abed-da674d28faa2", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7P3+4uVcqgw09T:mam+AnKehPRa9aW4u+qgw09T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233583, "uuid": "92f98ccd-cce8-4000-bd26-98fc9c5c6cb7", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233583, "uuid": "af4a6864-657b-4efb-9e38-0226dce37f3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233583, "uuid": "edf60a06-3844-4c3b-8d24-0b38886e6f9b", "value": "79f5a51fe5f4cbe6ef943e64ed635fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0c7220-f3dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1684236252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236252, "uuid": "cd165d61-e8e5-4dd1-9ac5-16abb9cd03a5", "comment": "Malware payload (ModiLoader)", "value": "1ba791c7a5b6862922b4748e6193ecd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236252, "uuid": "631753c2-b0e4-421a-84d4-e88c7e035a2f", "comment": "Malware payload (ModiLoader)", "value": "7c85f1aa39a1a12e2e1bf9d3b4b9f56e76304ce8efd332373f8404897b157a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236252, "uuid": "2df8490e-5754-4513-aeb4-3c3823f982bf", "comment": "Malware payload (ModiLoader)", "value": "dbeab14ef5a7d6d869f1df053e1efb9244e2e9b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236252, "uuid": "da984849-6b56-4742-b9a1-0e9abc63e326", "comment": "Malware payload (ModiLoader)", "value": "06e044c4534d871411f469408983a17bef6d68ca4f17bc34556cd83a075cd291c1f467d1886be6c40c60f9bc2f9cbca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236252, "uuid": "26e80d94-8d61-432b-9c99-b6ed0e3c7fc3", "value": "T1E8058D1AB2D1AA33C1A3AB385C17C744682C7F10183FF9673BD9B95CCA7AA463D05D52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236252, "uuid": "f7386ad9-85de-4f28-9b8f-ea27eff4de28", "value": "b994e2b35fac0eca9b95949a165480a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236252, "uuid": "2bbed48f-387d-49f8-b8cb-f6e5a8a42dc4", "value": "12288:IEaSIJxsS4ISFSs417nXbaGBazVb8N0K1WqN:/F0mcSFS77LaG6VIEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236252, "uuid": "f4383ffb-f334-40fd-90ed-5e368c4f86ea", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236252, "uuid": "3b441e6d-330a-4965-8549-f97d04eba231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236252, "uuid": "fee017bc-7111-40b6-a459-8470845da2b1", "value": "z1Xkptgkzbdmjptt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00232a2a-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233596, "uuid": "f525c11b-fea5-47e6-b044-43447bbcfaa0", "comment": "Malware payload (Mirai)", "value": "e671037c3f24fd0995cdd4fbf354d6a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233596, "uuid": "dc6ab5a5-6477-46a9-9738-826f389a3fc7", "comment": "Malware payload (Mirai)", "value": "7c9372bf051d395451857a3bf0dabd420851e40d39a26b5a929b664d82f87a3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233596, "uuid": "f4bcd0e2-79e6-43fb-aeae-7c7ad61acd76", "comment": "Malware payload (Mirai)", "value": "22f4c9c6cbad714f4dceb8e565758a1a90608043", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233596, "uuid": "1ad6fbf6-0ae3-4c0f-9331-d361a80e751c", "comment": "Malware payload (Mirai)", "value": "d1c7d488f44570b63a09660fec5ba632339817a85f17580d43a7424bdd78524b8e9164c47d380dc32dfe7e0d8cc0e56f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233596, "uuid": "32fc9a5a-39a1-443d-a2a3-14c6c2ef7e1f", "value": "T1BED2E18876D353F6CCCDCABEB75E003A30AA74A967B2A323B305D4534776140E691E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233596, "uuid": "1ed375c4-193a-4ee0-9fb2-a28a87a8ad59", "value": "384:MJd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BK661dHLTNE:+lxKd29WcxEns+V6IHE4RlY990961iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233596, "uuid": "92a31dbd-433a-45b0-99b7-8c7c891910f4", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233596, "uuid": "d02bf321-a199-46bf-b8be-e502664b43e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233596, "uuid": "57677984-309b-4554-a0b7-5a9edbf47704", "value": "e671037c3f24fd0995cdd4fbf354d6a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efc0b20-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234051, "uuid": "968ff29c-af23-4d8c-8c2c-ebb702be3000", "comment": "Malware payload (SnakeKeylogger)", "value": "e8f22750ad7f3dabaee9570825d23413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234051, "uuid": "f4114a17-573e-4ed2-bdb7-7189485f0768", "comment": "Malware payload (SnakeKeylogger)", "value": "7d18b2f91671da7fbbec682966318dfb7b3a7bfa114774991797b2ff78ace6c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234051, "uuid": "ce8e322e-3965-4489-bfcf-089d3e64957d", "comment": "Malware payload (SnakeKeylogger)", "value": "1067129df65bf4df554e0ab0daf26211fe7e5887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234051, "uuid": "fbf9247d-d085-4cb5-bf55-7431aaf323a9", "comment": "Malware payload (SnakeKeylogger)", "value": "166c735ec25a06b313d58583b625c7f56d8242ae922700a0bd6f6305a9aa7b1318afae14f0fdc212dfa5a4278a962212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234051, "uuid": "611fb09b-d84d-4012-8c35-f03d3e368fff", "value": "T156935C1A9B8C9737C75E0676A072432027F8DA857503E7878C84A4E66D677CF5E202BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234051, "uuid": "da294a62-2abe-4c77-bf5a-73d037c4446e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234051, "uuid": "aee43a61-f37b-4d3a-b538-ac56ff48c67e", "value": "1536:DYqFzCcNTBK0jQ5IdCPqlVkXoyReT5i+nInLTqxYhdKs:cwzNNK0jQWMtovT5imCLTquhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234051, "uuid": "88849a67-0a53-44bc-9f7a-052b4d60e222", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234051, "uuid": "87e77c43-1c19-4f82-81c5-2c3fa128555b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234051, "uuid": "2bd227ec-2b8e-48d9-88f4-188cb3212c04", "value": "Wyeddvomsja.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6a573b-f42c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684270557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270557, "uuid": "79a2564f-1677-454f-a350-ec24dcbe42a8", "comment": "Malware payload (AgentTesla)", "value": "1872ff588cbc1324603d6aeab85c5ca5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270557, "uuid": "181482eb-669e-418d-a25c-e9aeeefec8af", "comment": "Malware payload (AgentTesla)", "value": "7d19949247bbac4098f2d8566166deb54ca3150bc7fb088fed0992f3d16faccb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270557, "uuid": "5bc6ee62-9771-47b0-9b95-f5cc9a9d5bf8", "comment": "Malware payload (AgentTesla)", "value": "c413cf0956207afe642b25118bcc4bc34396527f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270557, "uuid": "9e6f2ca5-23ef-496d-8c09-26521a184554", "comment": "Malware payload (AgentTesla)", "value": "3935278a04fcd781943389679e196bc2f0c8a0da82107b72c13bdc383f449bdd7e83c39ddd284a28b1077dadff794673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270557, "uuid": "22ee3ee2-3849-4832-9651-134031e7f838", "value": "T148F4AE2061BD4B55E03F93F156A8FD2903B270E3A5FADB210EE5B4CA5A61F001E46F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270557, "uuid": "8cc28c6d-e512-4277-bb8a-0839f915c606", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270557, "uuid": "6521b574-d193-46e8-bb13-a7f03abe8504", "value": "12288:JBsFp4R4GVAJDJ5wy6RoDMGybZ2WCJcH5ntR+GV2s5v5/A:Tw4R4aAlLwJRS43jJosZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270557, "uuid": "e10c1caa-0127-4180-a399-d87d90dd2df0", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270557, "uuid": "3f9c62ab-3e18-4969-a885-7fef2c006f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270557, "uuid": "e1092560-11b3-4706-b282-c705d3db3c87", "value": "order# UC23075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb35c28-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684243684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243684, "uuid": "b1f00bc5-86f7-49dc-ac01-3a51797c6a49", "comment": "Malware payload", "value": "80d0f0c215d52d7cd2e2d095908435d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243684, "uuid": "89a19899-5e4c-4c01-8928-2ac67017ebf7", "comment": "Malware payload", "value": "7d2bc8929bcbe08410178c74b1d8285c45d4b6892e88ef4a7f71e64c664880cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243684, "uuid": "5788e511-d31a-46ed-9557-65adc7196bc3", "comment": "Malware payload", "value": "237622677f02fe99579a15967f6f2812d8773721", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243684, "uuid": "ff3188f6-6c49-44d3-8fd6-d8930acb28bd", "comment": "Malware payload", "value": "54b6d94fa2596791792ee148a4cbd73ba499197da6c234fc47f6799c897a419776391bd2b3e808cea69c7f4b2ee9ec95", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243684, "uuid": "313208ad-25f1-4fb6-babf-ae4821971832", "value": "T19E64638042956877978B7F66AA38C4A5DA7E0E7092CC568BF84E3154F6DEACCCCD4331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243684, "uuid": "74536d58-acdb-4e9c-a962-a2fa37a0a0b7", "value": "6144:PC19ccK7M1xQgiARGxzWCWX0U9uLO2ANk+TC:K1LCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243684, "uuid": "b401b30e-6b6f-4f10-8d6d-39be15533dbb", "value": 308953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243684, "uuid": "da6f5f40-d43f-4066-bf02-b15e93d9f065", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243684, "uuid": "d0f3a0f7-ac35-4b7c-b4e4-24d7d2f1cb22", "value": "Mvttsaz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0662c0d0-f3c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684225017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225017, "uuid": "7f8e8c9b-9ff3-4dc3-9215-3449a869311f", "comment": "Malware payload (AgentTesla)", "value": "7ff540eb44a0eadcd715858644a500c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225017, "uuid": "3667c1f2-3d77-4edb-bd4a-755aa0edecab", "comment": "Malware payload (AgentTesla)", "value": "7ddacf946c3de29255d826fbce407672c991285e15bf4a0e33f28561847b7d6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225017, "uuid": "5052f248-ea01-43c1-ac4c-4ff0ffa56764", "comment": "Malware payload (AgentTesla)", "value": "6db1a0796c1d9879299b2d261ca2c7de926a12b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225017, "uuid": "9aff4eec-d253-48f1-bef4-2703061011ac", "comment": "Malware payload (AgentTesla)", "value": "17dc0bce45c39f43a73d33238fd48b6a081c968811f7bcec0504bbff1965d2ff98d669fc24763e9b224ddd45d1c8d959", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225017, "uuid": "b86dd5ed-c23b-437b-817f-ca744c82d260", "value": "T15F642345D5C64DC8B35B6F84BB756D3E2DA89F981E43317E0C12786ACB037E025A74C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225017, "uuid": "372bb0b6-dde2-4f5e-8218-7426893e2fdf", "value": "6144:urxP0YmmfZmDH1lAbYL6oVrCeFseUEorIgYLB8zh2kOw3xFhO5eLevNsWrl1b4dy:uVPVZoGbOMBeBge8/hF1CvNdrl1b4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225017, "uuid": "153b25fc-0432-4e22-86ef-28433da06120", "value": 316066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225017, "uuid": "416fc934-45e7-423b-ab09-e5110ff557c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225017, "uuid": "3d6e0cd0-e62f-4e6a-be0d-75280830a63e", "value": "Swift_Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5afe34f-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684235297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235297, "uuid": "55c171a2-3dbb-47c1-ae21-23ff88454a15", "comment": "Malware payload (Loki)", "value": "9bbf39540a68f5cf6207535b896f84cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235297, "uuid": "5adc7bd2-ed62-4794-af54-2795e7ce5b8f", "comment": "Malware payload (Loki)", "value": "7de41879a47b6376ca77af402221e7d559437a2679e9322ed31453b2c476c683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235297, "uuid": "5f99595c-75fa-479d-a084-c1c5bb1c0464", "comment": "Malware payload (Loki)", "value": "7e162ff69d3b1844a13657d0ea6cbb1cffb25091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235297, "uuid": "19dc1045-899d-49d2-81ad-193e07f80dd0", "comment": "Malware payload (Loki)", "value": "7c86cf2ab7a357e9b5c35ed63462b682ae1a4bfe07714ce11c2c0ff23f903ad39114f16e9d92cdcc9659425b213a4dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235297, "uuid": "848650dc-f151-4357-873a-4867223f2ca9", "value": "T135B4C074209E4694E41F8BB169BCFC72437170F3EDD9CA760769A184CE27F606E8894B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235297, "uuid": "f36a24ec-d664-4029-96cb-a95b194b4824", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235297, "uuid": "c7213270-bf9e-4317-a94f-aee2a2c139e5", "value": "12288:yGKnlv5aqsFD3L9SFA/Wwu37pcw0oXAwSXItjrQZNomeAtDV:v+1AbjW1pTDARYtvKXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235297, "uuid": "47035709-d5d9-4b9d-924b-b1e62d4380a4", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235297, "uuid": "ff49d159-56c7-404a-9d03-8e156cf8b504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235297, "uuid": "a054543e-bb45-4927-8d34-77b8a83b12e4", "value": "FedEx Receipt_AWB# 3971757825428.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735a6f28-f3f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684244957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244957, "uuid": "7348cd16-9b48-45ff-86a6-ed4710ca210b", "comment": "Malware payload (Smoke Loader)", "value": "bc8dfcb4093f0bb356e3103af15f3d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244957, "uuid": "3a00476a-5e8f-4408-bada-7496a20a4432", "comment": "Malware payload (Smoke Loader)", "value": "7f016599bc5b598d9ba9f8e869a36e0c128bc6bbccffb391b05993b62ca71baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244957, "uuid": "4cb3acf4-ed9f-4c03-a60d-80bac3807509", "comment": "Malware payload (Smoke Loader)", "value": "25ec668fbf84db1b01fa623382da77fd53138833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244957, "uuid": "613d4c0d-663d-419b-83e3-6a120b78f670", "comment": "Malware payload (Smoke Loader)", "value": "4c9566e36c978ae89d54fc6d773e64e16e2c8ececc0219329231d017c614a191ebb1373dbbfa4efe3d01ff6601220e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244957, "uuid": "4fd6730c-90cb-466b-9c2b-55e301a8faed", "value": "T18525281972A1B146F16D4E700A341AF8AA95FE316634C81F62B6B70DE671EC1F430BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244957, "uuid": "1aa7463d-b4dd-4515-894b-198aaef27890", "value": "622a88682c24693792ff46e3135c6d5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244957, "uuid": "3b4f6066-9d3c-4fac-8d18-2775c1aec5b6", "value": "12288:yoHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD:yo0odC3lMHiEptXW+xVW8MeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684244957, "uuid": "ea3090f9-486a-4d09-a6fb-a894903666b9", "value": 1014136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684244957, "uuid": "421972bf-ecb5-4a5c-a869-35e323c782e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244957, "uuid": "5f697742-6ad5-42c0-be1f-f770b780b222", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed59267-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684235339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235339, "uuid": "6b7cf187-a9e4-4c5c-917e-70785cda5cc8", "comment": "Malware payload (STRRAT)", "value": "df6893c1e536710bdbd27746022d5125", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235339, "uuid": "c359e309-7cec-49a3-8618-8c360048b2e4", "comment": "Malware payload (STRRAT)", "value": "7f07f0677e02f719c024aee65748069e39ede3062911330f8395d757e59a1dcf", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235339, "uuid": "cdbf1912-763b-440c-83d5-41ab307c7c18", "comment": "Malware payload (STRRAT)", "value": "1c6c36f4deeab38500e15b0680037c62cc88576b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235339, "uuid": "b224d833-66db-4c77-9bed-24ee939e8b2e", "comment": "Malware payload (STRRAT)", "value": "8be4b793877e5125c0148f5b1e2ca4595d57e16b8dbde01d72703ead714effcb8ab4088bb57d4a84dd6cf3df67cb4c21", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235339, "uuid": "8066c54b-18d5-4fc2-bd3b-579c55c8a460", "value": "T1F524F10EBEABEAE7C10BC532005DC327B50946B9F485A16F14F8536A4D34E7A4A92C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235339, "uuid": "f05c4fe7-9d7b-4524-9c05-910dcbbfde51", "value": "6144:0H2fQEPiNabCkzRvhBxSr+ibseEXA+EFRu:uBEPiNYCkzRvhBF+svA5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235339, "uuid": "70f09bd6-0de2-4a0f-bb8f-3c7f86ed184c", "value": 223875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235339, "uuid": "2460dcdc-00f3-44b1-bbfc-f4a047b27668", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235339, "uuid": "6b7bc4bf-0403-4efb-a41f-06e48cf301bd", "value": "I35321_Qoute.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47faf4f3-f401-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1684252185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252185, "uuid": "dbc0b5ba-1be5-4524-b7ff-614d62cc72d0", "comment": "Malware payload (Adware.Neoreklami)", "value": "b12b179341e1602735bb761f6aea1bd7", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252185, "uuid": "f3f39a59-6ba5-48f0-bec2-438c75d348be", "comment": "Malware payload (Adware.Neoreklami)", "value": "808c965f9bd935da2dd1f39babb4b6af655c621191a1a42a0a1eae47bba0eea0", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252185, "uuid": "0414ecbe-77ed-4813-b439-a9b0bd14fb08", "comment": "Malware payload (Adware.Neoreklami)", "value": "2a826f81c3201a79e74f8851cf71b6149d91ccc0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252185, "uuid": "d6d14c3c-9274-40cf-b2b4-83c4d2c6e648", "comment": "Malware payload (Adware.Neoreklami)", "value": "537443297c5161522b81ee3c5d554aa9d77a1b72b38f33de44de10671b3bb051c9e2e516e9d9d16e59fab8443cd0fc46", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252185, "uuid": "07e6dccb-c926-4710-b671-e44632ffb4c1", "value": "T1027633957ED46EB0DD6A2D329E10718239BCF41D8EA18B43BBE0491E2F365349F61D38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252185, "uuid": "8fea1cf7-5eab-48a9-9326-99d244060884", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252185, "uuid": "e8fcccff-9087-4098-bf34-af750a8979e9", "value": "196608:P1OyZeFYUuaMmcslwSvIci+/WGMk2PF0q7R/LUwqrA9:tOhaUxMmc8wbYWyq7R4wqrA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684252185, "uuid": "7b81ddc0-98ab-4030-b971-8e23b79619eb", "value": 7573627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684252185, "uuid": "7d8208bf-d455-43b0-9a2e-1a9ac7eac8ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252185, "uuid": "9d4d0a0c-f7ef-447d-a759-e23ea83d2c06", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333d12b6-f3e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SparkRAT)", "timestamp": 1684241413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241413, "uuid": "b116efa1-070e-4355-8b10-359238323a80", "comment": "Malware payload (SparkRAT)", "value": "513eecac1e602be2a404f1d70719dffb", "object_relation": "md5", "Tag": [ { "name": "atom", "colour": "#C988F3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241413, "uuid": "7995b020-78f1-4f36-8584-a8ea1f7ed601", "comment": "Malware payload (SparkRAT)", "value": "80ef5b531e2e8cb19403a8f06cfa1d6743900957ebf24d84f63211ae04d6bc1f", "object_relation": "sha256", "Tag": [ { "name": "atom", "colour": "#C988F3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241413, "uuid": "1b4174a3-d616-4c51-8d0a-9000de0084c4", "comment": "Malware payload (SparkRAT)", "value": "7b552da9131831538987c312c0fc3d85d26a2e47", "object_relation": "sha1", "Tag": [ { "name": "atom", "colour": "#C988F3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241413, "uuid": "0dbc239c-5b78-4578-8760-9deb0d9af752", "comment": "Malware payload (SparkRAT)", "value": "d5152d02f172b08f9ce8f35dc39d717aade00c08299075ed25ecc22948cfef628f6cdb069a1d6693164ab5bd54e7bf27", "object_relation": "sha3-384", "Tag": [ { "name": "atom", "colour": "#C988F3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241413, "uuid": "aecb7b78-8bca-417e-81d4-f0b64198168f", "value": "T1838633793190FE17C0E233F421B86243EB13E7890F991F455AF21DDA133AA9A6D254E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241413, "uuid": "4d6b4d11-707e-43a7-8e07-ab774f7408bb", "value": "d9e5262dbdb011627a845c0251a44802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241413, "uuid": "778eebaa-2366-45db-9afe-a4de2f05254a", "value": "196608:gqtd+hY7xGKq9SsHd9rm2niE6RK/Io+IDZT0Lx:Lt7Q97HX/n76RK/394", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241413, "uuid": "79801fe9-0544-4c95-a829-0b52b2429a55", "value": 8479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241413, "uuid": "b88b871d-20cb-4dc9-9c31-bfb2cac75843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241413, "uuid": "b1820030-e5b0-41a8-9732-15bf7a4801ea", "value": "AtomLdr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92de26b0-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684235131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235131, "uuid": "f02647e8-3373-468e-b748-fe2f32ce0910", "comment": "Malware payload (Amadey)", "value": "b10128566d23a05377f25d0619c6006c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235131, "uuid": "f962195b-c7c0-415c-872f-26faf1665a38", "comment": "Malware payload (Amadey)", "value": "8105d2cb2a7650ed97f77e07db3d032a9d2d24402659c8886303d17d458ca789", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235131, "uuid": "99850753-0a59-4c1c-ad8c-7022941150cf", "comment": "Malware payload (Amadey)", "value": "906a5cb47d8c2b2fe1347ca520530ebed5edf9c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235131, "uuid": "8fdc2912-7365-4ad8-a359-9687fa60ce6d", "comment": "Malware payload (Amadey)", "value": "bd624d1806a90fd5eaee3b4dff6ca1909be9ca500b45ae95a869d29f57d8c126f80e7faba53a391d9b095e935abae20d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235131, "uuid": "a4526edc-785d-4715-b93d-de8248401205", "value": "T108452313FFD84030EAB317B598F206931A32BD764D38961B6395DCA645B3AB1763234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235131, "uuid": "2d284feb-ef7f-4216-9a38-9adb29ae4faa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235131, "uuid": "f1ddfa61-cf6d-4fb8-9f25-d1c7b55b803b", "value": "24576:lyVciLHMo/z/xUZdIv/SnYjvTMKW6A+z7+KxQqCmea2doZd:A/LX7ZUZdehd++3NQq3g8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235131, "uuid": "ae67b398-2e3f-4d05-bad7-d270f7e5d5ef", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235131, "uuid": "d153ce17-aabc-4f9c-ba28-336d27638e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235131, "uuid": "8fb79643-a5be-48a0-89e7-f8f7d4b8fe7e", "value": "b10128566d23a05377f25d0619c6006c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fdd07f-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684233529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233529, "uuid": "b006679d-7f8b-47ba-8534-2c5d2a20c6e3", "comment": "Malware payload (AgentTesla)", "value": "d1925f28c84577816e7d8b05a8cdf310", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233529, "uuid": "26d88817-754b-434d-9390-5ae5bfbeedcd", "comment": "Malware payload (AgentTesla)", "value": "82f5deb6c4fcc0e1024ce95e8723df267ebedbdccd94ec1e296e037fd59976f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233529, "uuid": "212f5c35-9ae0-4240-869f-eebe94a664dd", "comment": "Malware payload (AgentTesla)", "value": "731081545ac19b179686dbe1496e6b08b275250a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233529, "uuid": "3a81f466-dc4d-4339-a553-f52ed4b91243", "comment": "Malware payload (AgentTesla)", "value": "1f89afd8c0f3b38f21ac6999ee4252799fa9ac92f50b920093be5e78cb5c11a8ccb700f4e7bf66390132ddc3cb25896f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233529, "uuid": "4f5e5bb1-998f-44d7-a5fb-60d4375b5373", "value": "T156D4F069A1FA0B63D37D83F545A825020B7472A37C2BD53C5EDE20C9FA57F501A98AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233529, "uuid": "9390aa57-f3c0-481f-b753-c867e89e8475", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233529, "uuid": "ccbbf4ac-3aef-42e0-836e-1c40ddefb93c", "value": "12288:qlysS3UG2yc6FhsBEjHqNxsnWE9RqrRyVpCtQX+M2LgHoP:rUGonBEjMsnWE9RS2CGX+MagHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233529, "uuid": "a840524d-b56b-49ab-a8d4-a5c8de43d737", "value": 601088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233529, "uuid": "13633961-218a-43ef-a134-2c58c5b601d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233529, "uuid": "ed38fcc4-e1d2-421b-99ea-8aa50101cea4", "value": "BEFEHL#771490168489.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865c7e3b-f410-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684258732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258732, "uuid": "ca18061e-ef7f-4dcf-815d-e3d8396ef297", "comment": "Malware payload (Formbook)", "value": "1494ab51e18f84cd6e41c89b84f5d585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258732, "uuid": "165f0b68-590f-4d76-bb56-15c03df01c4e", "comment": "Malware payload (Formbook)", "value": "83655561bbc25a8d8d3e737bed283be32e228982310731a9640000797cd520b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258732, "uuid": "d7067664-c8e3-4678-805b-1fec3c35fd22", "comment": "Malware payload (Formbook)", "value": "bddab9deba1f1b2c40bbf1889795a5585325bea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258732, "uuid": "b4f8118f-008a-445e-a560-6d8b584eb89c", "comment": "Malware payload (Formbook)", "value": "2996067f2ee0f0d166e002dca868eacdf1d7e76a6c7a6db1cfc28afe8a77a4f8e98cf6307818950f2e2869f9131246ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258732, "uuid": "bd056a4b-6cf7-480c-bb91-8545d23a5c10", "value": "T17605723D0AA58AEEC0BBD364A7CC4997FA739817F15C9B6D54C6034272436CEA0C25DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258732, "uuid": "b7de9163-6616-4e82-a6e1-21460cefe8ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258732, "uuid": "b02b5765-84f3-4e52-8420-7639b4c01c2c", "value": "12288:ivaZiSljSRU3jkbOOT+LwNjdvaqKn/1edBcYfZHVceUu+eHHKS7:SaZBo6OKLwNhvBKn9IBDf5Wvif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684258732, "uuid": "5aac6532-be6b-4711-a4de-ded2c9802c6d", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684258732, "uuid": "9b957c74-5f6c-4eba-b8b8-e17f7a9e77cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258732, "uuid": "9f9f1ae3-f89e-475f-b22f-578f9758f41f", "value": "SecuriteInfo.com.Trojan.Olock.1.26419.25236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18690340-f3de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684237073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237073, "uuid": "b23e96f7-8509-4fdd-8610-40fde7c59b92", "comment": "Malware payload (RedLineStealer)", "value": "c611b4af1a4c2f5a9870bc7ef635c1af", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237073, "uuid": "c434c7e0-b06f-4194-b5aa-3e01059e4386", "comment": "Malware payload (RedLineStealer)", "value": "83b3e742e5066c1bc02670f0e19db826c4d40c165e8d73f9ceb4bbcc36919d40", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237073, "uuid": "4a16f0f7-305b-42bc-a100-f9229e99aece", "comment": "Malware payload (RedLineStealer)", "value": "a7154b0fd2183aeddc80f2520372195e30a2a420", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237073, "uuid": "b9706360-b8ff-4821-a6a8-4b7a3172196b", "comment": "Malware payload (RedLineStealer)", "value": "7655eefe2e2122e01de6d2c5d565c5d92e958b0d9e298b9b63fe008d80cc43233de65ebae65a478b202c03e28393df9d", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237073, "uuid": "f8874fab-6554-4127-87c3-e67e42df4a62", "value": "T1E94523A37BC91422CDF927B06CF203931E36BDE289749B7F2290B46D5D3268464717A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237073, "uuid": "3054d160-99a7-45f1-86ff-1df723b0d35b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237073, "uuid": "74755c0b-b373-4776-b185-a61261ae0711", "value": "24576:6yC0HtNSi6K8LP1APcpSp19u/2/ZjF6B9f8nKNGGPbPJOWZuDAP6hu:BCytH6K18SfwOnoEKRPjoi6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684237073, "uuid": "59fb8302-f186-43ae-bb06-894449b2a346", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684237073, "uuid": "4082756e-dbaa-464a-b3d0-df8bc1b2e19a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237073, "uuid": "c816a66a-68b6-4815-a6c2-18c93d176691", "value": "cumloader-4noname.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce42008d-f43e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1684278610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684278610, "uuid": "ff25414c-85a1-4c61-b34f-a1bef00128b0", "comment": "Malware payload (njrat)", "value": "c460cc5e08dc4af7091bde8d32458646", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684278610, "uuid": "f615f56f-2021-4eea-b3c6-1ed82e46100a", "comment": "Malware payload (njrat)", "value": "8525d0bc1e38bb74d592de9be2615da94ec0b81e611b0e456b3a51c40ab5baa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684278610, "uuid": "55816476-df8d-4fe6-92de-59b159d719a1", "comment": "Malware payload (njrat)", "value": "f9c591e5e8b8806b682302e1231ba1f95c712b92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684278610, "uuid": "08e2d17c-b531-4f08-880e-898126aa8dee", "comment": "Malware payload (njrat)", "value": "74bc4f0d6dbfb11f87b639c4ccd095fba9708edebb81eae8ed8357a631787a43c6988bc315137af9ffc6092aa7e4fc9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684278610, "uuid": "2d5d44cd-eb1f-423b-bb39-1805486bae78", "value": "T15674CF03BAC085B2D42214335B259F61A57DBC301F668DDBE3986D5EEE321D0A7327A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684278610, "uuid": "fd6aabf1-e3bb-4bcb-b36b-633a48fdabd8", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684278610, "uuid": "453c2ab3-8505-4973-b832-89f1e535b0f0", "value": "6144:ygZiAEAO0sByNsAal3gVAWgS7/OhwjMT+tkwsN/4:ygZXEAO/BUdG3gVdt7K9T+tkwq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684278610, "uuid": "59355bc0-4d17-47fc-88fa-cd48bcfa4f2d", "value": 345022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684278610, "uuid": "7b57446e-46d9-42b5-8a1b-2e1b45c93db5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684278610, "uuid": "2a6aaa71-515c-433e-a70c-181c03eb15fa", "value": "c460cc5e08dc4af7091bde8d32458646.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e1db00-f3e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684241423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241423, "uuid": "4dfe3322-5166-41db-9c99-e2a22a04f5a9", "comment": "Malware payload (Quakbot)", "value": "c66e5f56f615da77313480971e9589b3", "object_relation": "md5", "Tag": [ { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241423, "uuid": "ccf35de9-b246-4ea4-ad67-a4340c22fac2", "comment": "Malware payload (Quakbot)", "value": "86546437243c56a4dc7772b67663c8140134554174846ced0dc52f452e0e9551", "object_relation": "sha256", "Tag": [ { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241423, "uuid": "0482cf82-0560-48dc-8a6e-af66a6d16ebd", "comment": "Malware payload (Quakbot)", "value": "e9db239d005120bfd9f67a683cb6702ef58a9b6d", "object_relation": "sha1", "Tag": [ { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241423, "uuid": "ddd4cfcc-398e-4d2b-b0e3-da139e54f012", "comment": "Malware payload (Quakbot)", "value": "c890980b3a1fd22caba05b3d3cc12f5a2d2d91f86b40f083f74a9af253ad1ef4b3887d5fc10e35be4575fd2383a33346", "object_relation": "sha3-384", "Tag": [ { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241423, "uuid": "dea96f65-6e11-42d6-86b0-c1d8f0d24dbb", "value": "T19E449990479528774B8B2F36AA7885A2DE7E0EB8D6D8188BF85F7244F1DF58DC4D0321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241423, "uuid": "76c69973-92c6-4c65-8a6f-8815401ef9ec", "value": "6144:oaLwIF+6XN/YWu6NPiJSAGJhFOtrzVfPB:ozmvwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241423, "uuid": "ef6402a2-4950-40d9-a623-279a20be568c", "value": 257527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241423, "uuid": "04dd0156-c722-4a61-ad76-7ea9936ce35c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241423, "uuid": "11a7060f-60cd-4999-b5a5-f1ff1acf4b05", "value": "Yotl.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0555e2a1-f3c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684225015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225015, "uuid": "fd2aca72-d38b-40c4-9cd8-84ab7ef44004", "comment": "Malware payload (AgentTesla)", "value": "a3cda996e2b93785deeac0dae2f6cbe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225015, "uuid": "58d809dc-db76-4068-aa1e-dbc694d6a694", "comment": "Malware payload (AgentTesla)", "value": "86db57c0bc187639ab985ffa4dd383a2704273aada862ff21b62de85c6f88748", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225015, "uuid": "fe949de2-8ed4-4af5-a0e8-9a8072a0c686", "comment": "Malware payload (AgentTesla)", "value": "218d5c95f0ac830408a7a9c3c5bc5328768ba05c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225015, "uuid": "649bff15-cf77-4dce-a5d5-3b1d4cfc093d", "comment": "Malware payload (AgentTesla)", "value": "411e2125f54c5961fac9830418c80019f20c49c632f77eba156c6bb1d04284b942df35f8a4b8bd7c26fbcd8ea92d3415", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225015, "uuid": "daad8ac2-9f36-4ddb-b584-351241727489", "value": "T10294BF2063F84B48F1FF2FBAA470455007B5BA97ED39E65D4DA124CE0DB1B429A90B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225015, "uuid": "d68fad11-baa5-4e54-ac97-d4f3926c84d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225015, "uuid": "60810a58-7f81-487c-a770-bddc3fa198a9", "value": "6144:FCvZQF2uFxbIBMPryJc3Nz7jCbT3Cdeh2kPYjj1XzVB8PQqZ:FCuFfbNyq3NzXCvCdMCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225015, "uuid": "c367e22c-a3d7-4866-b990-4ac341657c07", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225015, "uuid": "a7ec4d21-3c54-4f72-9436-00cd56a40617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225015, "uuid": "7253a6b0-9cac-45ec-b362-d6e11b458ab8", "value": "Swift_Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2033a917-f3c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684228067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228067, "uuid": "13b9e3f6-e1bc-46d4-8009-a9f4028e9037", "comment": "Malware payload (AgentTesla)", "value": "ac5ad5b36f6892d0a8376bd558a4bd79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228067, "uuid": "13fe3730-20a9-498a-b120-a0d5af0977ca", "comment": "Malware payload (AgentTesla)", "value": "88de825967f8bba5cfd3f7aae4c655a8e85e3c8a921a57d5dbb7eaa358c12dac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228067, "uuid": "9c883d74-e0da-4bea-b673-661843d82223", "comment": "Malware payload (AgentTesla)", "value": "e26e2e9b45e972dd3828a65b3cd389c4108bbef5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228067, "uuid": "224f44a1-27bf-427e-8198-6377c0ab84a3", "comment": "Malware payload (AgentTesla)", "value": "121d51471dafd27126bed2a87bf092c75de7da47190a8e4c4a1c9e4788074e8bbb1a9961f521d89178c17691254e1af1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228067, "uuid": "79e98b2b-747d-477c-aaf7-cf9787ed79dd", "value": "T193A423C58C3AC183162F9B1BAAB0A6F4CA516DE20055723E37BF796A1FC630193D8D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228067, "uuid": "dfa1bb40-32f7-430e-9931-1d8d0e125c58", "value": "12288:PlyZwKvZwJ3FSvjSbysp78Md8ALfOH7JHUJ03fdKpx:0ZZwow7p75LgJHUe3qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684228067, "uuid": "999895e8-f40b-4695-b8bd-adaaca557caa", "value": 463594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684228067, "uuid": "1e5764da-64e6-4fa5-a3ec-04cec88422b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228067, "uuid": "7f8d140f-a75b-46bf-930b-36ea4d7cf490", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6799066-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684238680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238680, "uuid": "e1a3ec6f-8203-4f00-beaa-c8d298782fd3", "comment": "Malware payload (RedLineStealer)", "value": "cd3f8a77e0abde30b71197536f513639", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238680, "uuid": "1224ff65-ccb9-45d3-9236-270f84da79b4", "comment": "Malware payload (RedLineStealer)", "value": "88eee430f0ca44619f24c7c8b5ade102a25287a9493a02155aff9274ed09b53d", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238680, "uuid": "caa97031-0180-4405-a0a2-b73571572eda", "comment": "Malware payload (RedLineStealer)", "value": "a1634a84df296ea966332d6206102fcda6008c01", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238680, "uuid": "acb58fce-6fd2-4260-98fd-9d503ad7b594", "comment": "Malware payload (RedLineStealer)", "value": "190acbfb5c0360078b13e89692a33dc42af12531bb85980bbf7224a347f880fd0479e21d174fb13074fac8ada628a979", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238680, "uuid": "61930ec8-dbb9-4436-a97b-55f83bf45cc3", "value": "T1D4452353F7EC9567E4F85BB51AF603434932BC921868864A1B86E85F09B32D0E43379F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238680, "uuid": "503f10eb-fd6c-4624-8e9f-9a5d38682cf8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238680, "uuid": "200301fb-87a3-4c0c-9b6f-480b1240fe44", "value": "24576:1yJ46Hzbk4tl7FCxIuG5Sw1XyJ1LE2TC1Ahxb1h5aEJ6+xb2:QKAzttNQIhRXsLE2W1ADb1hsEJ6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238680, "uuid": "11498575-1652-4de0-8479-34c1ae91aa6a", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238680, "uuid": "be3e9d53-9516-446c-a682-c5b61ae93053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238680, "uuid": "7df99be3-32ff-40e9-a6c5-edb4df636829", "value": "tokengen.py.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb226a5b-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684235306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235306, "uuid": "49e58885-72ec-488c-9f3a-df54a587b91f", "comment": "Malware payload (Formbook)", "value": "81a2e07bd9eebd69d1c8a73fe1535c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235306, "uuid": "4e9e764a-631c-400c-9569-130835113705", "comment": "Malware payload (Formbook)", "value": "8a1818f6e89fe3a6a0cae314467eb120d9e3f95ad6e17099c4f3f5e18d039929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235306, "uuid": "18761967-15ec-400d-a0b8-c7e599198769", "comment": "Malware payload (Formbook)", "value": "1300cba9aca024f28d4a52dbda597748f4f7d2e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235306, "uuid": "fb7c5b65-46b6-45ef-a4c5-b38f97e19234", "comment": "Malware payload (Formbook)", "value": "2ec8e6c39b4468c68e890e8c03e575e2279b0a721771c6d5bd570df914b582ca03f0c8a2fbb94b91fb8b2c18b6250ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235306, "uuid": "9b60f0a4-023c-44b6-b311-a79e7b707381", "value": "T1303412547774849BF8A109714C399FA73BF667227220839F67405FADBE06262EA0D3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235306, "uuid": "46147d59-6b9c-49a2-9a05-8db9d31a9318", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235306, "uuid": "e3bfac57-c4ac-43f3-bf03-cd2522b260c8", "value": "6144:/Ya6MyDXbXYhsUeNV+6orlZRTugIvkLmAwaZ8:/Yay/IoYHlqgekLSaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235306, "uuid": "bb58ea55-79b7-492a-860c-f5c33a843ada", "value": 242614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235306, "uuid": "1a3d54c9-7f64-4fd3-af95-2b4a06a6d814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235306, "uuid": "29336da2-70b1-432f-a7b2-9978afd93306", "value": "E-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c85b0c-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684235243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235243, "uuid": "817ff099-b6b6-4be2-a885-6890c5f957aa", "comment": "Malware payload (AgentTesla)", "value": "167032939925b8d9631f7786113350b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235243, "uuid": "87499bea-b6fa-488d-bed5-a574a0a926b9", "comment": "Malware payload (AgentTesla)", "value": "8b8249728361d92d8d0891d75711b07ee241db22a8ca1bcf2efe2cf14204d9dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235243, "uuid": "17a9b189-81c6-4252-ae6e-fc567eafc183", "comment": "Malware payload (AgentTesla)", "value": "25f3682316d3281291f8ae55bfac6668e40c9a43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235243, "uuid": "82df0bc4-ef9f-4254-8b27-6fa731f654a9", "comment": "Malware payload (AgentTesla)", "value": "5a131ecc31544d684ff6c3ab1c8130ea34275a18bb953c861132362d524f33fd4df19533ef6891a368a88350549039ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235243, "uuid": "86388eb4-154d-4906-be22-4b6f5dc50397", "value": "T19CC4D07050EE4B90E02FCBB165B8FC72023274F3AED5C9751B66A1C4CE66F506E84A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235243, "uuid": "214c0d45-3be0-4ff2-862b-55cc462ce329", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235243, "uuid": "0a3344fc-69ac-4c75-8e5d-46ea322376e4", "value": "12288:bYNv5549XFFTlWC25XgDiWQzHlgwZ45GYBlh74Q3V:+r49X/ZWL5QEp1Z+GQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235243, "uuid": "5facb8cc-7c0d-4185-9f59-3981ab1ec8ff", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235243, "uuid": "3a2972bf-c6e5-46cf-83db-34fe2af1f075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235243, "uuid": "cd759eb4-f115-4b66-b46c-f3cd574f1178", "value": "DHL - OVERDUE ACCOUNT NOTICE - 1301493699-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742fa4cb-f412-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684259561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259561, "uuid": "58971d52-fa28-4f41-9eaf-ef6ae8847901", "comment": "Malware payload (Formbook)", "value": "e6d55202312115eddc7ea4ab1790cb0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259561, "uuid": "77ef7472-b9ec-48d6-adb2-1296fac72a65", "comment": "Malware payload (Formbook)", "value": "8bc2209887fffd6b27980ba8c2c138deb45370c5b0a8434f9542897c6a05c931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259561, "uuid": "600b4011-ef82-4505-9732-120c49d520b4", "comment": "Malware payload (Formbook)", "value": "0d10ad8bd3adeabdd6a81869287f50a95f8db974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259561, "uuid": "f90445ce-4adc-4234-8a72-b9cab348d83f", "comment": "Malware payload (Formbook)", "value": "86706b480ee9a91239394c6c5e16eb003bc24ec6deab676ed134ac2fa1364e7eb49630e7886a98469450e54a6cb47f31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259561, "uuid": "a8274d50-6fb2-489d-822b-498e6ba4b7d3", "value": "T18DE4BEFA32141FA3D3A846F88360B64563B631513C6BD7E4BDDF20DFA2D5B825629843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259561, "uuid": "75de5a49-8765-46fa-8f65-ed166e4a7fff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259561, "uuid": "aec1a695-3ab2-4610-ba4b-2293072bf121", "value": "12288:vRMrJcifIwdfQtSdNFn/+Ydv0Szjf6m6oh2YHxyLJmFUM:8fdBmSd3/755gU2molmFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684259561, "uuid": "62c24075-ea97-40bb-9e73-86858c4fc3a7", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684259561, "uuid": "e67ece11-af31-49da-a12e-7388b7290092", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259561, "uuid": "dcb79e1d-dcd9-46bb-a54c-bb52d048a583", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764c1052-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684243673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243673, "uuid": "2c3932e7-0204-4003-a289-63d63b1aadc9", "comment": "Malware payload", "value": "1d3ff4ed747331b584e92a5d57b6acd8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243673, "uuid": "d023825a-c427-4d1c-8b65-612038a1bfee", "comment": "Malware payload", "value": "8c2d1d7b94ee68e286b5d3c8f5df99c4d5ad0ed08267cfbcda66cab20bcd8927", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243673, "uuid": "bbeedeb5-e919-4e5f-a06c-6b612f16fd89", "comment": "Malware payload", "value": "333ec83e9242cf227a0d6f3455375d01bc50cf40", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243673, "uuid": "dff2f013-d35b-4b9c-b20f-4bf1c15a1c3a", "comment": "Malware payload", "value": "8718cd2bce852d3af9fdc245ac0cd059ff4faa38175ee00cc4db2c268d2fc77b41f6bbbda94cc746b57a5bc465ac2607", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243673, "uuid": "8d569668-ac14-4261-ada2-9edfcf1dc59b", "value": "T1933430D04F6568B24B4B6E35BAB0D5A5EB7D0E5482C8948BF45F32B1F1DE68CC8D4B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243673, "uuid": "3ef9083e-7faa-415a-a917-6cbda1266e37", "value": "1536:mDY/NRvg4paakXIR0xlXfewOaPLfWy46hUHx+zIt5483CCpRhsW+F22SOtcgZaXA:H/NRvg4HOlX2wOjjlNLt8Gmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243673, "uuid": "e56eb490-be3b-4062-8d87-7a533f75efa2", "value": 246130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243673, "uuid": "7f668d68-c511-4761-9483-7bbd82090568", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243673, "uuid": "b786ba03-bcba-40ed-b368-c65313141b45", "value": "Lnlmlmmw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6bd07c-f413-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684259843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259843, "uuid": "f0408a23-c97e-4faa-a98c-ee76c3f4e271", "comment": "Malware payload", "value": "3effbe54f4eb62eda0ff516f501db318", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259843, "uuid": "ae5e619a-61f5-4b17-a3c7-8d9769e32c3b", "comment": "Malware payload", "value": "8c767e4e043a37188a1a52944f2f43fbe949c9dc8466a05de481325b513da2b0", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259843, "uuid": "a40c765d-ba8f-4937-acf9-e65b4cb4b0c3", "comment": "Malware payload", "value": "2e0d9495f6a265120fe49cb1e236705826dbd892", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684259843, "uuid": "855d878f-a26d-4a2d-a242-2ab09898016d", "comment": "Malware payload", "value": "5dc6304fecf586b603beed2a1f86263be72cd61a3f1d19aba3c17f8db203694704e391f548da68bd90da5cc60a49383f", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259843, "uuid": "757eeadb-9e60-43a8-bc39-3da2822bb6cd", "value": "T1E2B4019826FD8149E4BEBA78C5F282685AB639D33528F31E4D05707E1C61BC18D26F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259843, "uuid": "9cf72953-71b7-468c-8e44-d909faedf3a7", "value": "12288:aGkHW7Ut6TtSA8bqRwqUQaYESmBLoPaSXBQS5O+w2q1ACirGzCnDPdvAEY:KW7UmtSRtBnLodQS5O+w2q1ACirGzCnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684259843, "uuid": "f56b0414-7f7f-4d21-9618-a9246cfd0638", "value": 527240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684259843, "uuid": "c3ef5d30-d89e-4fb3-b9d2-70a475649fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684259843, "uuid": "2ec95f95-6170-4d2e-b75a-f0d41d69c64c", "value": "scanner.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16dc0bf-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684235612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235612, "uuid": "c5e1e208-be10-4270-a5ce-0b17ced8fd20", "comment": "Malware payload", "value": "292604d64a1a4b171b7ff63926852f2a", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235612, "uuid": "130081f9-0ce7-4b9d-afe8-4cbfddc35d18", "comment": "Malware payload", "value": "8c99f9a37cd0abe38aa8707d6b56bae81211e23f8a8b77eba74fd153d364c19d", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235612, "uuid": "724b1855-6a5f-4368-9303-d6e4bf47a5ff", "comment": "Malware payload", "value": "4518d7ddf64ef67826ba315ae3b81a30b9b74662", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235612, "uuid": "ce7fa0fb-5332-4035-b9e8-d6a027b41832", "comment": "Malware payload", "value": "50fe170c1b92c98aabb1ac867a56ddb1ee81e7c1c72ff4c624444959b158f6fe3c71b2f36244409d7c485588ca134d5a", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235612, "uuid": "7339df8a-2578-4427-9e78-fed0e82d7aec", "value": "T15255CF71E93C4A0FCBA61D38C8EE004027C3BEB65214D3263A5C94796D5FB98DB97E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235612, "uuid": "cf0708bb-56a6-4b60-9ed6-883fccf1af3c", "value": "24576:dcVNlYvWEyLFHGqVC5KUSZmi28EO7QS5O+w2q1ACirGzCnDPdvIgc:Il2WE2Hyp2mi28EOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235612, "uuid": "2eecab2c-8fc6-455e-81ba-9aeba041bc18", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235612, "uuid": "b041d975-274a-4c17-ba70-17f4bf3e1fee", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235612, "uuid": "c3353de5-f6ee-4247-ac01-81c0165b7ea3", "value": "SN65LVDS93ADGGR DC22+.BIN", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1353d496-f3e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684239212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239212, "uuid": "d914a2fd-08be-4baa-88df-75483a3d5f82", "comment": "Malware payload (Mirai)", "value": "c4ee1fa15911e94aa272ab88b7ff8703", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239212, "uuid": "d282cec7-50d3-44d7-aee7-dab638b0d62c", "comment": "Malware payload (Mirai)", "value": "8cacc7fe5e5517cca574237436b47d5dd68f1b5aae43948c1987fa35ba1c24b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239212, "uuid": "ad0d9a70-84ab-4aa8-8292-217921c4e179", "comment": "Malware payload (Mirai)", "value": "c1869f7f1e8f9585eb739f72ffadb4b7f53e98e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239212, "uuid": "8ee20276-b219-4aa6-9f64-54c1d0df6d16", "comment": "Malware payload (Mirai)", "value": "65527c33266bc468f7d626c1b3ea66074b01e3e3eb9bc99827d923b64a0377063b1a60ea99b24c07b2036c801afc73be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239212, "uuid": "3a2ebdec-a91e-407e-854d-ab8000782c81", "value": "T1B5434A80F8819623C6D1127BF66E428D3B2613E8E2DBB3079D225F2037C686B0D77E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239212, "uuid": "46767386-56f6-4cd4-b175-346fdc62614f", "value": "1536:tj7QgWzvkqAs5a/U+81yv+VzxiCsaXvWnO:tjgI/8IvWV9xWnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684239212, "uuid": "1ea6ead1-52e1-44ac-afa9-e4eb34bf762d", "value": 59644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684239212, "uuid": "da35982f-5983-4c75-a7a1-2c53a619a6b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239212, "uuid": "281e5c93-607c-407f-901c-1342df0d6596", "value": "c4ee1fa15911e94aa272ab88b7ff8703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbcd247-f3e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684240709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684240709, "uuid": "6484f942-4f36-4e89-92c5-8fb85b3b33f7", "comment": "Malware payload (Formbook)", "value": "c59c51e55c2bf1edae2a547190f7fb2e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684240709, "uuid": "f1857277-9ab2-481a-b521-4bd9c53f351c", "comment": "Malware payload (Formbook)", "value": "8d89da78eaeb6383014d3d7c3a3ab024f4fd18cbf4ee729bfb251ba46d521359", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684240709, "uuid": "e9e97b5d-e5cd-44fb-9dee-396103175198", "comment": "Malware payload (Formbook)", "value": "63ffad18fe2c3e6ee9136df20e6e589f132c0009", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684240709, "uuid": "e9719512-1955-4cb8-ab34-4d3b62ee6b8d", "comment": "Malware payload (Formbook)", "value": "14ba85f1c07779d1fe5b723700936cd7ed66efa40af93d110772ef37f339a796329e945c0755791de15bb806f8ac8a58", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684240709, "uuid": "200a6f49-a4d5-447a-8753-df34491f7872", "value": "T19F442214673D24D1B2E9D6F6E6133872519ED12EF10D729666B85A883A1CFC32EB4C0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684240709, "uuid": "0ee99b55-186f-4f75-af1c-6dc5725f5d7f", "value": "6144:zF8Wp67pe8wt2/12N+jCLElRPkqixxh3avA9txLkW:zOW0wt2d2kWLicqyavA9tSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684240709, "uuid": "c7d7a5d2-dbbe-49e4-b680-cd9cf7638fca", "value": 276377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684240709, "uuid": "73b730b0-67a2-47c1-997e-635f8ed094af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684240709, "uuid": "93750586-b62f-489f-bfbe-e73355a0efbb", "value": "%HOME%_unpack_faktura.bat.sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abc80b0-f400-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684251707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251707, "uuid": "a0e91c1f-652a-4c9e-b51f-96206adbe431", "comment": "Malware payload", "value": "e17b7f9ff3546a84182e83ac5f53a901", "object_relation": "md5", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251707, "uuid": "bffd40df-a650-41f6-8ce6-c4ecf1ff9585", "comment": "Malware payload", "value": "8f352bf0a87cf3c3ad93a21b4324fb0ea1305b5411911c3d91f247aef297f7ad", "object_relation": "sha256", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251707, "uuid": "942d4b61-cd3a-41bf-998d-e36432378883", "comment": "Malware payload", "value": "c556e3fbd72dfb54598d5965e060ef9a7c177ea6", "object_relation": "sha1", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251707, "uuid": "4c5401d4-bdf6-4ede-ac3d-c7d129286bd2", "comment": "Malware payload", "value": "151dcb4a78c69509278a2cf34341261026565303733fe13352c6a8b3ea8f903fcc0bb30a25f037fc72d64b189937bded", "object_relation": "sha3-384", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251707, "uuid": "33f14285-b0fd-4a19-bc12-b243c2b8917f", "value": "T1A9443FD14B95A472878B7E267A70D5A1DABD0A6087CC598BF09E3260F2CE6DDDCD0730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251707, "uuid": "e8a4efe0-e6fd-4c55-b3fd-069d35ca1f39", "value": "1536:mDIgIi1xKZD3UqcAE7qf2gEPL0zuNA94HVkxw6p07LvQZRK/ixzcv4raLpatvXUO:kdLsD3dk7qfzEPLtg+vuIG1lLYWWXO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684251707, "uuid": "7cc887af-2485-4dde-9bbd-73621f126d16", "value": 264622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684251707, "uuid": "06523a47-1f14-404c-883b-72fc9208d040", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251707, "uuid": "e833a70c-36f6-4895-8b5e-a4ad04dd4b40", "value": "Hlyl.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ff83bc-f3ca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684228503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228503, "uuid": "a5321f55-1db5-418c-a4ce-055e750c4040", "comment": "Malware payload (AgentTesla)", "value": "d4a7468a87e2ed2d8890dcfec97424dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228503, "uuid": "816b605d-908a-48ef-9a6d-4b94dccad96f", "comment": "Malware payload (AgentTesla)", "value": "8f9e46a18a95b680f10749f2a9e6b01e521b925a8d38efcbc89de1c454219442", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228503, "uuid": "63f8a262-3f85-4cff-88e1-46d3f9556cd2", "comment": "Malware payload (AgentTesla)", "value": "a5e657940735f30eb100af8756b8acf06fe765ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228503, "uuid": "2427be3c-5f83-4a11-b16d-a9a95295782f", "comment": "Malware payload (AgentTesla)", "value": "e2c8961ac626d19e98f0b2c7eb4e79343eabacf7d2536af0e2281cc42c8c675dc6bef0ad97814aabc915ae7019700dea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228503, "uuid": "e80f465d-4a03-43c0-9375-f64acb4abc7b", "value": "T1BE942399953D928013EFAB22469E7354C81B06D07C95A3FD6A747C0EC7D8D08AED9C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228503, "uuid": "8d334869-2bf1-457f-974f-ed9898fc5ced", "value": "6144:BlWNd4jB/gS76NFLQS4N5c/jSoQXRUPh15JVdoTLCm9epu2RAOQVubBJy5LYFD/6:BmEUPkSDjSxCPh1VdaLCmAgotJgUu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684228503, "uuid": "ded0ad3d-da7d-4333-94bc-38f0b60cc247", "value": 426236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684228503, "uuid": "f577e948-45ae-4cd1-8063-6e9cd68efa1f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228503, "uuid": "3d3c474c-3b61-4a58-be49-8f4241a7a6bb", "value": "SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc10871-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684243689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243689, "uuid": "78699469-735a-4eac-8e25-7a0c0fd4c064", "comment": "Malware payload", "value": "357de377add7103ecfe42d8b1548b40b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243689, "uuid": "bd7cdccc-94b3-435e-8144-2c95dae28ab2", "comment": "Malware payload", "value": "90e164cedb14a0fd087ee4eb8a1401f36663edbeaf5c17a8ca364d9538a7123a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243689, "uuid": "629bd2b5-76ed-4d54-8471-40d6312de34e", "comment": "Malware payload", "value": "097d2f9296437482a1532002fa6deb0a78e4af70", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243689, "uuid": "03ec80bb-7860-4670-b270-eb97627c2bb2", "comment": "Malware payload", "value": "de081161b9b8f8eb3c893e9c676a4b72c5260df367fdd38e1fed1c14162ae3a94feaccd9fe04016d957c03d0c479ad97", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243689, "uuid": "df2c5b92-4f1d-48b8-ac34-df6a301c414e", "value": "T18344BBC04B551876878B7E617B30E861DBBD0E6082C85A8BF95E3265F2DE2CCC9D8735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243689, "uuid": "af4f9306-d1fa-452d-9e5e-2a903bf42cb9", "value": "3072:Psuy8CMt4Uwfc9Pxa85xpS7bNODrTq7b2Z+L:vy8ttXwk9Pxa85xpM7b2Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243689, "uuid": "6a64ef1e-9169-4f61-bf1e-a679622edd69", "value": 270331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243689, "uuid": "47a47f26-0fec-4d0f-b8bc-0ebc12f07edd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243689, "uuid": "2d53d28f-2043-4593-8733-95b43fed7b82", "value": "Wzlh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f66807-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684233925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233925, "uuid": "569fcfc3-b9cf-4953-a45b-4aa3d7ce9fca", "comment": "Malware payload (AgentTesla)", "value": "4eb5c79f238bc7585e7bac6856c6d2b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233925, "uuid": "393b04f2-89d0-4a3a-a878-73d423108867", "comment": "Malware payload (AgentTesla)", "value": "9133fdc2100c4d8818a0cc0fa136f70c413f6e78daec22baf543f0079ba35ce8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233925, "uuid": "0f888ba0-f786-482f-9c37-bbbde9a68f8b", "comment": "Malware payload (AgentTesla)", "value": "8024fc2b59da70a204e5a898fb9ec6058be8f638", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233925, "uuid": "478798b8-513f-4325-a0e7-723a110990fb", "comment": "Malware payload (AgentTesla)", "value": "aa21d71a511f8027105c69fdc51a75bbf3982e5b582b4da28cf60eab3e38302d39defe69beb07003c5a855858ccd5357", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233925, "uuid": "ff24e559-0f3d-4a50-a3e2-2f31dc3ccb58", "value": "T11055CF71E93C4A0FCBA61D38C8EE004027C3BEB65214D3263A5C94796D5FB98DB97E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233925, "uuid": "fc146512-c339-463a-a5e7-8461e489f224", "value": "24576:AcVNlYvWEyLFHGqVC5KUSZmi28EO7QS5O+w2q1ACirGzCnDPdvIgc:tl2WE2Hyp2mi28EOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233925, "uuid": "2394b403-c0ad-45f1-a32b-e122d0e922b3", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233925, "uuid": "f95c3f79-4f19-458e-8fe9-b6170a5a2909", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233925, "uuid": "2dcc8fe2-62ed-4a31-ac2f-e8d23146641c", "value": "ISQ-Quote 428542.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd68d71-f3cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1684230935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230935, "uuid": "2a2ef9d0-f52f-48f9-9e79-d95ee4d74e23", "comment": "Malware payload (Stealc)", "value": "017ec29b10183144c4ad9c53646ca263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230935, "uuid": "1693ae11-c4e0-45e7-884d-aa39baad3b9f", "comment": "Malware payload (Stealc)", "value": "91c54161415866a533e47eee9e0c440a7ad855bab9e198b968439f1ed8ee94ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230935, "uuid": "a41824c2-4e55-4329-8b03-f16680efb254", "comment": "Malware payload (Stealc)", "value": "56f7104bab803194afc73f36d594cd0504e266c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230935, "uuid": "a58c2cae-4d41-4266-bfed-abe83b8838b9", "comment": "Malware payload (Stealc)", "value": "73f61f585b322caee032decda3a95946eb5e352509e9211f19c851ad87f1c968f2b84dc076e24df9f9de02b230202ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230935, "uuid": "ee3cdb03-78e3-46cf-9495-f9aba20b123c", "value": "T10444CF123680D436DE6305788CA4CF798D7BBC712B16F9CBB7C80B5E8F25ED1992524A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230935, "uuid": "0b1747ac-7c75-4ad8-abaa-79e182c49921", "value": "441dde5b8c1eab2560caa3d857c1a4e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230935, "uuid": "f2104d81-2457-408c-aa83-d94cd8aaf862", "value": "3072:xkzo5YPGjX49HwrcGuyec8butFwePbCbe/fFPXArOnPevhbKuu/Ch9QZAhC:xkz+Y5HeBmuvwAbFP7Wu6hG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684230935, "uuid": "49dd9d88-2621-44ae-8c8b-5858fd805910", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684230935, "uuid": "43181c3f-c3b5-4ac9-bef1-3782247f4a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230935, "uuid": "57879e65-4307-4f2e-a225-e9c45b05b03f", "value": "Stemix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ad0d3a-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684232458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232458, "uuid": "bae2b33c-141f-46d0-bb63-c5099703e431", "comment": "Malware payload (Formbook)", "value": "0f2bccedebf25e9f665b2e07064f307d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232458, "uuid": "f46b3ebb-4c2f-4f2a-86bf-a19f224a22ca", "comment": "Malware payload (Formbook)", "value": "9296272090597bd4d2723682f9ab6923356efad185125ad318eb778637b36cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232458, "uuid": "0e9261ad-cfac-4e43-84ef-f1bf31b95f7c", "comment": "Malware payload (Formbook)", "value": "6eabbe0e5a7aa657101d39979e44a9457a912cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232458, "uuid": "bbc44918-c357-4933-835e-853e9d64ef16", "comment": "Malware payload (Formbook)", "value": "be3ce23bf47772da0599efb284088067d1565aeaecb02e729bdf8dc3dd340a5424a9413e7a4c74db49d28955f2564edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232458, "uuid": "3dc19744-4e3e-457d-9bd7-b1661fcee14a", "value": "T1E5F4BF5022649B92D3B947FA5134091003BA3A963D3FE3689FEF20CBA663F475A54F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232458, "uuid": "78b5ea92-1f42-4778-92df-41056a4022ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232458, "uuid": "4d66396f-0e1e-4e09-8007-2b22df3f83e7", "value": "12288:c+QX06XlJMsJxxbt0ex4qbgAecAMr8ql42L/mjYbnzP3qiQ8ljQ:F363dDge5ekr8OjmjMDqOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232458, "uuid": "9dd4c3d4-811e-4203-8965-7354861a9645", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232458, "uuid": "3890c141-ac3f-4110-a3f0-d6213b4f307a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232458, "uuid": "4785722d-8f25-445f-a2e4-05e6ab204451", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6a81b1-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233620, "uuid": "3bf5e4ab-9266-4b37-bc67-895a1b8d31b4", "comment": "Malware payload (Mirai)", "value": "b84500295a50a6a78f246a65ca518271", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233620, "uuid": "df82c4f2-0ce2-4f08-a44f-7cb27974e09b", "comment": "Malware payload (Mirai)", "value": "92beb5ec8d4575fe1dd11706e388de6903ad300d4e43c8ff75e7c95d291ad090", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233620, "uuid": "2e8aabe0-5d21-4fc8-89ec-2b4c8ac7b57e", "comment": "Malware payload (Mirai)", "value": "0502a905eb5bd34c78be06e51313d912fbc1f30e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233620, "uuid": "098f89b7-8afe-404e-8cdc-f3e477d8e23a", "comment": "Malware payload (Mirai)", "value": "2df8950171f16f4ab9a0d0823ec53374fcbe8d310d942e90eb9691285e5294e18e3dc0e1df4b5652da845b526efdd245", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233620, "uuid": "196236b6-0591-4006-a78a-023a0c253ea2", "value": "T15B33F272676D6AD251B09736BC33BC1AA6DC27F85D67309A38F0661977C18020EF6682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233620, "uuid": "e35820c1-821a-4f43-a804-d21a2e19581f", "value": "1536:s9O/ZMAXIxNUk076LcPqF1aBexo4opKZbW:s9O/ZNKy6LGqFUFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233620, "uuid": "cc866400-ab68-4938-94ec-0ef92939ddae", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233620, "uuid": "a07f17bf-5df5-459b-a06e-c6385052fa3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233620, "uuid": "717a000f-d9f2-4392-8ed6-13526da9cc1f", "value": "b84500295a50a6a78f246a65ca518271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a2ecc1-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684232027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232027, "uuid": "557db198-702f-4fd5-a9b0-b638ace70f34", "comment": "Malware payload", "value": "e835d186f302b6447b4b397b2f0b1072", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232027, "uuid": "09d4f25d-2b77-40df-91bc-be51c1ab2057", "comment": "Malware payload", "value": "93d85aecc9f5a2dcf868b46f0c9b6181deec58bf099840c7a6b63ec3f1272110", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232027, "uuid": "6a9ad6e7-13ff-4d1d-8c91-fd2d78c3f998", "comment": "Malware payload", "value": "c75a3ab397d2d17e23dc962817836ec81353d58a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232027, "uuid": "8652fae5-d9c4-466b-b3a4-18702e8c5b6b", "comment": "Malware payload", "value": "e9843a79577d42063e657f3ded9a8ac7cd16c6826ea006e3b1ce2b1952ce0277a2c284011835ab7798ca4c3c646d5046", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232027, "uuid": "8f335c7a-3225-47d8-87a9-e2cb2a3ee336", "value": "T1AB45BFFC76047DE6266F576BDA96ACDC03B627229ACBA4CD806477C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232027, "uuid": "c6129efc-cef9-4365-bcf4-c9288200a9d1", "value": "24576:p/zBEuinlGx6B56r4A3Hi092JvOsUhHxjHVWf+oq2JtrsYH5WovNiBK1fwph:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232027, "uuid": "38a58f1e-09fc-4199-91ef-d33211c3d6f5", "value": 1262376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232027, "uuid": "5df0a13c-661c-4aec-b324-c20c4520b7bb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232027, "uuid": "2f77b8c7-0bbf-436f-93f5-8c5a82e34a36", "value": "PO00848.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81a0323-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684235247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235247, "uuid": "5b53612d-1544-4944-b73f-68721f584039", "comment": "Malware payload (Loki)", "value": "093992664d4204b6b0c6d56e8b4be350", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235247, "uuid": "49f81a4d-c5a3-4d3e-848b-104ff5a9d8a3", "comment": "Malware payload (Loki)", "value": "93d876a6561ce4396d3562fdc42b577239f75d5524b809db0499f23b3527442e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235247, "uuid": "b42df739-6f1e-4e8f-a9c3-bf9465998dd2", "comment": "Malware payload (Loki)", "value": "509a73032e25a6221c21398aaca080b03da08235", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235247, "uuid": "e1205baf-090a-4ccb-ba58-ab43cfc41245", "comment": "Malware payload (Loki)", "value": "5c7df0e8cf177b3a4971e24bac04002f0bf958d94ec155130090cce1a88d641479aea3404ad631a4d8ed9c9517185997", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235247, "uuid": "c4fafda0-c15f-4067-991d-eb0190528e3a", "value": "T1FAB4DF7420DE8A90E41ECBB165BCBC71037170E3DAD6CAB50739A184DE27F546E88A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235247, "uuid": "2ffe22b6-ffcb-47d2-943b-6423879d2fb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235247, "uuid": "df8e0c47-58fe-4f71-9dad-901bec0877dd", "value": "12288:EMNnbv55X0CqVjkt22rMbQ6SnHw3vousH87g:vZjzEP2IbQVQ3vouE87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235247, "uuid": "ed6ee7d4-c18f-4532-a84e-dfc22184db54", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235247, "uuid": "30f60a45-28ca-42c0-bd99-e397f6ae8710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235247, "uuid": "97448ce9-0c3b-4ca5-983a-536ee20ef45a", "value": "DHL Express shipping DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f426750-f3e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241863, "uuid": "9413efc4-4217-49a9-ae50-acb6c71fcced", "comment": "Malware payload (Mirai)", "value": "428e1f3cadc03f15529ac100f0675357", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241863, "uuid": "f4fff82e-9895-411d-9478-96982c53dd0d", "comment": "Malware payload (Mirai)", "value": "93f63ab2c79013676f06992c528b047376fb3a4269d67ae6415722f8b37ee35c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241863, "uuid": "d774171b-41bf-45b3-bc47-f549cfd3c221", "comment": "Malware payload (Mirai)", "value": "fbf935b140fef00a8401f4cbabacbebdaa059f2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241863, "uuid": "6e9b368c-924b-4941-825b-401a30eea8c8", "comment": "Malware payload (Mirai)", "value": "25056cd940c6a285d5139e6b60c0610d9152c5425d699e1988e2aec515dd33942b4c212902a6501db3e7145f84bbf286", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241863, "uuid": "d08ad84d-b654-4343-96c1-6e1c4a520c54", "value": "T1CFE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8279B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241863, "uuid": "f575cf1a-f542-449c-9d11-521c44c29a2a", "value": "3072:CJLce3pCsp7naLHbz4N9GUJURIJ1FfEXkkTM/9AIMY:CJLc6dnaLHbz4NMUJdHfEXkYM/9TMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241863, "uuid": "d6491987-490b-48b4-8534-dc6ad6c473a8", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241863, "uuid": "e09e374d-3810-416d-b62c-065f22bb2af5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241863, "uuid": "9b88a06b-b961-46af-9625-cc62ab415320", "value": "428e1f3cadc03f15529ac100f0675357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e617ac9-f3cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1684230641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230641, "uuid": "d1bcc036-500d-419a-bc44-6eb105cd23d3", "comment": "Malware payload (NetSupport)", "value": "8c36cd12562f003326dd7912dcdcd978", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230641, "uuid": "d59c5583-4f29-4446-b978-0ec7e837675c", "comment": "Malware payload (NetSupport)", "value": "940a644adf65467831939be61952cb30d352dd461c8f2d337496e1836f7d3584", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230641, "uuid": "e8b395c5-8bfe-414f-bdf0-d490ffe91386", "comment": "Malware payload (NetSupport)", "value": "747a01aa527790f74bfcfaa129313f39111767eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230641, "uuid": "5db3968f-2f17-4afe-9b40-49cb0fe18472", "comment": "Malware payload (NetSupport)", "value": "6fe7306c0b38125326e10fe14be9b527b346aab4535ccf640cbecefcb961962f12717b26a9a23606f2a6ef6709d13853", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230641, "uuid": "41a49f67-b9a8-40b3-9e8f-04ed8cb1f425", "value": "T1BEE2DA8826D3B052935BF07A775E8CC5E66859120BC56D0FB81D2178FF86C3CCAE4768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230641, "uuid": "f7892372-7a6f-4508-82a3-ccb1a484f74f", "value": "384:wQ0LleH+sI33u5C2amTRl0RPYYXiwyho/iC7s5+8vEB4rImmYGskZrmRQKPuL4EL:wQ0LSCtpFYIiwyhaWo8vU/wALFdpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684230641, "uuid": "72bc3b0a-6059-43eb-92e4-1693aaa2adc3", "value": 31361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684230641, "uuid": "24b287b8-86f8-44ce-b4e6-7fc4179e963b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230641, "uuid": "db8e3ab4-2435-40ab-81d3-a3d7bf379505", "value": "doc2029284_6019343_5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344c3a81-f3e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241844, "uuid": "a34385c0-a08d-43fa-abef-b99081508d12", "comment": "Malware payload (Mirai)", "value": "6af18c5ded17ea12d3c1694a5b414ad9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241844, "uuid": "e9707932-5be0-424d-9303-cce694a5227e", "comment": "Malware payload (Mirai)", "value": "94549db62ce7fd7eb2c383fc7677e5e8f04f0da62a8484df557498ba157fa4c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241844, "uuid": "776c4b5a-e650-4e2e-beda-dd2c649348c8", "comment": "Malware payload (Mirai)", "value": "06b793f5824636464ba92c8b5909d324329f3c5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241844, "uuid": "f2b09e71-76d7-4ba1-9eb4-a11a72b923b3", "comment": "Malware payload (Mirai)", "value": "776933edf3982e04dea191a5f65cd377e8d45816d5bd3ae773a3102bb122d24ee9a178b96ab4ba9f8c2b2809f4f6bb5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241844, "uuid": "5fddc367-b2fc-4bf5-bd4e-3b4aeb045e2c", "value": "T1CC637EC9E287D8F6FC1705702036E73BAE71E0AA211CE696C778D5B1FC86941A117ADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241844, "uuid": "03eedb9f-f44e-4ece-81d8-dd9c664b9cb2", "value": "1536:pnUQJZdRlDAXO6QyQUK6+Q6Nx8hp3uJ7RvsuIr5bhD8I:pnUQJ7RlUXTQpUK6+Qox8L3q+uWuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241844, "uuid": "56312097-f418-4a8e-b6df-78f099127bb6", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241844, "uuid": "f8ed5956-1863-480f-8bba-e8efe81821a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241844, "uuid": "98399e73-223e-4002-9cff-334cc635384f", "value": "6af18c5ded17ea12d3c1694a5b414ad9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2800f3-f3c9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684228171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228171, "uuid": "637d6ed7-9857-4c18-a7df-5b18d2989ced", "comment": "Malware payload (AgentTesla)", "value": "34d29794aa396ec77e7a232e13e66dc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228171, "uuid": "e1ff74b4-4061-4fe4-a206-71a7d363a44a", "comment": "Malware payload (AgentTesla)", "value": "969176a34d561011ae830585449b3c8ffa542cc63f7fb1ec57c610c139f74c55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228171, "uuid": "8e2dfe93-f716-44a7-ba6a-a2f433e3df7d", "comment": "Malware payload (AgentTesla)", "value": "1a86d4624ed848fa22823289037136bd00a79044", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684228171, "uuid": "eb1db4ff-5fb5-4bc3-96de-d79fca084b7a", "comment": "Malware payload (AgentTesla)", "value": "8442d6ae735a6ed0058706d8f8343c9097c386466fc9ed3e9081f522d2c97db1152396b85437f41b7f9f9dff34947138", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228171, "uuid": "9143c41d-8883-4ee2-8cb6-4feb3aeb5286", "value": "T178A423C58C3AC183162F9B1BAAB0A6F4CA516DE20055723E37BF796A1FC630193D8D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228171, "uuid": "f4142d75-9471-47b2-8b6a-f97177bc5325", "value": "12288:slyZwKvZwJ3FSvjSbysp78Md8ALfOH7JHUJ03fdKpC:bZZwow7p75LgJHUe3qC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684228171, "uuid": "4d65dad8-7471-46f0-b70b-81bc74b06b3e", "value": 463584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684228171, "uuid": "0ed6c422-5f2f-4f55-a626-d94d93863882", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684228171, "uuid": "094aa74d-d631-4bc1-be01-9d6082802383", "value": "PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8376cc6-f3eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684242952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242952, "uuid": "ddff484e-b63c-41e2-a932-777b1221bb8d", "comment": "Malware payload (AgentTesla)", "value": "97102b82f92d69898edcb37f9c2e8474", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242952, "uuid": "b2df1bb2-e2c7-4a2c-b020-0fb8b0bfd54e", "comment": "Malware payload (AgentTesla)", "value": "9754fd1df64407e26dd257a9f277dadbc8c5e28b21ef94509296b898b35fd77d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242952, "uuid": "a4c1f73a-761a-42ca-8ab4-19776f55cbea", "comment": "Malware payload (AgentTesla)", "value": "e03253666b2df47f8c51484016e113dc5cc5b63d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684242952, "uuid": "c52ca3dd-e538-4c6a-bcb8-1a9ba64daaf0", "comment": "Malware payload (AgentTesla)", "value": "951efb05d67f80c94948f4a473cf82887d4732b88189e7685d70c8a0cf476974630d5c04d1356c0311d26b5b487b69bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242952, "uuid": "875a264e-e8d3-4399-8f77-43810b8dea67", "value": "T1E905953D09A68AEAC07FC3E49BCC4957FABCD837B655D96F18C603426241A4E61C319F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242952, "uuid": "aae113a9-8ea4-41ab-83fe-f8b1f49255cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242952, "uuid": "c5f4ac14-1e4d-415d-b792-dfcbeb1d416a", "value": "12288:Sr/0SljSocgbFrYeVRWYDGTP69V36TfXsB:SXVbFrTRLDGToV4fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684242952, "uuid": "873b15fa-af77-4e3c-8091-d686dc1f2a86", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684242952, "uuid": "d4400c67-423e-471c-809f-051f40872e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684242952, "uuid": "f8c65043-a0db-429a-b4d3-5905cf10b339", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450f32c2-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684233712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233712, "uuid": "e09de15f-592b-4d3d-bffe-c4992d3ae17a", "comment": "Malware payload", "value": "2b6551577c2b7ea1769fcb67ec5f9b1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233712, "uuid": "693390ad-4afb-4377-b465-9f19a8cdc6cd", "comment": "Malware payload", "value": "97c9c8d61d95bef4666b32a30410b2538df10730673aa31a9ed162e178c59710", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233712, "uuid": "80a917e5-f797-4648-847e-c9b901e0b636", "comment": "Malware payload", "value": "9f6c9d7a5a26b0aaca3c5f10b163d106b96f9978", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233712, "uuid": "ff42eeef-0c74-4125-bfa4-5a4cb6f2e239", "comment": "Malware payload", "value": "00c89629b3e7e2f5d967544e8b4918d1dcac875baa68d7e6ecf117fabc80fb01f3adf8c02b6e7b82605014947923355f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233712, "uuid": "92880283-f7a4-4a23-b28a-bb247f702a82", "value": "T1E3E2C89925C3A062975FF43A775E88C5E26E49111BC6680FB81C3278FF95C3CCEA4768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233712, "uuid": "a44007e8-a877-4b5d-a9d5-87bfa14756e0", "value": "384:3L699uuf64+rzYrkiEkOahvD4gYta/YNd8v1wGmhVPvU7leadvVs/5:7Nk6RQ5MRdugW4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233712, "uuid": "920c7aba-5737-47b2-90a4-ce49a2beca39", "value": 33299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233712, "uuid": "969b1be9-8ec0-4403-815c-541a112e3cec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233712, "uuid": "ebfa1d4e-771f-4552-8d4c-a3f12f0bc054", "value": "doc2395477_1304477_60.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80397c3-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684235703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235703, "uuid": "71f4881a-b02d-4cab-93f8-95cf371b4f28", "comment": "Malware payload (RemcosRAT)", "value": "452a3fa330c94024ad16d754ac82e59a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235703, "uuid": "05433f00-3aa6-49b3-890a-716cb65f5ed8", "comment": "Malware payload (RemcosRAT)", "value": "97e54013704e2edc63c7d31ee30dfba3d2bcdbdd91df650ff0a01e560c3e111a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235703, "uuid": "29057482-66b3-43e2-96a8-140acf309ab5", "comment": "Malware payload (RemcosRAT)", "value": "4015c54d1b216af73427309dd808d33468acf10f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235703, "uuid": "d8fdfb01-f65e-4fdf-8793-1372c538035c", "comment": "Malware payload (RemcosRAT)", "value": "f482a0dae079be5109dcc3364c9465df14e4d44fa50aa3d983bc15850c47fcc0449f8febd8e126ec583e05e601ea08aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235703, "uuid": "246fc40e-6b21-43cc-a1a4-85edd3375ccc", "value": "T158150170519E4694E41F8BB1A6BCFC72037174E3E9D9C9760729A284CE5BF602E88D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235703, "uuid": "7a865399-54c4-480c-8b50-e12b31ac73ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235703, "uuid": "d4622534-587f-4f4f-bc20-3d89b1094f45", "value": "24576:uRCspBT06N4yK0e4/gh8iGPefdT2mbyJNvR6Vnogn:uVpB46KyK0eCS8NPq+R6VoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235703, "uuid": "b7ba1e37-98fc-42d5-b81b-45c885252e67", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235703, "uuid": "7fea5ee2-ffd8-4461-a02e-24f4915ea042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235703, "uuid": "f390824b-c215-4e8a-8786-00effc0fa9f5", "value": "452a3fa330c94024ad16d754ac82e59a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866a5516-f3c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684226520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226520, "uuid": "1b0e3f4c-e00b-4da4-a7b6-14c9f93ae948", "comment": "Malware payload", "value": "ac3c664f99038eeea142016142571851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226520, "uuid": "18ee1582-ba22-4ad0-9c88-e95ff47d958e", "comment": "Malware payload", "value": "97eda997acd72e95525ee26ca829d00497e7d20d4319161e30e29e3da7e14072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226520, "uuid": "a5d47293-c980-4faf-98af-aa769f5870e2", "comment": "Malware payload", "value": "97e84625cb12ef3fe4eca56cf16f1896e5d0e79c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226520, "uuid": "b2cb7074-211d-41be-ab4b-d7324578a5bd", "comment": "Malware payload", "value": "4b91551c25174c65c71d3537cf0660c4441ef3458f1feb8cd101de97834af01938f5ce199ae44e699cbe875a2ac60cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226520, "uuid": "835b21c2-945f-473b-b876-edf47311dcf2", "value": "T1886733C36B70C230C4291C327643A955020AEDE45EBE9AB85194B7FBDDF4FA5EC21A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226520, "uuid": "26a1c4e0-f106-4c5d-af1a-65807b6a257a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226520, "uuid": "9cac3e0e-7258-43b1-be47-16f53d37adaf", "value": "786432:x8DgBfUyQcKBLY/EWEgtN5Trec/h0+I04k4YZfZC:xmg6MKBk/EWDXfzrIgfZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684226520, "uuid": "30e1495a-913f-4392-aed7-e1827f0d1923", "value": 30094848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684226520, "uuid": "7b8c2158-7d33-4d5a-a0a7-bc77ac6b7b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226520, "uuid": "9b692a66-ac13-4ef6-86a2-ab87272d6109", "value": "ac3c664f_97eda997acd72e95525ee26ca829d00497e7d20d4319161e30e29e3da7e14072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ce8670-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684238485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238485, "uuid": "e19823c2-f2db-4576-90d6-632ce976260c", "comment": "Malware payload (Mirai)", "value": "310dbf061a4fb01febcf276be3ff6b56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238485, "uuid": "ebe40e1e-ba89-4ee9-8666-8e5143d17ea0", "comment": "Malware payload (Mirai)", "value": "98a05c308626ac4187a265f516c758ba7d4825cf6741d88006505a4acab8006b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238485, "uuid": "91a7d755-6887-46c6-b80e-8ec511b0b2eb", "comment": "Malware payload (Mirai)", "value": "2e7e7ff19804768883fa0b07e352209e54249bbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238485, "uuid": "32defb26-226b-4294-9d51-f48bd1eb29b0", "comment": "Malware payload (Mirai)", "value": "7727b024d6b367fe86b5c1fffdcd2745f9d58b7099ff81bb16d643651eccdf64c4f5f05872f7d1c6ef1876abdff08367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238485, "uuid": "40eef83f-36e8-4d8a-932b-361d0c762774", "value": "T13F435BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238485, "uuid": "44dcefea-bad1-4a7a-b9fa-403234d6a7cc", "value": "1536:JeESt/basV2rcZhG6+KN7TqqpW1ZzWOIaEjrqM2s:JeESt/basVTgW7Tqqw1ptXESx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238485, "uuid": "deaf325b-8937-4bab-9eb8-f3fc4b27af41", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238485, "uuid": "b77e17e6-aab8-4df5-a014-1172969fe0cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238485, "uuid": "510af516-2c80-49db-aac3-efdd963da1e2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a018f7-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684238709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238709, "uuid": "c3050308-e9aa-4179-bcf3-80894113aadf", "comment": "Malware payload (Mirai)", "value": "746caa031c8743260396b279a5877f87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238709, "uuid": "bb1f0c08-8255-4999-b744-354e7ae286b1", "comment": "Malware payload (Mirai)", "value": "996b5d99085bad3eab7f1536fcecde050f2c20e30ea6490ffc541baabc926fd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238709, "uuid": "5ac89063-93df-4407-93cc-a0ab4a1bccfd", "comment": "Malware payload (Mirai)", "value": "4f887ee02f19ba68823b59dad0c18458e16a8c5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238709, "uuid": "773d0897-2cd2-44cb-81e6-7108f20bb282", "comment": "Malware payload (Mirai)", "value": "2b42d16f8c1d8a89dd4c99bed8b4a93a6cc45da3596f7442536f5bfbe77417232fe66d590a0003757277920ba3bac4df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238709, "uuid": "40b6ba91-687f-464e-b82d-809d5bcde0bf", "value": "T1E6630956F8814B22C5C6027AF92E118E332357FCE3DEB2229D206B2077C696B0E76D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238709, "uuid": "65b6c70e-4135-4fe3-b8ce-4c149592f906", "value": "1536:tpnqh/sOR5YbAP+uppI46EBGaHA1zuInig8F2+lhyS5bYonT:K/9R5MEWaO8F2+lhySRBnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238709, "uuid": "f2aa9bc9-a00c-49eb-a329-76eb47b082b6", "value": 70964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238709, "uuid": "75dc72a2-df54-44c0-b221-78ee0412ed88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238709, "uuid": "b1cfb747-e872-4e1a-8645-5e816ba8c5ac", "value": "746caa031c8743260396b279a5877f87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8d691c-f427-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684268757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268757, "uuid": "268f31b2-d2a7-4171-ab19-8f2924d1d9fe", "comment": "Malware payload (Mirai)", "value": "6a3e858557ea570efdd9a6e81d602d93", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Horse Shell", "colour": "#A86D13", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268757, "uuid": "40c9593c-eb0b-4ce8-a48b-167bccfb0f29", "comment": "Malware payload (Mirai)", "value": "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Horse Shell", "colour": "#A86D13", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268757, "uuid": "c639e4aa-f058-4978-9f9b-a750c5d292a5", "comment": "Malware payload (Mirai)", "value": "fb79a8d42b1e4bc9641ff790c2c86ef582582c6f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Horse Shell", "colour": "#A86D13", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268757, "uuid": "f076ee32-9f40-4181-bb86-af49cb2cd307", "comment": "Malware payload (Mirai)", "value": "bfd39edbfab18fd945d260524a911a317c284a8edf6bbc49feee3ed9a7ef6dc31ceb444760b23c54ca932767147d2739", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Horse Shell", "colour": "#A86D13", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268757, "uuid": "6be3b0a5-d788-443f-8c54-5ca0cc03525f", "value": "T10504F9172E12DF6AF2A9C2B0CBB3C970C59462F31AD54525E27CE71C2E2864B641FBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268757, "uuid": "d2b2204b-0716-4384-a066-0de60db84b0b", "value": "3072:EhUVsdM26NC8n+PjPyBrc++uMn10if6iwAVkM5DEMufNVNguG3CIOhAP3N/v5946:Eh+26p+PjKBrc++910if6i3H54MufHvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684268757, "uuid": "14a79227-7c94-4b88-8a48-721b0284c721", "value": 174580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684268757, "uuid": "c9136663-4dd4-4642-8223-ad29657866fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268757, "uuid": "0abdfcfa-3c5a-4bd0-ac95-76406a4a0243", "value": "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cc6f85-f3f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684245382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245382, "uuid": "b98a5aeb-a179-4b56-b0b2-0f9e5e0d9185", "comment": "Malware payload (RedLineStealer)", "value": "c1ddab3caf15e19a2927a08b456a738a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245382, "uuid": "7c781c96-773e-4822-b0b7-0b0789ba6241", "comment": "Malware payload (RedLineStealer)", "value": "99eef2ddcdd851be98d34b201c6e2b82df5483c3ea8e526cd939bf0560ff5ca0", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245382, "uuid": "568aa259-d1df-485c-8b5e-d9b6dfb57219", "comment": "Malware payload (RedLineStealer)", "value": "dd1f94df9b8cf93594745700bf53e431844fb8b8", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245382, "uuid": "25d72009-a14c-4876-853d-e7e61d6df9e7", "comment": "Malware payload (RedLineStealer)", "value": "296499da23b799b3ea91bccfc6be3fd1c82be3fc073b1ca376fbdb7c1c5367a1103530ffc20d79973f0569dc301714f8", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245382, "uuid": "8f52c174-1295-42ed-867e-844e4ac8de0b", "value": "T103452312FBEC28B2CDF217708CF52687067D7F414EA8D32B1696E45A1C73AC16435B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245382, "uuid": "5fd44e8e-d86d-476d-bb32-3d359a14813c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245382, "uuid": "32c9c297-781a-4e6b-9c92-176bde16906b", "value": "24576:/y7V5d7yhvCVVHcf/VmQeEC2SkPUMW2hJpialRFuAkiesl:K7V5pyhq78XVJ1PNW2hJpialRFRkies", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684245382, "uuid": "41035270-6e25-40c9-b701-735ea96e19f7", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684245382, "uuid": "70ac133b-76cd-4256-8d38-b7ce1150aa85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245382, "uuid": "0362453e-1256-4bb8-b623-d9baab793858", "value": "UseTheForce.py.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761ec79e-f410-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684258705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258705, "uuid": "15212a9a-f196-4cf5-89d6-f3cfb8d953fd", "comment": "Malware payload", "value": "b67311d5285a20f732e9fcc4644e391a", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258705, "uuid": "95696122-18d1-4e85-b6c2-baa074194f6c", "comment": "Malware payload", "value": "9a2e2acba782e2f0602996fa62eca6b4b1e6fd21f53823a715aa6e9c749b21b7", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258705, "uuid": "fe2cbbc0-6cbc-425a-ae58-86c44a0c79d9", "comment": "Malware payload", "value": "9a8e66d69caababbe00bae2f6681f10f6976eefc", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684258705, "uuid": "8cf8f0fa-d470-44b2-b09b-1be8bc574096", "comment": "Malware payload", "value": "38422958481b5041d249e24e6b1ea9e08c25915561bee75ed200fed9cea68e42f0d2e0f863bc61aacf342fa00d4d81b4", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258705, "uuid": "5c868558-9c0c-483d-8ab8-ea75ec328baf", "value": "T1BDB423FB3E2A8EFF9374C6950CF2205432CDFC4656BC804BB12D6564EDDE6402A5A636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258705, "uuid": "d24773c9-ca04-46a8-952c-a1014f23a6c3", "value": "12288:k9nehFEd8aPqraeQkDywjjGj6kEhB8WYhfZA3Lh:7hFEdIfzpBkEV+hwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684258705, "uuid": "71c18283-f4de-4046-a66b-216f7962ba3a", "value": 534869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684258705, "uuid": "2595213e-b100-4241-923f-065bd1f10911", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684258705, "uuid": "382b7eb1-824f-4070-8f99-11f647d39505", "value": "Purchase Order_231313_20230.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63168556-f436-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684274994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684274994, "uuid": "95277665-7f1a-4f59-af00-4240fb7f8a48", "comment": "Malware payload", "value": "07d562eab091eecf61e9ff0dad842a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684274994, "uuid": "e58a4ca1-7d09-433d-bdc8-dd39b0e9469a", "comment": "Malware payload", "value": "9c2c4b5b8b250240a6d908369290d0b9a894b0110fca69b07eb02d51a9de34d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684274994, "uuid": "a944935f-cdb7-41f1-a199-6396698dd203", "comment": "Malware payload", "value": "6fced32d7008143096e7b88412a86da034c1888b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684274994, "uuid": "74847c61-d576-4890-92e1-389de65e741e", "comment": "Malware payload", "value": "f4352066c78dd4dbe63ac7a684fbd8134205de86c838c7eadf08ebf2242cdead9b6d3fb355745059a37400af5ebf7b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684274994, "uuid": "80f834cb-4889-4ac5-9ebb-6101cd9e0203", "value": "T16CE59E4033F84E1FE1BE0BB66531D16947F2FD569BA6D38F2CD164AE24E2B018852763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684274994, "uuid": "0e21b0f9-8865-4ce1-bee8-198837e65a5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684274994, "uuid": "399d7590-c38a-447e-af0c-83a429b1c594", "value": "98304:rwWr//ujlS6uxS2EDl/RRhhFAh3RYLRRRTRwhRRTMRhh6hyuhRRhRRTRgGMAsqRZ:rWqxS2ql/RRhhFAh3RYLRRRTRwhRRTMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684274994, "uuid": "43c526c3-5789-447f-8992-8d58fbdf99cc", "value": 3252736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684274994, "uuid": "39d8691c-261e-4fde-b6f7-55e4cabdeff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684274994, "uuid": "bcc5739e-b55d-4258-881e-e250f6924b87", "value": "KeePass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c95842a-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234047, "uuid": "5ec3da95-dfb8-4c03-bbfb-8feb49933abe", "comment": "Malware payload (SnakeKeylogger)", "value": "521626db00ce9434f6e65ba4b9e218bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234047, "uuid": "4ce637ee-9c51-490b-a339-83457f01db40", "comment": "Malware payload (SnakeKeylogger)", "value": "9c66ee8408f346d107b9de203506f8006ee635f3cac6efeb4f14b8446b2916de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234047, "uuid": "63523be1-d3a6-4a36-8203-5c7c524f0b9f", "comment": "Malware payload (SnakeKeylogger)", "value": "61b5f8b9cb744c5abd44f9d4a0d144786de568d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234047, "uuid": "95ce7edc-1f5b-4ef6-8533-6702199f9301", "comment": "Malware payload (SnakeKeylogger)", "value": "a81d340f4c5b96c473f95328bb043662a3c70c68bec0b5ed30870719d584bdc5a9efb9e0d0a0339dc319afd3652160e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234047, "uuid": "69206d10-2623-4af3-a571-54a66aa22d19", "value": "T10CC4D070609E4794E01FCBB175B8FD72033270E399E9D9740B25A5C4CE2BF146E89A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234047, "uuid": "787b95e4-82b0-4ffb-9a4e-b1277d53ecf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234047, "uuid": "95c367ae-227d-4493-9952-726e6e3ba43a", "value": "12288:IYRv5y3/99S9nXhVpKRIUDO+tLJAH/ji0cKtJlksgDF:To3V99RIUDHtAf178", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234047, "uuid": "4beb37e3-32f3-45b3-9e92-a529a2e576d3", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234047, "uuid": "97a37d12-cc5c-42dd-8308-206a5b4fbba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234047, "uuid": "d7ef5cb5-df3d-4973-af1c-f54e2036a36f", "value": "Shipping Documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33002306-f3d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684231534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231534, "uuid": "e44e2729-8d04-435f-9d42-07a0bfeb08b0", "comment": "Malware payload (Loki)", "value": "18eac976314f6ac1e39e1a61297ec680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231534, "uuid": "73ff6407-b14c-425a-89c3-a4872b7352df", "comment": "Malware payload (Loki)", "value": "9cedcc423c89f58cdef6386a96d9d57237cc0ce9b84622651691ec7e40d1e128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231534, "uuid": "de22f436-cdc9-4034-b191-50b189b53b5c", "comment": "Malware payload (Loki)", "value": "dcaff7f36c7092d849e2634dd26e8e5112386ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231534, "uuid": "fee2a0d3-1284-4377-8cc0-4c66ab5cf07d", "comment": "Malware payload (Loki)", "value": "565846a424d6d1e2a52e011edd5473578122b75d57af7db0bdf20f52b7d44b02d7df9a01b19e860f43ad0273def89f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231534, "uuid": "a96b9b60-b4ed-49ea-815a-b2915f988ae6", "value": "T1ABB4D170209E4A91E02FCBB165B8FD31037174F39EEAD9750765A2C4CE6AF502E4895F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231534, "uuid": "88b40809-d2a8-47b4-9e86-d3aecfb5b7ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231534, "uuid": "6640d9c7-7c59-41bd-8428-25f04ac457f3", "value": "12288:2YSv5rd9ymDtS9yQIiNn8EUorDvTuffDVEQDVnBJoyZMNe:2jFDGyQDNn8EUo3vTuEQBBq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231534, "uuid": "8a81b9bc-e651-4ef5-ba29-64c130765e94", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231534, "uuid": "9b4c49cd-875d-4f21-a275-de79400b2e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231534, "uuid": "03fffb05-3afd-44bf-94f3-54880131cbc6", "value": "HSIFsnN0YhuG0YQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a352ef-f3fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684250282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250282, "uuid": "120e44d8-ef64-4be8-8c0b-9daea60b2111", "comment": "Malware payload (AgentTesla)", "value": "f4a9043991298fe9703fa851dac561d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250282, "uuid": "83898dab-8835-45c7-83a2-68616c827334", "comment": "Malware payload (AgentTesla)", "value": "9d125dc7d3de0be5bdc03db4187d1e0fb86e1e3f520c95bb6b3d1340d37007a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250282, "uuid": "e87e91f4-86d7-403a-b3c7-fea95fa4d793", "comment": "Malware payload (AgentTesla)", "value": "56f01c918f34c2a17c6a5b6cf4d149008b63d775", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250282, "uuid": "53248f91-4dcb-44e2-8fd0-121bd2d954e5", "comment": "Malware payload (AgentTesla)", "value": "82b9df517c26d54da1baf1b97ce7f6a31e040521e968c49a8f364f261c35f4f0323d9e972a93795f32da213a9d1c3bf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250282, "uuid": "e117f0b7-6541-445c-bcf5-8ff7cb83078e", "value": "T1FFB4238718D7FFC242A5FB2486F70AE03E5A750B15F65A056F8A8CA25200F7C706A7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250282, "uuid": "4b225a04-1747-4c94-87af-30add3d1dcfd", "value": "12288:BmDMXjVqvCe7B5D5K+7/Tai1666YXENXqasW16P9Nrq6j6491w6:BxqX7B5g+bTai1666YXOXxsA6P9NW6j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684250282, "uuid": "d24f48ec-51c4-4dba-9e6a-e6590f7009ff", "value": 509001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684250282, "uuid": "922e17ea-1179-4343-94b5-44d83686f95d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250282, "uuid": "40710e04-9bb8-4461-863d-01959ddbce84", "value": "Order 403971529.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c0330f-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684233930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233930, "uuid": "2c6ad09f-7e81-45a9-83c5-22ecbf395e45", "comment": "Malware payload (RedLineStealer)", "value": "a0ca0075c5ca80e59d10211a26c3eb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233930, "uuid": "9177cbc0-6f69-4cdc-9d41-52ba99dd54a8", "comment": "Malware payload (RedLineStealer)", "value": "9d5bb7f27363fa29b81d68d30e20aab6d450909973b98a1548d944c36667b679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233930, "uuid": "b97f0db9-aa60-4672-ab24-bb38eb0ddad6", "comment": "Malware payload (RedLineStealer)", "value": "b3e7ef6e49f5cb6b57fc800760d9582bd2b28dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233930, "uuid": "d4656283-55db-41f0-88c3-7598f58b4f32", "comment": "Malware payload (RedLineStealer)", "value": "143a2cff3a401dbdeebad6c16144d933e224b2185f7a1117f2cb7dc03d42b5eabece81f42da5dbf56942da92cbc9385e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233930, "uuid": "c4961e27-27e8-4efb-8d9b-0c0e3d3f1a72", "value": "T19A4523963AE88937DDFD1B3024FA03D30F31FD616C6A46AB235559198C72A817870B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233930, "uuid": "255cbe4a-bad8-4317-80be-604457808abc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233930, "uuid": "e40ce248-4439-477c-9e0a-38dc1e960c71", "value": "24576:3y15vvoqL1+TFdESRLa/qGCK/XNziFpUMf7djW3wroQXmYhv/bHoneSUJ6:CDXL1GESRzEWFaMZcwrPWYd/bHondUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233930, "uuid": "8663e971-eea3-4c29-87d6-35bc2fe03d32", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233930, "uuid": "ba940d7e-6702-465e-836a-6d232cf467e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233930, "uuid": "69cbf7dd-003a-44af-b2c9-c0ae2b4be424", "value": "a0ca0075c5ca80e59d10211a26c3eb4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18cfb76-f3c3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Expiro)", "timestamp": 1684225734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225734, "uuid": "772f5550-6544-41c2-8ac4-e1c6af3e1b65", "comment": "Malware payload (Expiro)", "value": "bd064f5b67dcb30de45b19e11d424f53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225734, "uuid": "f4091998-90eb-48c8-a54e-5f057275ae0d", "comment": "Malware payload (Expiro)", "value": "9d603074042f5d594bc2710ed1545ce7648f35ea0ad789ed1ffbfa2d294faf55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225734, "uuid": "361c38b1-4713-4f2f-818e-0d48ac94c8b3", "comment": "Malware payload (Expiro)", "value": "cfe03d52e6af08c9ad2d7c7f3b7afbd4d7e5794d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225734, "uuid": "3547ea0f-ac6e-4f8c-ac8d-afb5615fc516", "comment": "Malware payload (Expiro)", "value": "d646a98c92c29d75072f24c7930967df99b52ee16db1fa47e0e60ba438f7880a922d6d6803693be9b944334d21066036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225734, "uuid": "0ada69ed-c245-4df0-9a87-b24b353b6009", "value": "T1926512A4B2F90F52C37E83F6556826801B7462A77C67C63C1FDE30C9E907B411A68AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225734, "uuid": "2b0f855e-4390-4be9-88f3-926137143dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225734, "uuid": "28453a49-ecb4-4e70-aa51-ca7195db1ca8", "value": "24576:+JDy73Le60VNu1ZtGYNitrP7DVvIiK7vog0soXrmiSyqDG2whTfrO:+U7q60VNu1ZtZ4tr7DVGog0sovnq2zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225734, "uuid": "a511eade-c8fa-4e9e-a77e-f80018233260", "value": 1467392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225734, "uuid": "59682608-c2b2-455b-a9a2-5cf7b6abf4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225734, "uuid": "ddac4fe9-e0b4-49a8-ab3f-4414964fb2bd", "value": "Order-688930021178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811d181f-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232524, "uuid": "df88f869-ed32-44fa-84b1-525079601497", "comment": "Malware payload (AgentTesla)", "value": "9ed5378ff879cee9a6f9fc528a1452be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232524, "uuid": "a7060575-577f-4ac2-84ab-5fca9dff8c03", "comment": "Malware payload (AgentTesla)", "value": "9d8031410d6a4bcda198842c16aeb42ad294e57e05702fd01661a90e43486bc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232524, "uuid": "eeb4da5f-03b5-4f59-9a3a-75fb045ca256", "comment": "Malware payload (AgentTesla)", "value": "82a2cf484f041489cbfbe03fa8937175712adf9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232524, "uuid": "4ee3d4f3-316b-42dc-8f84-8d9bf59ce599", "comment": "Malware payload (AgentTesla)", "value": "7ec9f4a2414f87c33b616fbce8264c3b6497dda8bbf71785bc5117e30aac21030b71f5a358bc219c5d887793e0015c81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232524, "uuid": "bab4709f-8229-476b-9676-abc08f5f11cf", "value": "T10365D0783199A5CEC01BCE7195B8BC71962170F397CBC223221B5288CF1EEA59F495E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232524, "uuid": "ca0431bb-b6d4-4efc-9d51-930fdf9efbed", "value": "12288:DNBoFJrv5HV1UCzfLgFxHyliAIiFk14pG2omZ0g9wxrOGYRV2jvT8/jN3hmj/KGS:TCzj1LqQIGkyptomZ0rFaV2jvTwjxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232524, "uuid": "1b7e4a9e-d014-4178-be39-233dad8c3375", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232524, "uuid": "f5103add-3a9f-48cd-81a8-8199344a4f9a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232524, "uuid": "7810c772-f0ae-475f-80a2-5e505a2ff157", "value": "payment Advice Note from 16.05.2023.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d15caa-f3f1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684245382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245382, "uuid": "b1923747-8a3d-452a-b299-f542c89902bb", "comment": "Malware payload", "value": "11b95161afde7e1aa1f95fa6e35dad34", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245382, "uuid": "608ceacf-c9ff-4a82-b065-971a21e4bbfb", "comment": "Malware payload", "value": "a013ca122e589869d1f0d4d540060fccc4ddbf0f88df01639875948b714f4639", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245382, "uuid": "c36de776-2e38-408a-b775-8b3945424cf5", "comment": "Malware payload", "value": "b4a1cc5662d56648041a84091ff6a5346bc552f4", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245382, "uuid": "d3d3d9d3-72b4-46e5-a5e9-93787a7f7b64", "comment": "Malware payload", "value": "6ed0a9d5efaf69fcb9574df1104a107c51a5785ef665cb9f9f103dd7af5dae784e241975749efedc328fc0bab804cb20", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245382, "uuid": "04126c51-20d2-45a0-becf-9964e7ed0fbe", "value": "T1514523636BDA4073C9B51BB06DFA62830F36FC91657C470A2A546D4D9CF32C4A8B473A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245382, "uuid": "75f18160-0a21-4c98-88f6-799bda8b70f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245382, "uuid": "9b43a0fd-00bf-446b-a75b-f271adca1f68", "value": "24576:LyzBNXA+rZC+fTH1TOl2bF8G7rwpg29VE+Do:+PXTVrZOleV87D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684245382, "uuid": "e9faedd8-2961-4ba6-9f19-7bb63617c711", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684245382, "uuid": "c3cd4c43-858f-43a1-a4b9-bba8cec07ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245382, "uuid": "da5a46c8-c907-4551-8a8d-b137af533283", "value": "99242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2361d56d-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219053, "uuid": "67fa7298-bf19-4fbb-89a1-829927b8b8fe", "comment": "Malware payload (Mirai)", "value": "5bf821462c6e36e1ad3eac0f7529e418", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219053, "uuid": "fc46cf3a-80e1-456d-909e-1ca047aaf67f", "comment": "Malware payload (Mirai)", "value": "a026295ae72f8d95e812e2d3ac48ed3e555e9c929ddc3f05cc27775ad8a1dd22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219053, "uuid": "d1fb284a-66e8-4ed7-9f8f-567cd25e32fe", "comment": "Malware payload (Mirai)", "value": "14b1e9defa4680e1c20d814482fb0e90bef1aa79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219053, "uuid": "bc441fbd-e634-4f54-96d8-cc922feb051e", "comment": "Malware payload (Mirai)", "value": "c36cade0ab571048691918708de31e9b9dce17a5b30bb6ef3c33c073a111423eac1742a057d055eb389d3ed4afacb167", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219053, "uuid": "dba7c006-1bd8-4de4-a1cb-632b42976174", "value": "T151F33905E6408B57C1E2277AE6CF824D33338B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219053, "uuid": "e05ed34a-2a05-4588-854e-71f0b2a5d02d", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvB6YnyLRM/9HNmFwfBxKQodn:hg2hNNlzIkk/MOa/kYnydM/9tmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219053, "uuid": "50e65ea7-a1ff-479a-9dd0-c7abbe38f72d", "value": 159885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219053, "uuid": "c64ca8cf-5fa2-4d52-9e2d-c580a9ca0aa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219053, "uuid": "c5f6e94f-0746-47e2-967f-29662e3b55a3", "value": "5bf821462c6e36e1ad3eac0f7529e418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0bc4cd-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684238534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238534, "uuid": "a0f268ca-4543-4a4c-99b9-451cae40a4ff", "comment": "Malware payload (RedLineStealer)", "value": "53d58f2152afb9a79804c2c0711b8c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238534, "uuid": "6e31b943-e742-4e58-bd06-770a593d3792", "comment": "Malware payload (RedLineStealer)", "value": "a0c95d8d745e3f50e3219d614018ee27d4bd72c6b7d2092c92f16e88f6f64ba3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238534, "uuid": "48157b2d-f96e-42c5-928b-6b98f2da61c5", "comment": "Malware payload (RedLineStealer)", "value": "2687b00ebd2c3a2a6e694df176e3f24036a60a36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238534, "uuid": "369ce101-dd1b-4f79-864b-6e8ca7a1ea61", "comment": "Malware payload (RedLineStealer)", "value": "13a283ee42d251c0bf3b457deee1d32ff087bddf0a620a5468a6dee27ef26e0eba358f73b579eb6f8bc69829631984d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238534, "uuid": "ad76a6e7-541a-454f-ad52-b8d5e2b4b454", "value": "T173647C226548B0FEED2A94356DF58B335279E03417AF1CDFBF8C32098AD12A4577724A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238534, "uuid": "20508ef5-ea98-45a0-b217-e9217c5aa5aa", "value": "728c6b1d6104d08ae563f697f3b86300", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238534, "uuid": "34060921-d6b7-4c70-9469-d351b74be236", "value": "6144:WpbXoosDzviJOgJoEqABiCvQOLjJm4I6rAz33wNjxycEzA4G:Gb4DT6OgJoEfiPAqn7zA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238534, "uuid": "3fde124a-0a37-4176-a59e-ca4c8a0e0d63", "value": 319768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238534, "uuid": "21571059-8372-4b0e-9a8a-253e8ad2f489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238534, "uuid": "dec336a4-3634-4e84-9fed-c27c836969a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cadc3cb-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684231899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231899, "uuid": "8432212d-0f3f-42f4-96ab-314e0d44d6fd", "comment": "Malware payload (AgentTesla)", "value": "19f00b76091d42f5e02b7e8fb8ee07dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231899, "uuid": "092725b8-96d3-46a5-9a85-ff596f6a4405", "comment": "Malware payload (AgentTesla)", "value": "a14304598aa9bd20c8dfacf82371547c4fc51655384da076b47d9361f3428da2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231899, "uuid": "92f82560-0475-40b3-8cda-a9c45278d76f", "comment": "Malware payload (AgentTesla)", "value": "25f7122081dc161b8c00448785232fca2781f3a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231899, "uuid": "48390d44-8e96-49b4-9aea-62f42cf93d76", "comment": "Malware payload (AgentTesla)", "value": "9d4ef9c834c5397f13db1499aa9676d7d70b9aa0589e6377a9c2e34f8b2158244a74c1a5fe4b9f68e83570e138c545fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231899, "uuid": "fcd71dfc-aec5-4d92-ad9f-90116ebad575", "value": "T138935C189BD8CF63D25D26719023031117F4D649B142FB5B9C88A9EBEC537D84E22BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231899, "uuid": "d0d76db6-badb-42f0-97c5-84c6ed7bd732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231899, "uuid": "e5eff5d9-f330-4d79-aba3-a8ce7d1887b5", "value": "1536:KuDvUjddFVzlUqBTddzcENS55pR9qSS2Co/HazNsS+fP+BCTKP7NeYRN4:LONRUqBTdhwbC+XSs+BCTKBeq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231899, "uuid": "a36aaccd-60de-4a8d-b88a-9b363dbda536", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231899, "uuid": "d53040e9-446c-4247-85d0-42f137ca8a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231899, "uuid": "f94d11b6-2509-4c4c-83a4-e9c91c66f8f7", "value": "Payment Advice - Advice Ref[A1WBFVjTVOhi] Priority payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bda249-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684235322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235322, "uuid": "808ce16c-d15b-4c21-bae2-ceab12959798", "comment": "Malware payload (AgentTesla)", "value": "57b881bba254b1238f80f97ce26a65ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235322, "uuid": "14adcbb2-45be-4635-b0e8-7051fbbb6048", "comment": "Malware payload (AgentTesla)", "value": "a1d32422434369e8665386e4474696423e10bef04f40160f2390c9ba449fcebb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235322, "uuid": "d6861ce6-fa95-4ea6-b0e3-df0f41b54c77", "comment": "Malware payload (AgentTesla)", "value": "043323b23c6beda8c3d2bd605ba4c8b6ca7dddf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235322, "uuid": "68db7833-34cb-4283-b6f2-ef8b803982fc", "comment": "Malware payload (AgentTesla)", "value": "af91f7a7313949de9dc49d059e8a1b5bbf4b59e2a48e2a415c524041634ee390fe9151532c0fdaa8da8e82e996c6dadc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235322, "uuid": "cdac30b2-29c2-448c-8346-442026c27adb", "value": "T16234F1056AE34646C88A8975E0E3413457B2D38B72F3C3CA79C846AA0F523D59F8FB5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235322, "uuid": "17ce8d04-3964-4286-ba3c-4fcd2cb38762", "value": "3072:wZb9WNrYF/sOzByqeAMvApDU2xkMBl3Ji+cexTo12tkf8Mfc2mSRXyZayJs9NfxA:CbJAqeAldUOiFh2aj28n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235322, "uuid": "a3482f6d-dfbc-462d-ad79-dd7f0e36dff8", "value": 235592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235322, "uuid": "5ffde600-2f91-495d-8935-54c2f3fb1072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235322, "uuid": "c10178d2-5680-46a2-ae27-2edf64de6a7f", "value": "ZiraatBankasiSwiftMesaji16052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e3b6e3-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684232722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232722, "uuid": "e3961868-8cff-4ebd-8b39-377925e985d8", "comment": "Malware payload (GuLoader)", "value": "fdfd87c686e54167a187aebff7190502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232722, "uuid": "b0274060-cc38-49f7-ac99-30c3ce90948b", "comment": "Malware payload (GuLoader)", "value": "a28c536ab37d1769b543891226520fdd477fc71c814ca7fd0525c5d13fc8f454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232722, "uuid": "eaa09366-83a8-4156-8038-d55b43dde75b", "comment": "Malware payload (GuLoader)", "value": "dad8ef66f3767bb8c07964f1d8eb6b68e5957324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232722, "uuid": "b7eff74a-1fcb-49ab-8ce8-b8c58d0cb62b", "comment": "Malware payload (GuLoader)", "value": "7476446de1c0ce90016642019d5db53d2cd72d29412011509ca956c11c9aa0708c1d317416a1295f1b7dc405f3c6e861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232722, "uuid": "3fcf6d88-f711-4d39-aa24-cdbc9ee913b9", "value": "T14B05232116A1C577E1074A70C47AFAF9E768DDA1E3B20BA753807CC3BC346514B6E62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232722, "uuid": "98bdac8c-8a39-46d6-904a-f265a6ee5726", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232722, "uuid": "4270345f-6142-4ee7-95af-8d652e5523f1", "value": "24576:Y/HE+QgPyhy0X82xx3zZ9uFzTEEgmJ2Hef5:szQZM2xxUZgmA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232722, "uuid": "f7cc91d3-a2fb-4f27-9a8a-e5937b1ceae5", "value": 870008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232722, "uuid": "1c0c0a0a-7d8e-4c2f-a108-23f558d99447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232722, "uuid": "edc53af4-6613-491b-b11d-d8875ccc1f62", "value": "Humberto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613bdd4e-f3e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241490, "uuid": "cab61a93-6eb0-40a5-82e7-08f089284fb8", "comment": "Malware payload (Mirai)", "value": "de7f4ab51a968785a552788e3a7dba3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241490, "uuid": "d25b896b-8f47-4614-ac5d-2d0c871933e0", "comment": "Malware payload (Mirai)", "value": "a3821fea35cb319ae404c4968ea56e572b965fb8504de1eb7d04e308226883ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241490, "uuid": "e0db0710-4b5b-4b93-8da3-16602d3a8368", "comment": "Malware payload (Mirai)", "value": "ad910e5c18b516e87d13acb847ff1546c520f20b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241490, "uuid": "e2d5404f-196f-4c3a-be95-b895ca1536ac", "comment": "Malware payload (Mirai)", "value": "914d39cbae3441c2eef581f64f9afcb4b752e7632f74d8d7789414781ddd93e768bb0851b638cd8b130ea1504cf32a0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241490, "uuid": "bdc3e3ee-0bee-4e28-a1ff-16fa31f44fd3", "value": "T126633BDAF801DD7DF81BD77A4857090ABA30F3D502831B3763A7B9A7BC721981912E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241490, "uuid": "d1fcc777-c22b-47e9-8c97-615f74aaab88", "value": "1536:3IgNliNoHq08DYfRW8VB3a1oxf6P9dJzGLotJ+ChQiu:3IAliGeEfRHa1yfy9/zYChvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241490, "uuid": "f8f7f69f-e961-4de1-872c-4faac03f2763", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241490, "uuid": "8efbd5de-7974-47ee-9a4b-9acb971b9b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241490, "uuid": "403370b2-2435-4226-b04c-de3177573c95", "value": "de7f4ab51a968785a552788e3a7dba3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9885ce2-f3a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Meterpreter)", "timestamp": 1684212916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684212916, "uuid": "a594a304-142e-4852-9aa9-0711d88ef40a", "comment": "Malware payload (Meterpreter)", "value": "b6757518b585993a6b458acb43fc51ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684212916, "uuid": "4446c1e2-dae9-4030-b1c1-4e6ae20e5474", "comment": "Malware payload (Meterpreter)", "value": "a3c9afd38101d1d6d06ea9e2cffc6b3aeecc46376057c4de56c48645ab62276a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684212916, "uuid": "9fc46a51-fe55-48c8-b9b7-c07650bd0493", "comment": "Malware payload (Meterpreter)", "value": "2eb6c8642b4adfe6c259125d472e9645bef713b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684212916, "uuid": "c0153e1b-534b-4f78-b449-938fe5f51865", "comment": "Malware payload (Meterpreter)", "value": "c9cccbd54292c20bddf8a23f4eb494ad1817914cd8c9bbc02af74a3fa623b5dd43ec722959d192028a668df6c67a755f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684212916, "uuid": "c6e69018-02dd-45e8-8f0a-c4d944207764", "value": "T122E3299C722072DFD857D4B2CEA81CB8EA5174BB831B5603E42715ADEE4D897CF190B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684212916, "uuid": "6fa18c56-643b-4510-894c-28c741ab33d1", "value": "3072:meazRfkyR/MI1gAu5YAELn97TFNAuHymPAA+/qqlm0PDnJyTuY4In6MwAyR4WyX:mzfRMWGYAELn9fSZdbUKYxwAyR4Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684212916, "uuid": "d81036c2-b686-4485-9f70-228da01c3f61", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684212916, "uuid": "9eb06d32-b0ea-413c-bde5-3e5236126216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684212916, "uuid": "dfd3b5b7-f50f-4d61-b6a3-7aa41fa6db71", "value": "b6757518b585993a6b458acb43fc51ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b63eed-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210141, "uuid": "ea593a6e-f987-4774-bf08-f2131b3c2579", "comment": "Malware payload (Mirai)", "value": "5da5649ebd49d723c0044317fd2dad1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210141, "uuid": "9f76b5fe-df2e-4b7c-9a75-cc17903202d9", "comment": "Malware payload (Mirai)", "value": "a4b5803592049a1169245b8e24242cffb80d596c9d576d6bacce3e2c8f603a86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210141, "uuid": "d9705ae3-16d1-4600-995f-1cfbeb0cea76", "comment": "Malware payload (Mirai)", "value": "7ca0a81d181aea55d8ec2e5213b723c369f08702", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210141, "uuid": "f98e43a2-4e05-4c85-96be-54af05458bf2", "comment": "Malware payload (Mirai)", "value": "24345345116a4d598a6ce7c8565b93c74502c979d842463c26adfc958898dbf6ee96e35298f9f8fb5c528cf0ff1fb665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210141, "uuid": "b2d3907d-5b3b-4815-a5f8-955f71d44aef", "value": "T1CAC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210141, "uuid": "7e7f11a9-b93c-41df-8064-554d444f00bf", "value": "3072:4jDy/+mh1vtbPIKaMbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaMbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210141, "uuid": "8caaffc6-38af-496a-8241-1a915bb9b1ba", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210141, "uuid": "5e9dd7d3-e7a0-4b29-8c74-6819676af6e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210141, "uuid": "6a215942-0276-4177-8f49-9d1dd35a54b3", "value": "5da5649ebd49d723c0044317fd2dad1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a1bf45-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684232097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232097, "uuid": "d08694ac-0ddc-4d60-923a-5bfe100eea49", "comment": "Malware payload (Mirai)", "value": "cb5802abc7e1174245cec7682599fc54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232097, "uuid": "cd366ed0-6623-49ee-8c85-ede503d254b4", "comment": "Malware payload (Mirai)", "value": "a52f419baec4909aecdbe1e1e735724370a3822574cc452e87b7a62cb89df754", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232097, "uuid": "05f42bbe-89de-4393-8124-e1e6c89e6f22", "comment": "Malware payload (Mirai)", "value": "450e2b2e0101160962c8f3d5103a4938ae8cb679", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232097, "uuid": "76adbb5e-5721-4a78-8439-ff17e2feb684", "comment": "Malware payload (Mirai)", "value": "a3f70cfa6b28e2ae1d0954627508efc34da153dd24197d6f3584fe71b8afd69705577074b65acb3b24c80be8388e40f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232097, "uuid": "598fa16b-fd73-46bb-abc3-d32081a62d60", "value": "T143A36C1BA241C5FBC08756B62BDFA6615823F83A0B33710673D9BCA83F218C95D6E741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232097, "uuid": "7ff4b7e1-f69c-4ee3-85db-b7a7718db395", "value": "3072:sl2nLV2Woe9OOtJYyhAD3rZSr0phaCZpTmHyVQX5A+u+cm:5gyhQvphaCZRmHyVQX5A+u+cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232097, "uuid": "161d579b-609e-4e5b-bfd4-fffd24602522", "value": 102934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232097, "uuid": "f504bf11-1990-4484-8603-7ad96a663b59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232097, "uuid": "b16f5fcd-ec9e-4df4-9eb0-a8b1da797c98", "value": "yakuza.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1141f47c-f3dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684236632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236632, "uuid": "21f75055-f255-4867-b473-fec9b1a706d6", "comment": "Malware payload (RedLineStealer)", "value": "bb10c18dbb3f431361abbb3ecfbc218d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236632, "uuid": "5487b4bf-e822-4042-9001-15a9f99429c8", "comment": "Malware payload (RedLineStealer)", "value": "a55a8e5fff989e11431c7a07929078773c09c9598f571621ff54bc7e48b68089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236632, "uuid": "8bb44f58-6446-459a-9717-432d7aa9205e", "comment": "Malware payload (RedLineStealer)", "value": "0893eed5d75cd71c24ac9fecd31d831ac60b7f0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236632, "uuid": "3b48ed24-d216-404f-afe4-cf369489ee03", "comment": "Malware payload (RedLineStealer)", "value": "6228900e3816afeae7926465cbd4b0090d2b9054d3720bb9a19637e476db433ca3c913ec267771513216432f8522cde1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236632, "uuid": "f15f54b3-49b5-4038-8d8e-2a4b2b708cb8", "value": "T1DF452353B7DC80B6E8B2237055F6028307367D969C68C1BB7391A8499D72B86F93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236632, "uuid": "6e8733cf-baf7-4b3a-a96f-c8afc4135ccf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236632, "uuid": "b8d4f87b-b1c5-40bd-9bd8-03569ac6331c", "value": "24576:nyQcmXDArDGvfIb/SnVic4EGH5xebJ2HdDmK/ye0Ujj7BR7:y7m0rD6i2iWKAwHwbe0Uf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236632, "uuid": "76149ad6-a363-4302-9c47-be0080597648", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236632, "uuid": "04a7c956-16ab-42fa-86f0-611bfe4b92d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236632, "uuid": "2f8f4c45-d1a2-4547-8296-054c75e17501", "value": "bb10c18dbb3f431361abbb3ecfbc218d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20466674-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1684235368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235368, "uuid": "2d61cab2-4b1d-455c-ae35-4a8cad98e641", "comment": "Malware payload (WSHRAT)", "value": "57ebbe2e997dbfea17030286f8993cb4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235368, "uuid": "e2d5fda8-10dd-47d0-94f6-a9dc69114bbe", "comment": "Malware payload (WSHRAT)", "value": "a64102ad5032310cb854cd6f68255cbfa61173ef90f88c399ba10a0b15523e18", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235368, "uuid": "7a0e302e-898f-453b-82bf-87fb410123dc", "comment": "Malware payload (WSHRAT)", "value": "c5b7745fd561933d84c68b18fff5a131726034cd", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235368, "uuid": "5110ba04-f23e-48c1-8491-f9f0ee72c645", "comment": "Malware payload (WSHRAT)", "value": "684256d079d2bdf116fedf91d4550f03dce02cf6d681652d86fe77d9aa64576cf20517905b7379309db752c1bc4e315b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235368, "uuid": "b93c603a-0f8e-4d5d-bd2f-a18d750228e6", "value": "T170146785BE091362585FF6DD20800C1AD73F002AD55DADEA604EEB4B9D5CA07EF6E0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235368, "uuid": "53501731-71ef-4524-a8cf-fcd044c17d85", "value": "384:TxmlmlWimcfU4pbuyerHazSVrxXNX8ZW7/z7X9rlPl0X5mu1uEK9y4VKthVf7JDe:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235368, "uuid": "5a2136a5-744f-4abc-bd2f-a0deac13aa24", "value": 198530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235368, "uuid": "ce0a2c59-6e15-4aee-9611-a6f8b6914f87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235368, "uuid": "ba3df877-4c70-4394-b3fc-054aa9674212", "value": "ORDER-234468.doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b95c94-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684232990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232990, "uuid": "c128b74e-f478-43d2-81a6-e3c47b5fe60f", "comment": "Malware payload (Mirai)", "value": "5065345ea653265532db4b2526a7b5fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232990, "uuid": "973a163e-3316-435d-9a09-405dad3f2b4a", "comment": "Malware payload (Mirai)", "value": "a647749649ad203b5809dc0d2f05bfd4d078fbe2332c05a02493a41705c7cb7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232990, "uuid": "c5acfbbf-41e2-47af-9222-56c0d9e05f1e", "comment": "Malware payload (Mirai)", "value": "88c571e60667374b57000352a1bf36f5babe1736", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232990, "uuid": "9377f5fc-2120-4188-91bf-4af507b26447", "comment": "Malware payload (Mirai)", "value": "684299e11137cfa8be3aff747626d7c4ffb7ccb6bc526dae275b5f7c62a20b0afaaf536d75d8003e07d6b61dfde131a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232990, "uuid": "6ce48b57-de6f-4b7e-a986-cb280ffdb324", "value": "T19783C81E6E215F7CFAAD823487B35E22575533A52BE1C9C4D16CE9001E7034E781FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232990, "uuid": "d70f4e83-4153-4f8e-8371-dbb980f3aa47", "value": "1536:D0+KmGzMO6GF0V+LuIMJmVVWKK4wvSYbHelLG:QTYOzKmVVW/3yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232990, "uuid": "eb5f7c83-a4cf-4e13-990d-d35e2bcf5f0c", "value": 81544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232990, "uuid": "27cd83b7-6d99-43eb-817a-a8272e8820f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232990, "uuid": "158192fc-425f-47b2-9f79-b511219499f0", "value": "5065345ea653265532db4b2526a7b5fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2d5bbc-f3c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684225911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225911, "uuid": "6bc227b7-21af-4dc5-b704-f5a654271b01", "comment": "Malware payload", "value": "645352edc9e892b8d3fc1f4237da1374", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225911, "uuid": "2cb6b162-ffcd-4a50-b6c9-4c43e06e0e5f", "comment": "Malware payload", "value": "a688b9dc4e57322d206117cfcd481a4611a9021a92b9406e853e3752ac667fe2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225911, "uuid": "ba9e6360-706a-4ccf-bf60-204a92291304", "comment": "Malware payload", "value": "56175b22efabaeb2cc6a0445c2a4de3ad059cf16", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225911, "uuid": "99dd84af-59ed-45d5-9eff-651a7674456f", "comment": "Malware payload", "value": "46325182c32f60272d500d8aefd83c67f2fd8289f2b0f9ab849150359723698d4b0f36b342087d4ba0d12da3248564cb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225911, "uuid": "d2d7fe92-5a56-49dd-869f-3df73d9dc0c8", "value": "T1D8F2085EE78F02688F4113B6131B4E88A6BDB23EB351517134AC937433EDC794666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225911, "uuid": "5468b430-639c-4bab-b6ab-31804bd616b3", "value": "768:CFx0XaIsnPRIa4fwJMu3EZuD8IH5dScGPZ9C9iRSp9Cwe/TFW:Cf0Xvx3EMu3EggIHv2Z9CYM9CwETFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225911, "uuid": "165dd2dc-0cd5-433f-9062-56508e6490a2", "value": 36722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225911, "uuid": "2ebd2ba6-e542-49e3-a806-d860a5281e52", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225911, "uuid": "bb212d92-ecbb-47ec-9175-426a947e3f89", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.27885.6531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0cde8e-f430-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684272536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272536, "uuid": "c5f48388-8380-432b-8f1f-60f07dbfcd25", "comment": "Malware payload", "value": "6165ccf33902415f411c981a6ce740bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272536, "uuid": "6513a05f-778d-4612-b2f0-a5b7c0a466bd", "comment": "Malware payload", "value": "a7f8ea157b43f41eee62a257ff09d62745fc2951b7fd80edc223b30e4bf5432c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272536, "uuid": "2ba0fef8-1ce9-44e3-9b4f-9f8e641fd357", "comment": "Malware payload", "value": "45b2bb7295ed87c63fa32d040a3fcb58c9451c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272536, "uuid": "946d25cb-0bc4-45e8-83a8-a7453112943b", "comment": "Malware payload", "value": "d6bed942796095002e3253a239791ee2a9afe48db203014cbcfd69f925ecc8e9ff74c6f0c44c0837a3d790b6927ec52e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272536, "uuid": "fde7fe96-f06c-4952-a9e6-d838bcf30a72", "value": "T1C07423911FC38DBFE5AD8DB40AB9EF7B8270474C461678834348BFD61D229964B87B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272536, "uuid": "fcd9ce2d-6760-4311-bc07-c89ca6c981ea", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272536, "uuid": "cc9ca959-465f-47ce-87ec-1a7d23132749", "value": "6144:h4SUjhtXAPCRVb0DLj5VpQzmNGxzED+c5H9ByjuGHK2Tb+w/dd4OK/FtbSJPB7A/:6XAPCDgjhQqyzED+c5HHyjO2nHld4dFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684272536, "uuid": "80a32d44-f5a2-46a2-aefd-c47bc3cc904f", "value": 363042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684272536, "uuid": "6cd3ca37-4ac9-4bec-a8d2-ab5c9a834624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272536, "uuid": "4b11a1e8-3fcd-43d0-bc1d-c5707a3690e6", "value": "NL-2190147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de20c1da-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232680, "uuid": "ada8ff9a-9ad3-48e6-bf46-62b1782a95f0", "comment": "Malware payload (AgentTesla)", "value": "302f609135cd315953c05470be6e9669", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232680, "uuid": "05e29f01-c6d0-43d3-be32-c0ab97ed8113", "comment": "Malware payload (AgentTesla)", "value": "a80eba9d818d535cf897c8806c4118a259617d56567cd615a3afeec411421aa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232680, "uuid": "04e63805-8870-42cc-b6b7-7bd5ea7c8a9e", "comment": "Malware payload (AgentTesla)", "value": "802e5381fb08ff100384645419315caaf198b465", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232680, "uuid": "425f5d76-ee25-4472-b08e-67db87d0dd57", "comment": "Malware payload (AgentTesla)", "value": "8899408a6d6670aba9974e062dac81cbdf0c8da9d6f04e2a83cd7f29229fcf48c4d21a97e684847a7a0dc83a124bed57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232680, "uuid": "4bd3955a-b11f-4d05-9b5a-4ad6c61afbb3", "value": "T1F255F170609E45D2E01ECAB1617CFD7202B170F3ADD5DAB4372E9184CFAAF946E4894B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232680, "uuid": "353a081b-2302-4af0-b553-f88be8c309e9", "value": "12288:Sqev53+XiAXs7rMmQBgWRS4NShawWieGZ5pnBl0LYldlzM+t:05+X5uMmQBgWRlfiDpBlbPlQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232680, "uuid": "2f2e3392-7192-43d2-a5af-1a66b5ad580f", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232680, "uuid": "79cca24b-f638-4a01-8ba7-a1ee99fad75e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232680, "uuid": "0d65a52d-9a0c-4e39-8e4e-85f6a80c7427", "value": "epoDTL977.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29011db-f400-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684252042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252042, "uuid": "1b524541-cfda-4122-9bc7-dad48ed9945c", "comment": "Malware payload (RedLineStealer)", "value": "49eb5f1999edebc05cb0d8ded6537a6f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252042, "uuid": "580fd714-25a6-478b-80a1-05d76c800ec5", "comment": "Malware payload (RedLineStealer)", "value": "a8dfc21f303969704e0b596f7a5f64981f4b34a1a81a79be16c587e00731a41f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252042, "uuid": "97d33d38-3939-426a-ba52-e12f4ff36fbd", "comment": "Malware payload (RedLineStealer)", "value": "ac2b43d39f50a9fbf2e865c130ec083dcba3d122", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252042, "uuid": "be78f646-bf43-4fdc-b748-553f810d1cc6", "comment": "Malware payload (RedLineStealer)", "value": "3aabb1c68dd28545c136ca6fe50b7add1a7f65769b80977d9a80611fb69c2860abc84c813e0d1527f02ce57cdc1f2134", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252042, "uuid": "6744680c-23b5-485e-b13b-2e750f91936c", "value": "T1FD452313E7E85033D9B5A73499FA16C30A3EBDA15DF4825A2B848D8F14736C0763672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252042, "uuid": "799247a4-1df6-4d41-a99b-7ffbb8d0755d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252042, "uuid": "ad097817-be94-4e49-881f-c171690cbd7c", "value": "24576:6yTkfooOfGXJ3d9CrjtabhbRzq3d1+4G2Sh1oaaf:BTkJOInChaFtzqm4G2ShD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684252042, "uuid": "4406b530-8183-40c9-b4b8-fe2614eff5ad", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684252042, "uuid": "f9eed17d-90cb-4d2d-829d-d5c26740413f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252042, "uuid": "cc1527db-dd8a-4e07-a8c5-15f34ce21844", "value": "handler.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7170c2-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684238722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238722, "uuid": "6f584c5e-0d21-4ceb-9b52-6820b8cf00a3", "comment": "Malware payload (Mirai)", "value": "0459eb4de7f59b1880cdc3fa5dfd24c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238722, "uuid": "9ded1e70-6761-47df-a4c0-2381536088a6", "comment": "Malware payload (Mirai)", "value": "aa5a2144a0d6e4409304d2af92396decc8e5f38de8d263a36d849f4f4a3cc71e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238722, "uuid": "6e457e37-4224-43b1-bfed-2bb695d90d21", "comment": "Malware payload (Mirai)", "value": "3edc88bd603b5c1d19a35d2e7de553232cca7ac6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238722, "uuid": "54fde450-870c-400e-aa37-646fe7a3ab70", "comment": "Malware payload (Mirai)", "value": "a831d112ba51053d6e794cc9d90ac3a43fce9f156c14afb9fd34d05edea24c991fe3c006b5259506287f747b34d3f70e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238722, "uuid": "81e4db8b-148b-4ed4-a976-adacc2bf768b", "value": "T15ED32A56E7408B13C4D61775B6EF42453323ABA4A3DB73069928AFF43F8279B0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238722, "uuid": "f5e5bb90-4e90-4de1-a42c-8d4f63d4b183", "value": "3072:lS6VGv+5uaDAFEsHY07NSIYwxGnqR+SQkM/9iH:lS6VVuaDAFEs46NxgnqR+SDM/9iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238722, "uuid": "27aaab4d-7b41-4889-b857-24e3ead72e76", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238722, "uuid": "961c2cb6-6eb7-4e39-839b-900f27ce3e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238722, "uuid": "b0b4eac7-c7b8-4649-84e5-189e429fb73f", "value": "0459eb4de7f59b1880cdc3fa5dfd24c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8c7866-f3b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684219095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219095, "uuid": "d8ab15eb-19f2-478f-96cb-908ad5e46750", "comment": "Malware payload (Mirai)", "value": "2ccf828fb86cfd1d8b5d042184605695", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219095, "uuid": "e10b11f9-e77e-4a69-85e1-7adbfa0926eb", "comment": "Malware payload (Mirai)", "value": "ab679347c7b9ad65a7bbb07601c809b4d74ff35f68b0e760973c895e3db98874", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219095, "uuid": "d4c591f7-6503-45dd-811c-3f86b2426579", "comment": "Malware payload (Mirai)", "value": "f00fa91193a137533883ec1e584f0ca94e96e73a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684219095, "uuid": "fbf61986-aff0-44f3-8ec0-d2d0e7a5ec7a", "comment": "Malware payload (Mirai)", "value": "ccde722c08d9a9a0e395080673f068f543bfe57d5b9789624f6f395dae65137ebb3991234c190b3551c466d162e743d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219095, "uuid": "03d4c351-868d-4ed2-afb2-58a5578ef518", "value": "T149A31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219095, "uuid": "3a56ef5a-987f-4cb4-b036-4c88ea5913ca", "value": "3072:VSx+i6mqaObhNgnPTO/X6HmZuqQ4DPwXXtse:y6mRObngnPm6HmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684219095, "uuid": "7c116e3c-5a04-4078-8992-d6bcbc5c8a41", "value": 100868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684219095, "uuid": "87a0fe6f-4881-4b14-ab0c-f04283f04260", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684219095, "uuid": "f906e970-104c-49fb-97a3-ab2be10ee816", "value": "2ccf828fb86cfd1d8b5d042184605695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb08ab4-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232515, "uuid": "fc8efe92-6b71-43e2-96c7-80567a80ed84", "comment": "Malware payload (AgentTesla)", "value": "b94a7caf9687286d14b779db796bd50e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232515, "uuid": "9a04c007-8786-444b-9795-edd3428efe39", "comment": "Malware payload (AgentTesla)", "value": "ab8f412dab69812ee7f32c48d5f2dedf1c26b5416cd408456e253d58f8be6fa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232515, "uuid": "7611e93a-b240-4b79-9851-28c2dd1c21ab", "comment": "Malware payload (AgentTesla)", "value": "1fc458fd314ade3ba45f3c7ca40f1cc3c4367d4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232515, "uuid": "a8e252c9-50e2-4312-bdaa-da18cc304008", "comment": "Malware payload (AgentTesla)", "value": "77ecb5b3fe5c661ec3028fcb644000fdfe2b27bfc7970e68c3a6a8bf9dcd096cb6689f4c9cbe51f7b3906b6f6e3a65e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232515, "uuid": "c91c2e9c-e36f-4c7f-b05c-d859e8ef1597", "value": "T1B605D0783199A5CEC01BCE7195B8BC71962170F397CBC22312275288CE1EEA69F495F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232515, "uuid": "87037ec4-88f6-4f45-abee-ecccb56606e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232515, "uuid": "77289ace-024c-49c6-9a20-45379e8dc37c", "value": "12288:uNBoFJrv5HV1UCzfLgFxHyliAIiFk14pG2omZ0g9wxrOGYRV2jvT8/jN3hmj/KGS:ICzj1LqQIGkyptomZ0rFaV2jvTwjxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232515, "uuid": "7c52e65b-6a84-4588-8bf3-5ace4e3c50c2", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232515, "uuid": "a7cf9d62-c1fa-4d0f-b43a-b91e22007616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232515, "uuid": "1b3327b3-17a2-4121-9be5-0945b2dac3eb", "value": "02aJA4RFlwhxd8F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03884a0b-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232314, "uuid": "ef78ed9c-66d8-4d6f-8f9a-96a7a4337344", "comment": "Malware payload (AgentTesla)", "value": "c8c58701e68123180dce61fc7c664d11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232314, "uuid": "f5ce3a51-9c7f-4461-8b67-11e0a7fd19c1", "comment": "Malware payload (AgentTesla)", "value": "ac34616497579756a7a7785ebbb39a75631272497dd7b2404ed00245741a3b5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232314, "uuid": "5cdcf3a0-59e7-46a9-9b20-41545889fb86", "comment": "Malware payload (AgentTesla)", "value": "05e89868d811fc31186bedeb5c36cd0f85970d97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232314, "uuid": "de14ca8f-eaf1-495a-a67c-d0b7ea90f043", "comment": "Malware payload (AgentTesla)", "value": "b945c45d339bdc8d438ffa685af29c782dcc9f9d308563289c4f6834c911d1994d450eeaec57a6a1fcbfacd56be4563b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232314, "uuid": "44c24dbf-1a5a-4626-80ab-d7d03ad12477", "value": "T130D4F16AB1F94BA2C37A87FA557425420B7461A37C27D93C0DDE30C9EA17F501DA8AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232314, "uuid": "aefa718a-7209-4e30-9fa3-bb36990b2308", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232314, "uuid": "0632a587-bb06-4842-9e2b-d0fab8d651dc", "value": "12288:jIysSNLePpFKwjWy/5kvFtLRI/iAa1i4uVnlF37yGFw0a:LIWy/5eOaAakb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232314, "uuid": "3d141876-ef89-4b78-9602-ab2536fa2996", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232314, "uuid": "89d69a1a-49e5-4e2c-9cc6-5986e1390cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232314, "uuid": "50fbb818-8fef-4815-8199-2bd5c1362fd4", "value": "Transfer copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7c7e59-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684233644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233644, "uuid": "58a5003c-9eee-4e30-89fa-5ba1a6632b71", "comment": "Malware payload (STRRAT)", "value": "2649bb05e669ea428fe92a0ad6bd8fa0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233644, "uuid": "e4734362-d6e2-46e9-94cd-bf42bb41c7fd", "comment": "Malware payload (STRRAT)", "value": "ac3a074915f64a5bacbea23ef6655c70b586b85f88cd8e5d1668a1fdd1f45703", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233644, "uuid": "342d5840-ea13-4dc1-b831-269f7ce598cd", "comment": "Malware payload (STRRAT)", "value": "87899cfda46b67335de4e053a9703e4f54561de0", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233644, "uuid": "a4ddecb5-34b9-45e5-b415-1f9fd3111fbe", "comment": "Malware payload (STRRAT)", "value": "7fdc232f06b94ecbcf909793a9eafe5a1ff5964c0ec08d888ab749fa2ef37ebdb53128ba5add5778572841067e03edd7", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233644, "uuid": "3c13167a-30e6-4dc0-af35-58827636630d", "value": "T10E2423D77D91E43684CB58B0BA18661CBE5D9844814B201BEDB1C6923117E3FF8CC78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233644, "uuid": "98c71ec8-1bab-4e0d-8c15-8620799730a5", "value": "6144:wyINReU8Lrzm03t7PWo0unZ/FG0yfNdEyEN1io9Q:wyI/efvt3hOo0G5F3WNGpN1rQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233644, "uuid": "4d9bead7-28af-4cce-87c3-6f59ead6b125", "value": 221820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233644, "uuid": "aa77fc8a-d0bd-4180-877c-037bb7efe522", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233644, "uuid": "ddee5b6b-1f3e-487f-8b5a-02b7ae4e9418", "value": "S. Alam Group - RFQ_No.6001735503.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1e5a77-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243787, "uuid": "bb88fcf9-f98d-4768-9ccb-c5410a6a77bc", "comment": "Malware payload (Quakbot)", "value": "c47e7a0eb61a4f462c3ae63c3f24ccda", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243787, "uuid": "9944fc3b-2333-4662-b75e-f4d5a56b5904", "comment": "Malware payload (Quakbot)", "value": "ac6cf922b7ce10a16b20401e522393bc97d584cd024906c0d6cc15d0d4896027", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243787, "uuid": "3a03314d-4ebc-4e28-a45f-6d0538b40c3b", "comment": "Malware payload (Quakbot)", "value": "f4c7c796fa94f54fe6c71e3156415085aa0ce105", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243787, "uuid": "74366484-cb6a-476e-a444-2961c1473d5a", "comment": "Malware payload (Quakbot)", "value": "dfe0b9d1db438c4a8213772c38053cfbac24ab662c4277596d7030f72e39ca13ecd48d3735f8be670d8d4d53921fcb6c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243787, "uuid": "e85c2ad0-9696-408e-8b96-ff6aa6a57202", "value": "T10634CAC04F655872478BAA62BA7085A1EB7D0A1483CC988BF85E3171F5DE6DCC8ED731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243787, "uuid": "4f682c94-b747-4fca-bacb-c279c9bdc458", "value": "3072:Qvwv6Lt7QACOKtsguSxzq8Zc+BYVCISH659G7q:QYvyxQACJsyxrCVCIk65wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243787, "uuid": "56b8e068-d94c-4b86-b334-2867921624f5", "value": 247631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243787, "uuid": "af68a85d-b7fb-4da8-a7ea-9eef5a27305a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243787, "uuid": "c16017e9-fc85-4304-b3e9-4f10ddd6a994", "value": "Givqz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54befb5b-f397-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684206680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684206680, "uuid": "e8ab67c1-9b44-410a-bcbb-99e24d498601", "comment": "Malware payload", "value": "d3ea9a7b88d4830be36a6a6623e1c204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684206680, "uuid": "2feaeed1-f0bc-43fa-ab28-957e4943b8be", "comment": "Malware payload", "value": "ad3cb99d6f6282ec20577c508833bf9e61a42a4e76bbd9fdabc2e83bcea351f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684206680, "uuid": "78233787-1d49-474e-9b19-4de84a55109d", "comment": "Malware payload", "value": "d0047b22ad49ba17467713622dc740f5f7669cc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684206680, "uuid": "ac8438d0-b080-455c-bb69-b4774fc1769f", "comment": "Malware payload", "value": "debc38c2d464f84d3f4b9da60f90941e9195958446f9ee9fc5ce8647e05e365fc75e57ec5605feb0ca0119095b08a548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684206680, "uuid": "d431d8c2-16b9-4e48-b468-80072fd941b1", "value": "T175E5C223CFAD4958C1268F36C453655365F23D98434ADF8A0AA0BC3E5DF37426A9723B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684206680, "uuid": "f65cdc20-08ac-4a13-8836-a214cfc39928", "value": "4e7f12711ac216d2f925b7bba78673c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684206680, "uuid": "b0865ba8-e803-4adf-ad57-438672f5fa53", "value": "24576:Jl+U8DTAMMUZ0HDoogmB2ruU0Q22nt65xwunHSdzMsrFmMaMmMCsmsqMmMuJJqma:JI4WtFsgxMxKxKi4mWngB7GFMU32H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684206680, "uuid": "f804c48c-921b-4bf2-b6f1-ba52a8eae999", "value": 3052544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684206680, "uuid": "fa6a4ee2-4442-4439-a079-30d2e86c594f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684206680, "uuid": "641fa11e-bb95-4c60-afa5-1c36a630cfcd", "value": "ad3cb99d6f6282ec20577c508833bf9e61a42a4e76bbd9fdabc2e83bcea351f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a798136c-f423-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684266949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684266949, "uuid": "fda71a39-7693-4447-ba4c-cf671750ce3a", "comment": "Malware payload (Amadey)", "value": "a995fde990914d0ae4278af25213cac0", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684266949, "uuid": "40972fd5-b33d-4a31-b4c6-08e8ddc21ae1", "comment": "Malware payload (Amadey)", "value": "af4ddfd4d441c924a034ef6bf800b07ac0bcfdf42616ef64178f2487c1d917e8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684266949, "uuid": "0a82ff3c-fe93-421f-a1b5-4cc7d8eb4c98", "comment": "Malware payload (Amadey)", "value": "e610383a2c2ebd1de209539c1f6ec7e35436329f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684266949, "uuid": "cde27aa1-c08e-4e33-84dc-eb15f19cb6c1", "comment": "Malware payload (Amadey)", "value": "515b6d0af3e739c5a64873a65f8bfa45198d522ef05b80f3374352a7b94ce7bdf6e524cba38342d3cc3fc3b8c6bc0257", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684266949, "uuid": "c82efb93-56c3-4f1a-bf82-aaba07e54a53", "value": "T194357D1BA26601BCD4BB9178CA274A46E775744603709BEB17D04AAA3F13FF16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684266949, "uuid": "c4f06a49-d4b1-4718-9fe0-d029bce3f6ea", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684266949, "uuid": "ca76a456-bfde-494e-9848-64f28560b23f", "value": "24576:H1q/R30hIa8JrC+azFbWZhEYvKuTZyRydkC:HHIa8JrCHzQZhEY3AQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684266949, "uuid": "8b62761c-71ea-40ba-a852-708902e9587d", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684266949, "uuid": "dfb53c3f-e842-4535-baf1-30e079cbec3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684266949, "uuid": "23c6e7a5-5974-40d6-9a51-7067fe2e2d11", "value": "a995fde990914d0ae4278af25213cac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81f1481-f3c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Chaos)", "timestamp": 1684224993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224993, "uuid": "009a5ebe-dde4-4462-9cbd-6bdee6e40278", "comment": "Malware payload (Chaos)", "value": "e2258fb5390779a9ad9b195fa8610332", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224993, "uuid": "bc9ae844-6426-49df-9b0d-fa6323a3dded", "comment": "Malware payload (Chaos)", "value": "afbbf7833447e0a14735a0b97382990345799ddd5960af8bf20cf761e4469cfd", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224993, "uuid": "b60f1096-7553-4cd1-8471-90921ad2f012", "comment": "Malware payload (Chaos)", "value": "178648a1c8b32763ffa0e92940ff50655c6a72d3", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224993, "uuid": "d0178c11-271e-43ce-afd3-fcd25d787305", "comment": "Malware payload (Chaos)", "value": "21a2543f14d7d4ff781858ba66ce352548bdc93104f6c14231ed99f019965dfecd798193b694016905bdd8bf54d4ba56", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224993, "uuid": "e00eb61a-8fb5-4e67-8117-5a67a9a737a7", "value": "T1F9D4F169B1EA0F63C37943F645A826420B7432A77C27C57C5EDE30C9EA56F1019ACAD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224993, "uuid": "a05e3d03-0d9b-4803-bdb6-8f5cdf2bdf16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224993, "uuid": "a9797bed-00f2-44cf-9239-b35ba7087550", "value": "12288:zMysSjhezxQW1cxoCQfl4fSQ+Kfom47wwO50+6GTjhUxYI/KcT:FhezOW1cxoCyl4fSnfm47jO5l0YSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684224993, "uuid": "ef6013b6-bec1-4d02-a025-56f95e760094", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684224993, "uuid": "0c5f088e-4ad2-4b6d-9752-c4666116d83b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224993, "uuid": "10598110-31b8-486e-ba96-20c16ae1191d", "value": "Download Tracking Reference2.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207d3643-f3e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684239234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239234, "uuid": "014c9bae-e7f5-40a5-93bd-12de5db48fc4", "comment": "Malware payload (Mirai)", "value": "03f0c224624429dfe30d26dc234f268c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239234, "uuid": "55fbd524-dea1-417c-8838-20161927039d", "comment": "Malware payload (Mirai)", "value": "aff4021eb3e713ee97d2aaad013e21eed4e13b7d3eb50c64fa310b3acd7f6be0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239234, "uuid": "5edcfc39-f11e-4e21-8f36-7ed99a649ce9", "comment": "Malware payload (Mirai)", "value": "d91738595484b14be1cf5c3cd4a767d301afb8d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239234, "uuid": "1bdada18-4be7-4426-9c91-be7bd9d4a5ec", "comment": "Malware payload (Mirai)", "value": "bec2e9569e9ddbddb9e8254cbc18a12463954e87940f4cb55bc538b3fb7576cc37a87c7a747e102b19954e1d1be58d71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239234, "uuid": "218ea1ec-1f89-41a4-b97c-4521b4d71b41", "value": "T1EC533C9AF801CE7DF85BD77B4457090AB632B3D102821B3663A7B997BC731991D23E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239234, "uuid": "4b8a9ecc-c08c-4b60-b53b-03dd5d0b39fd", "value": "1536:Nk04gnXHxmK+THgk8L6ny+xG5T7D7XMpUeayX8YW6:Nk01nBmlTHgVoxsTfIrX8YW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684239234, "uuid": "25af5199-85d7-4725-9562-a94d405c1595", "value": 61704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684239234, "uuid": "c29b7b02-c433-42be-a77d-0bb9e1dac6f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239234, "uuid": "ecb7cee7-3bf6-4e51-bc5d-31561cf201cd", "value": "03f0c224624429dfe30d26dc234f268c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096e67f5-f3e2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684238766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238766, "uuid": "d44dd3c1-414f-4d41-b3ec-a0beecdf76fc", "comment": "Malware payload (RedLineStealer)", "value": "c121fb3f802d3c2c2774d279a5b658d3", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238766, "uuid": "6311c326-7119-43ae-bf1a-33be3bffd87f", "comment": "Malware payload (RedLineStealer)", "value": "b071131b4822c690af1cfe537a14e2bd0c6cbeb71d9088615f1b8bd4179efc62", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238766, "uuid": "b31c897b-9fc9-453f-be75-c9d3a89b0030", "comment": "Malware payload (RedLineStealer)", "value": "b809947028672f7840ab7eca77aeb7a29dddbc1b", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238766, "uuid": "5216fda9-16b8-4d4a-a00c-50261bdc0dcb", "comment": "Malware payload (RedLineStealer)", "value": "a1da56171ceaecb9815175cea2afec36662450bb9f169b0c7a4880cd2831d0c1c8018b76bec192b38495b1cc8e8f2845", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238766, "uuid": "e826ee55-ec3a-42a7-a6a5-8b610ca11220", "value": "T1A864BE0131849934F4E6ACB08CD5A7755A3CBDB1ABEF91CBB385356F892BEE03610395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238766, "uuid": "d310c79e-840d-4067-964d-94a41b6ae7ad", "value": "46c74cf13312d6259105eaa206ede1b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238766, "uuid": "8b26ef4c-1c26-4512-bedb-98b6eafc8ae1", "value": "6144:LymrEkZJ3gDuJc8zta2JV9JG2FBJhFuuqpMKfCtixM:Lymtv3guzI69JGeJnuXpDfxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238766, "uuid": "a7b20834-1f94-421c-a8c8-7bc01a5c94aa", "value": 323720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238766, "uuid": "63c01869-3b62-442b-b4b4-ff443460075c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238766, "uuid": "b849e406-3576-43d4-b0a0-94e3e2121a8d", "value": "n0des-downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e7bc44-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Expiro)", "timestamp": 1684232162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232162, "uuid": "60d39e8a-a77c-4087-af89-ac0c02066a82", "comment": "Malware payload (Expiro)", "value": "2f5da568298cd319b13f93bf4dcce1e1", "object_relation": "md5", "Tag": [ { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232162, "uuid": "a0c6b736-de55-419d-85e7-b97cb84a4874", "comment": "Malware payload (Expiro)", "value": "b0d2b31b43fda52b1d5cc9f1fa2e20f80bfd92d304b7cd810c7d833913a4285f", "object_relation": "sha256", "Tag": [ { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232162, "uuid": "be21c503-3299-4b0e-9e6f-cd8a664da4f8", "comment": "Malware payload (Expiro)", "value": "e0bd6e10caa9ddb236fc64bafb41e961a86ba7b7", "object_relation": "sha1", "Tag": [ { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232162, "uuid": "2b4c5540-8008-4a46-9d09-086d6bb6fac6", "comment": "Malware payload (Expiro)", "value": "2dde37ca9549cd9006faf21523ddd89fa81bfbca3a0fc0e2fcdc8ac4caf653c0f11f07ef571df75e1421d345695193f8", "object_relation": "sha3-384", "Tag": [ { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232162, "uuid": "432e5c73-7a87-4fa3-9630-11cdee33bfb2", "value": "T16555338AE4D3B1208B60270F4317ADE91F02D153552D99CAC7A58178E8E6DFA75B73C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232162, "uuid": "87776aa1-db18-4935-98ed-3da50011bcff", "value": "24576:HUrbvoWhRr7KEkD87F7newWrVjnzF+6h+DUm9keYouqPfvqHC3+4cn:qvokr7mDCFDu1nzssydV+3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232162, "uuid": "99635c2c-9681-4a5b-9a68-4ff4c48312e8", "value": 1390180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232162, "uuid": "d7058500-1009-449b-b9ef-ffa9d3c5cd42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232162, "uuid": "499e0088-eb43-4762-acf4-fb9035f41fbd", "value": "Urgent-Order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63caa0f4-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1684232905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232905, "uuid": "333b5f0c-1abb-414f-beb8-b731d0955bad", "comment": "Malware payload (zgRAT)", "value": "526ae0b1779907e90f387d64d7215779", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232905, "uuid": "c761998d-449f-4dfe-8333-9ae95ac0c0cd", "comment": "Malware payload (zgRAT)", "value": "b15a92eadff0e84622061216d99a2e69c9b8f56fda159a9bd1dd03d5ddd4f974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232905, "uuid": "bf21e6d5-63a7-4bcd-9c4d-0d54f4998d1d", "comment": "Malware payload (zgRAT)", "value": "128b350f0ccfdf4333aaa585bc7f949e541374de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232905, "uuid": "10bfb832-2910-4535-bf34-53400c88a334", "comment": "Malware payload (zgRAT)", "value": "1c60dd678834bb2412de6fd824611467fae89ee299159d87748934458db4f5fe12f33026cc51d03787f33561e6593aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232905, "uuid": "7d4329cd-729b-434d-8a56-159f28724d57", "value": "T15674010A3B879712D09D5275E4F7253007F1D3CB62B3CBD6BA41528A1E027D9AF9978C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232905, "uuid": "c8bc3f43-c0b1-4886-8ee5-68bbc60dc7b4", "value": "6144:9tmHRCCbjp7LQDQvqnJBEfj9vdK26IryVAjjOTAH1Bp7YHhos6on4:WH0Ujp7EgZhvdKRQyVAjjOT61XmOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232905, "uuid": "d1bd1558-4aad-487c-a0c7-2af232ba18e8", "value": 348744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232905, "uuid": "450f12e8-328e-4378-bf8f-ff9555e35521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232905, "uuid": "e3e5b628-28ab-4846-844b-ff10580b612e", "value": "Wire Transfer Confirmation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719df9f1-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684235505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235505, "uuid": "368703ca-0fcf-4afe-91c8-57fad6503fd8", "comment": "Malware payload (RedLineStealer)", "value": "b8a93e6bac133cce1dbc116cf39e8015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235505, "uuid": "f2941ee7-da41-4797-8132-c244b4805d39", "comment": "Malware payload (RedLineStealer)", "value": "b18c2839fdb9a12e5b52de597561ee6f320591b7974caf5a1f0af3e055d49061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235505, "uuid": "e08737cc-b49d-44c7-a534-2eec208601c6", "comment": "Malware payload (RedLineStealer)", "value": "863822623f218da910c20f86278480b5c19d5471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235505, "uuid": "8caa8876-888c-4d96-b2ca-73eed89c9699", "comment": "Malware payload (RedLineStealer)", "value": "1e1313af4711b5f92714c60937aa11886d1c75ff876a1796ee06cc468b4e56f30cdae24708f9285266b1d6906c3fc976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235505, "uuid": "f4a37983-7207-4edf-93a1-c3d95c40f923", "value": "T193648E03608BC432D92ACCB9ADE6C7665B6F30702F4F91DBA3C4625D0791BE1B6B5217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235505, "uuid": "93917c5d-43b9-4706-8fd1-acd4ddb5fc6c", "value": "3fbe537ffebff18f8391e84d462e9e77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235505, "uuid": "39d8d873-11ed-458b-a384-42722469bc62", "value": "3072:GXOkKIsiRezHcBqk8teUC9utbZNYt7GyS7jeP70OE5L1E4Gh7+Lom6wD4tZVP4rm:GXOmRezHfFtbvjjE7auZComB4tHw97L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235505, "uuid": "2e6919a4-8bd7-40be-9f4e-fa63290c05ec", "value": 335128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235505, "uuid": "95caac6b-db0b-41e2-96df-4e58f7446558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235505, "uuid": "8480ceb5-38ff-452a-92ef-9e67bd00e5b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e55940-f400-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684251719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251719, "uuid": "abe2fb7d-c890-429e-96ec-d34c6eabfc85", "comment": "Malware payload (Quakbot)", "value": "e57d675101fd9c36496edf4aab1eaaf1", "object_relation": "md5", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251719, "uuid": "13a4b932-3230-402d-96c4-5e75a1517d5f", "comment": "Malware payload (Quakbot)", "value": "b43533834f474b2f9984b1eaad806e5dd31c06f002cfe5392cbfa1d22e4312c3", "object_relation": "sha256", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251719, "uuid": "192b304d-3a89-4f20-b154-53b6bb133203", "comment": "Malware payload (Quakbot)", "value": "79b39f2d28392f6b22f090d48cf1d9eb091152f3", "object_relation": "sha1", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251719, "uuid": "b124dea0-ed33-4ae4-b981-fdc3c08e448c", "comment": "Malware payload (Quakbot)", "value": "88fc65dcc85cbd5755c38197e7723abc4697fbf589c75d69127d0726330b1071fbb6ffa6b583f446f6dcdba462547bbf", "object_relation": "sha3-384", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251719, "uuid": "decc1938-807d-48ff-a931-bff4cd27ed71", "value": "T148256C327992D37BC2173332844DA185D4BEEA784E728D4357EE572E2BB9D838620F15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251719, "uuid": "cf3c6eea-3408-4c8a-abc6-3b13f4c47968", "value": "3f2a9612dbdb7f61e07a31a7a1cbb9a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251719, "uuid": "315e1fcb-966d-4c8f-b69c-1e4d2fe33589", "value": "12288:UjYxnjXcBIlezoQy41hY1eOuQxb64XpyUJM64eMr4JlMxx8Q484xvVAc+IFBNp:UUpcBSf4IeOlbrooi4JluqMQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684251719, "uuid": "9e3b5e3a-aca3-43ac-acac-4071bb6cd2d5", "value": 1049530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684251719, "uuid": "7a202799-ecb5-4d38-a1fd-96a2911f817b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251719, "uuid": "52ec4beb-cba5-4f60-9d9e-03f1abe6503c", "value": "808.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dc063e-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210125, "uuid": "9e539ed9-29fd-46d3-bbd5-5f263b0cb62d", "comment": "Malware payload (Mirai)", "value": "c66d27c21ceb1be96d731eb6d72fc29b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210125, "uuid": "34783233-e706-4380-899e-e5d7ae965a78", "comment": "Malware payload (Mirai)", "value": "b7722d53504a882c6a0dcb34f3504c2b862c14fa8980231a94724922ecdec10a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210125, "uuid": "d32847f6-2998-4c50-8004-837464eeb0a0", "comment": "Malware payload (Mirai)", "value": "9677b088ec02732cfe4577090faacd9b193ea7f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210125, "uuid": "c1648cdd-352a-490b-95a6-6223f7f1c559", "comment": "Malware payload (Mirai)", "value": "7b0a5f6eb439328ca4b8bec0812202cac6a3b2ea624e8a87267080f8692f9fa414e2fdc23323fb46cc994f3bcd1bab6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210125, "uuid": "9627c10f-b65c-44ae-81a1-57ef8d5e1d30", "value": "T17FC3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210125, "uuid": "146d922e-26cf-4522-97a9-8da09e5fa969", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPRL7ymm/QMurB1nKGNb:SMQplVRamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210125, "uuid": "8a043389-88bd-41ae-a7de-996b4d0452c5", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210125, "uuid": "1371cfd4-2810-4dd7-b8af-047d0845f188", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210125, "uuid": "067da283-5e07-454b-bce2-f7f3473358b9", "value": "c66d27c21ceb1be96d731eb6d72fc29b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816ea65d-f40e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684257865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257865, "uuid": "025f8983-7688-436c-bff3-6f115fe28e3a", "comment": "Malware payload (RedLineStealer)", "value": "3e25f57655b7cd39ce4f5fc8ea1a800a", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257865, "uuid": "38bbb2e1-1700-461c-9071-c9b43054fedc", "comment": "Malware payload (RedLineStealer)", "value": "b8ac53e5c33d7b40159cc4daa8e47f0b85b3757d202e4b754ef203c9fb825468", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257865, "uuid": "ec687208-6970-40c9-a150-be2c35f34cff", "comment": "Malware payload (RedLineStealer)", "value": "849331547d0a81795a9397d520253e5bbd0f091c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257865, "uuid": "7e5b79d9-5356-4e17-bb20-5421cb407983", "comment": "Malware payload (RedLineStealer)", "value": "e6bb07b620420ff750ffeb40f98ef984a2c92333325d7fca91d3f4efe94739d48b46162be2716ef4903d19b17d958926", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257865, "uuid": "9a40f16d-5267-4a96-bccc-9e53659949b4", "value": "T146652373A3D86072F5B517B814F322C30925BD82DD30C99F39A96A160CBBAC474757BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257865, "uuid": "a07ee173-4cdf-4dc1-95fc-6c4c8da4dee9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257865, "uuid": "db8c4429-6e9d-4c19-9317-1073202543fe", "value": "24576:8yqkUg/FdTbdsVuh6By7KovGlbKuKhgVt/PTbfvdYdKmoid0HjymBszLyrJUN:rj/FNbqzpbKuKhGPPfqKmoDBGyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684257865, "uuid": "aa9f61ae-81c2-490b-854e-b36ea564dd48", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684257865, "uuid": "c1891e28-c15c-4d30-8505-93a40fd7310d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257865, "uuid": "a544a829-c92b-4058-a7f7-3506a8cb8274", "value": "interface.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4506e80-f3dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684236449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236449, "uuid": "f15b1c5c-d554-4571-b26c-cdc002bd7f70", "comment": "Malware payload (Smoke Loader)", "value": "0a7b19bec6b4ce27e3becefa1e17a649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236449, "uuid": "a73409ef-33c4-4326-bfd3-c56d44f14e4e", "comment": "Malware payload (Smoke Loader)", "value": "b92797965358585eadbe928c2b8531c5575caa87cbcef1171a48f1941a10b740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236449, "uuid": "4fad55cd-fc98-43ee-be62-00ed8e16f53f", "comment": "Malware payload (Smoke Loader)", "value": "9fedbe554e39566881a3e65b195538abae07eb8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236449, "uuid": "ba5a070e-0041-4563-90e6-c10077079920", "comment": "Malware payload (Smoke Loader)", "value": "970e9da5c878f47f50a21790504dac0cf86ee3a631190e005dc8ac0c5dd813e4db7b238c056fd624f3a3acf0dc48c8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236449, "uuid": "06c9681c-c9e9-4d42-84a8-1ecfd939b620", "value": "T126443B4F92F17C55DB664B73CE2E8AE8369EF5608F59776B22189A1B04B02F2D173301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236449, "uuid": "39d5a270-de86-462c-bdc3-941ba9040828", "value": "60946fdd5682e6ea801f7726d24d2022", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236449, "uuid": "afd128f9-319b-4b85-991d-0cbd5f66fcf0", "value": "6144:Tr1+ziLykntIW0iHgEUyBa4vgtdJfBSwb:tWkt/jHgEUyB1vgtDBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236449, "uuid": "1f84bb09-287a-452d-a63e-882d32c09ba8", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236449, "uuid": "20d6733d-4f5a-4e3e-805c-8cde2677f61a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236449, "uuid": "f7e0f00c-4233-45f8-9309-58ffc3d1934a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fe7c2f-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684238728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238728, "uuid": "06cf3047-68a3-4fca-a887-b616ecd097e0", "comment": "Malware payload (Mirai)", "value": "613918b7ac57ade6a4d10d4587f1c07e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238728, "uuid": "92878e07-d9b2-4d17-bef8-a089eb004443", "comment": "Malware payload (Mirai)", "value": "b9918ec372e5f00ca7635208bee3d88726b7e51e87962909db6b5a1e30928fac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238728, "uuid": "7a1a6cea-55ce-40c0-b97d-3b8f4ced8d89", "comment": "Malware payload (Mirai)", "value": "aa61dd3c8b140009ca1837057e2ad33ab0e4c898", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238728, "uuid": "902eba84-b6e9-49fa-b10d-65413e490c3c", "comment": "Malware payload (Mirai)", "value": "25f03b76a645b2631eeabb8ae00fa10f118f4440c6ce3ae4d07a9d274062994a7374e4cd620f3f334a17bbf50169459f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238728, "uuid": "d1bb3c78-9d03-49b2-81fa-b96759e4f836", "value": "T16B433B31BA760E27C0D1A8B621EB4B24B6F547DE26E8CA0B3D710D9EBF715402553AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238728, "uuid": "60d28d98-c046-4c1d-b95c-c9ba0d1574c1", "value": "1536:/fPucFQm4/g1We/ubY7qXQpu75nta1NIw:fucSUvuVaNIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238728, "uuid": "f713cde5-f83d-4efa-8f95-c56629ac480e", "value": 59872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238728, "uuid": "fce5c6fc-1f3c-48f5-be6b-1f10f1fec60c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238728, "uuid": "81b3a581-f46d-411e-8328-a9065725cad2", "value": "613918b7ac57ade6a4d10d4587f1c07e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af10ec5-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234232, "uuid": "9eb271f1-749d-4bc3-83c4-bfbe0306e496", "comment": "Malware payload (SnakeKeylogger)", "value": "59266130a0b0e30eb70bf86895debac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234232, "uuid": "4cbbb142-04a0-41fa-a469-b18129bfd6df", "comment": "Malware payload (SnakeKeylogger)", "value": "bc1f8c5e09141cfce24709d5d58bbe1a99967296b80d126f6cc9ecbfe768cbed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234232, "uuid": "db504a5b-5e33-4966-9144-7d877b8d8e46", "comment": "Malware payload (SnakeKeylogger)", "value": "17c209148cf6d52236f45ff0eba8732488d24bac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234232, "uuid": "d2928bbb-caab-47d1-9f34-06586bae13b4", "comment": "Malware payload (SnakeKeylogger)", "value": "c04c7e9dde53c868833be8d6fa7c2e271a59d8b0417d97d2fd10dccb7df2f2b50aeeecf889556556641d767b729aa748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234232, "uuid": "bc767d60-eab4-486a-b342-36b581033cda", "value": "T19AC4D07050DE8694E41BCBB175BCFD71423270E3EAD6CA750B399584CE6BF502E88A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234232, "uuid": "8452801d-c6a4-49a9-afa2-bec09d89149e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234232, "uuid": "98c5dc29-9187-46ea-8373-fce7b41a93e8", "value": "12288:jJqnWv5tNtZ8XUpMXd0+cinVwwkKSyvgw0Abnes5BNKX:FeybZvpMO1AwwtSFAbneuBNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234232, "uuid": "6700f252-bd21-4cb9-9633-12ad0773842c", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234232, "uuid": "09d40195-e972-4064-998f-ba2676b5137a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234232, "uuid": "b5118df8-2364-40bf-8566-db1155ec8ba8", "value": "report rfq07523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f47736-f37e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684195883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195883, "uuid": "be4cf586-8823-45e2-b19e-6c425eb6bd4b", "comment": "Malware payload (RedLineStealer)", "value": "7a4d02341e47d74c08467f302f66d141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195883, "uuid": "a8cf1686-1e60-4dcf-aa86-9a97561cae3c", "comment": "Malware payload (RedLineStealer)", "value": "bc32d1684e8321e03560ad51895db528547cb3dbbfc11f35b6f5dfd28c60fcfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195883, "uuid": "30f17070-e57e-4437-ad3e-7401cc3a6bee", "comment": "Malware payload (RedLineStealer)", "value": "aa42b0d5c16e4e2ae5d7508b5695fbbfc292f7ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195883, "uuid": "bd39e58e-635f-4b4e-aaaa-861a2eeb9e7a", "comment": "Malware payload (RedLineStealer)", "value": "c4cbac94ee8ba2db70dee3d3090166ef2aedec78ffb7988ed41401f99e8020b4c91ce25f98e3604e08c324b6fe7f766f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195883, "uuid": "02ccd727-0b0c-45d8-aa1a-80b0d7358201", "value": "T13574D02272C0D871E16756718E6AC7F06A6BB9750F24EBDF1790762F0EB82E1C671306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195883, "uuid": "77298c0b-4f38-4859-8d1e-d31c0705a755", "value": "21150e4f7b9effdd3707c48abd03e889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195883, "uuid": "e3fb96d7-8879-4f4b-a280-f0218831a847", "value": "6144:lxTMctzRaH9v2yUy0rXpg2PgOy2etubB3HbHZ:3TMcx4H92yL0rO2tyTubVHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684195883, "uuid": "2e71a651-bc50-46b4-bd4e-af6c6c36cd1f", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684195883, "uuid": "8aba3526-bb87-4c9f-bef6-e1c2fa747648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195883, "uuid": "87509495-1f23-49f5-b510-b78e47d40706", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d74ebd-f40e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684257925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257925, "uuid": "f7007519-cdab-4c4c-8394-dd02c97e2b9e", "comment": "Malware payload (Amadey)", "value": "cf25548ce569eb0910faaf2275d7f373", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257925, "uuid": "014b84d5-482a-43c2-b6bf-1e447f5d01e5", "comment": "Malware payload (Amadey)", "value": "bc7950c5fd76e33d77d898635c05dc5febff8f4a6e9db6220918bd78e7040d64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257925, "uuid": "0f243980-dc63-40ba-955f-27671529f406", "comment": "Malware payload (Amadey)", "value": "52e0eb0f1c42916ab91af51fdf5f4a3b08f69770", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257925, "uuid": "ffc6e316-6ad4-43f7-af86-9c11347a1cd3", "comment": "Malware payload (Amadey)", "value": "f0c36f87568f11e42bab59f171d007b000105c1c5a23e499ace60f87a242713eef27de72f05186deaef55206d87b640d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257925, "uuid": "1f746c9a-96b2-413b-b528-2308a2a38116", "value": "T15F65232BF3C6E032D9B117B504FA1647183AFDC25968D74E23595F3A0CB09A0A1757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257925, "uuid": "077b0082-86b2-4de2-b9c0-f30b4f799e01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257925, "uuid": "f229bed7-83ce-4654-8abc-6789d2ed8f23", "value": "24576:LyNpARv+eryggE92hcCfk0uQF8AQoHgrmOcE9prVvC6dnxP9BfdyESmaG:+Ng2+yggEmOQKoArms1jdDJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684257925, "uuid": "8d77b2a7-66a0-4a55-9531-b9ba2f5bb42f", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684257925, "uuid": "9e94176b-cd41-403b-9653-556be3b3c41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257925, "uuid": "a1f9dc88-eb34-4aee-8291-b1fbaf3c8430", "value": "registry.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71283445-f383-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684198138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684198138, "uuid": "742efa58-2bd3-4837-ac85-b23e97b179b4", "comment": "Malware payload (GCleaner)", "value": "15c9294666b119122e9e90f2a4f24000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684198138, "uuid": "83e2f63d-d83c-428a-8571-7ad86e67b14d", "comment": "Malware payload (GCleaner)", "value": "bcad7ab8fc955f5893df7cb42f31101824f11aca3427d42ef09db45062b19982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684198138, "uuid": "6c0a061c-f733-4077-9602-15f0e3a7bef2", "comment": "Malware payload (GCleaner)", "value": "43a84329d922d307be02a9bf598dbddc70a2b4a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684198138, "uuid": "056111ed-5f38-4ada-89fc-42919a83e103", "comment": "Malware payload (GCleaner)", "value": "037b124dcf9e00f6caaf0089c4c04f6ddc4f303ab64442a6cee9d58a51af09d8059ac44f51ab302f6f78430723f3217b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684198138, "uuid": "cac77e23-f73e-482d-a877-39512a683d74", "value": "T1A69533E572C37AB9F8D78CF20C8387510825BE521025BAC977DCA7ECF7E90916898647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684198138, "uuid": "ed507de3-77d1-439b-af1d-f02fe1827820", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684198138, "uuid": "82d1ba93-4bf9-46d9-8e91-f20f92ba9956", "value": "49152:wDQCHV30K8+nDdDj+tveK2/T2Ls53884g0AG5cx:wz1EjqDVjT2I5388KXcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684198138, "uuid": "dd354097-8072-4e69-a73d-98f9c78e4a20", "value": 2018305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684198138, "uuid": "b77bfd5e-6609-455f-881b-bba59713baee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684198138, "uuid": "9c2f3d40-9812-4b57-8774-726e43e48082", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893ebfe2-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243705, "uuid": "4f15d498-cbd1-4ca4-b4ec-ae4babc9a96c", "comment": "Malware payload (Quakbot)", "value": "b238e6b9499f97291480f7135b0b77a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243705, "uuid": "49678812-6202-4b06-b72d-71fe1529b150", "comment": "Malware payload (Quakbot)", "value": "bd6ac7825dc6636af444e8eb64ca1344ff8544a572df6991b912d9588f9a8e6a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243705, "uuid": "333e216d-f715-45c1-b627-ef262be05b3a", "comment": "Malware payload (Quakbot)", "value": "ec7e0d67e839c0b47be4dad0e8ab250ca84e273f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243705, "uuid": "1cbcfc9c-3a56-408d-9a38-d7f9b77cbdef", "comment": "Malware payload (Quakbot)", "value": "c01936a0dec9265ded74e615bb419ca8647388cd9e13ad093ff5f3d3f240558458ec8c7ba146951c319da5403991a776", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243705, "uuid": "7f57e36f-eed7-4d34-a476-f7f3b159516a", "value": "T14B34559C471229224B6BBC227725E0BDEBB91EB5C2E0868BF45B7215F6DFD0CC8D1125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243705, "uuid": "8e03f030-623b-4b0c-8ea0-5dc849f59103", "value": "3072:5sCrTLGytSZYqEhzSDx8JdS9nKXv1BKyWoXglvd9XbBJdgg03Rsd0IS6:+APSZYXmqdaKXvqyWoXgdw3Rsyx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243705, "uuid": "87af3e6b-020d-48bb-adad-976d6ec11c36", "value": 236642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243705, "uuid": "806f3642-7418-4150-8f2d-4825c7d606a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243705, "uuid": "22d10299-780b-4841-9531-7d711556016a", "value": "Eznrokqd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10622d4-f3db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684236121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236121, "uuid": "554d10ca-0dd0-4500-907c-68bceef5bd0b", "comment": "Malware payload (RedLineStealer)", "value": "72652483b7a61fd7ffd56c302d329e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236121, "uuid": "976a9f9d-9f02-4f63-8f84-6f498d710e2c", "comment": "Malware payload (RedLineStealer)", "value": "bde14637586f65e03996e7a45ca13891ed4725c49bd9b1b95c0b640fba1ee867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236121, "uuid": "c20a36a0-73f1-4d6b-9570-1cd1d6ab9c2e", "comment": "Malware payload (RedLineStealer)", "value": "df640ae625b0323d679c9bef42a60040d089d3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236121, "uuid": "f0570dee-bac8-4c12-bb57-f0eca99f15d1", "comment": "Malware payload (RedLineStealer)", "value": "e0371970e435d6ab7c9e658f8aced044a8db93288433f5779b0f1a7f53c90c45b78960fd86f2b9d97042bfa43a3fc668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236121, "uuid": "1db291e7-32d5-4542-bee0-718ded80a624", "value": "T1F2746C4392A13C50EB254B73DE2E8EEA7A9EB5504E59F7AB12189A1F04702F1CF73711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236121, "uuid": "cb2cebad-5c24-4a95-883c-edae1d5ab3f1", "value": "60946fdd5682e6ea801f7726d24d2022", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236121, "uuid": "3c86aa9e-69f6-4f5e-9ce9-2ef9be744799", "value": "6144:7i/md+dLt44dehXsXcQ/3QiHFFG3k8Gp6hWiBSwb:8R440m5HFSfbBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236121, "uuid": "a82db50f-7d8b-4cd9-bc46-c2155fedae15", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236121, "uuid": "9478b4c4-8b7e-43cd-b5db-ba70cc3d1fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236121, "uuid": "58c5a88f-fe67-4372-96e0-3c0e20ce8a2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2a5c50-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234237, "uuid": "c8e70572-09af-49ed-b488-815bb4d8ae04", "comment": "Malware payload (SnakeKeylogger)", "value": "abb1c9038a0fb3c4c8f8268acad55c73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234237, "uuid": "e26c0a19-2edc-4ee6-9e46-4308dc9e7f5d", "comment": "Malware payload (SnakeKeylogger)", "value": "be1588c97b371b5b329c2ac781d083829b8d93ba95dee3dc9778a772c5d5edc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234237, "uuid": "457ef134-d5b2-4a58-a9a2-783ffefbc5ed", "comment": "Malware payload (SnakeKeylogger)", "value": "445664a01a3cb92ebb4b9a996cc4f386aa6a5bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234237, "uuid": "1e5a1ecc-d539-48fc-b608-044e99c73b4e", "comment": "Malware payload (SnakeKeylogger)", "value": "41d28c9741a69cdf586eb36a8c1e3b889b52d1e57fa39221fd79bcef38cfe882d427f789f93b34ed146ce9c60487f855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234237, "uuid": "757c3422-cc86-49ca-8c33-b186fb4b0da4", "value": "T1DCC4D074619E8A94E41FCBB165BCBC72423134F3DAD5CA750739A284CF6AF142E8891F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234237, "uuid": "31fafea7-ae22-438f-b6f0-576b83c1cd94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234237, "uuid": "b69b4528-32b8-480f-88f3-b7f3beb8ec7a", "value": "12288:VXhnIv5glmAB78+LQ5PEzOJdxROPU+chbl0o9b+:p9U/fcQ5PEz0dTyk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234237, "uuid": "cad57a50-55e4-46d2-a9f5-a8ff402efe58", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234237, "uuid": "fe7e9cda-284c-4796-a4e0-27d54a1db2d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234237, "uuid": "2c32aa3c-be8e-459d-9241-e197f31a3f38", "value": "RFQ NO 45900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfbb693-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233589, "uuid": "013da5c3-e2f3-44aa-86d1-e890151d5283", "comment": "Malware payload (Mirai)", "value": "305bfbd6fdd59442bcffdf70d2024871", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233589, "uuid": "1d86cce8-48f7-4ecd-8c76-3cecc5507659", "comment": "Malware payload (Mirai)", "value": "bf6d111b9d4075b0db41f80c0454368ea79c06d38d84f1aa28e7677263b93f10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233589, "uuid": "0c5be445-d593-4199-b9c5-71583628706a", "comment": "Malware payload (Mirai)", "value": "29083a69d4dc9732a5da1ecb902915a1d7c7b558", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233589, "uuid": "78eda117-c8dc-4883-bc65-d2b5e991d80b", "comment": "Malware payload (Mirai)", "value": "06481e3b0601a80f9e9e157d77d2622dbad64c0da427e410e5a0993a9703f79a28fe52635c76c755c44a003d73f67a99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233589, "uuid": "65c8961d-9141-46c7-aa55-a5aecd3ad900", "value": "T1E6B2D1A48B906706C2B0B476A37C8F975A3B15E0C6F63936272092BCDA8549633FC5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233589, "uuid": "23636a08-86b4-4d20-a4c4-d79b224f3906", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BFThymdGUop5hu7Z:4GaKQFH0rs3zWoDDRsjt7LB9U+BFTs30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233589, "uuid": "eb40db33-454d-491d-a11c-1ffa9acf92da", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233589, "uuid": "eecce6bf-af09-4226-9d2d-63cf368c7251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233589, "uuid": "55e4748e-fd6b-4feb-9a22-3499006dd2a1", "value": "305bfbd6fdd59442bcffdf70d2024871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10554694-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1684235342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235342, "uuid": "1b3a2ef0-17b5-47ef-a627-cb581b1dd16c", "comment": "Malware payload (STRRAT)", "value": "5d411ed66846cdf2eb9be3323a347c77", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235342, "uuid": "be17a0a5-1309-4a41-9328-ddfca27176c6", "comment": "Malware payload (STRRAT)", "value": "bf7288bc39a7f58547d70a4319bf8e3247cc754290eb27318e78fda0e30d946d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235342, "uuid": "7f5e05c5-9d73-4477-803d-b6504685a815", "comment": "Malware payload (STRRAT)", "value": "fcea064c24e977ee04a6f74e47a26d99e826bfe4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235342, "uuid": "cb09eb62-e2da-44bb-acfd-c1b928276c90", "comment": "Malware payload (STRRAT)", "value": "3fb306346bc06e84468e137ec3fae2ea333695b9c95c23a2f3846d5427c237423904d23963f80ec134500c28f73b3938", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235342, "uuid": "f40c6aa6-aafa-4817-ad0e-49731e0b99f7", "value": "T1C724010AACDEE7DED15B1B3605088B32B10C529CF105926F25FD48FA0D78C695B86ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235342, "uuid": "6087c44f-79e9-426e-b498-4a9b5db9f4cd", "value": "6144:LEZlzS35EnYh+JVcHPxrOL4Xn4K4MeVHhr1aNeTHz/bF9:AHzSHJOL4Xn5QXTLJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235342, "uuid": "9dd1b456-9d6b-4b28-9886-6d280b7410bc", "value": 223980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235342, "uuid": "4b5cadc2-59a1-47c3-a858-3002fc3bbf55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235342, "uuid": "1a5ec7f4-4c96-4c5f-b57f-304b31191299", "value": "RFQ 878-3AB and 930-3AB.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab875c8-f3e8-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684241614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241614, "uuid": "46a78a8a-468a-47f4-bc72-4555263d012f", "comment": "Malware payload", "value": "c77caac13d38c99bfa3f1161c1c45dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241614, "uuid": "e1e755cb-da1a-4faa-844b-c9d62cac026c", "comment": "Malware payload", "value": "bf8beeab25f30735fec66843fa380a30b1913b7411f21329d049220c7d7598bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241614, "uuid": "ba0b2766-5ceb-461f-9de3-4439d8782733", "comment": "Malware payload", "value": "5ed1474daa0ea0a592724df52e1972ab881f70e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241614, "uuid": "1ddfab58-53b4-42c8-8f4a-4293450dcf36", "comment": "Malware payload", "value": "6346a3d7696a637d4c8f0fa705efd326cc056a2e40ecc5703969cc5ea6ee23981e193f3186c722294b2fcb8b2df4939a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241614, "uuid": "3eefe9a1-4058-45ec-afce-83eca46c644e", "value": "T1469423A183D2E8AFE18029B02437FA75DF795E8E54815A1753D9CEFB3E326530F191A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241614, "uuid": "97284167-e34a-4449-9224-07cec9389342", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241614, "uuid": "ce2f920b-7d8c-4541-9912-019aec3061f6", "value": "6144:V8dNXSEmIt3bs5f7krvBM/0XuS+6JJ+dYiaxRt7b6UGQXifRAB10GTgjyBC:GmIrsyrvNeiyYiaJfZzxB1qyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241614, "uuid": "62aaa196-8cfd-4398-80bf-ce4bf5226097", "value": 433216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241614, "uuid": "00924355-361f-4197-bc4e-bef665fa0574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241614, "uuid": "7a6aae12-ab73-408e-afd3-2ff5b95ba66c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c139886-f3fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684250179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250179, "uuid": "a12ef4ef-489e-4832-8b5c-0073b95b9afa", "comment": "Malware payload (AgentTesla)", "value": "bfd5198ea6d1a4836801e2fd438d8636", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250179, "uuid": "4573d1f7-2487-4770-923e-e372e2d6e65a", "comment": "Malware payload (AgentTesla)", "value": "c28ad3336a4f9b1cf6009d53c8b35bd6e50521a5c4546c506e119af8a3274de5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250179, "uuid": "ef1cd179-c3aa-4e13-98a2-668b79faa31a", "comment": "Malware payload (AgentTesla)", "value": "e31cab87dab92f6bb0f81eea4dd5afe0a18ba139", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250179, "uuid": "7414c263-3a2e-4afc-9c6e-370cadf7db5b", "comment": "Malware payload (AgentTesla)", "value": "c7fa47b09849d215419ddbf29a6062b4665b3d508db83a4010f9ddf0d47ae606f854baeadbdb6e581d68cbc32d492dba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250179, "uuid": "00d0489a-9c09-44a1-a90b-84a359b9cb43", "value": "T1A1D4D070609E8694E42FCBF165BCFC72037170F3A9D9D9740B69A1C4CE6AF502E8895B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250179, "uuid": "2fc5cacd-8065-41cf-92b9-81431b64abb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250179, "uuid": "f316e206-1ec6-45de-b139-0f8dc023490b", "value": "12288:CY/v5qE3UbeLK37M+5tmRxqsCJjjLVQIIJefl8xn:rkE3UiLK3/mC5aCqxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684250179, "uuid": "49ae366c-6942-444d-9e95-39b17489b280", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684250179, "uuid": "0315409f-fd46-40f2-b707-6da34934796a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250179, "uuid": "a0a18ef6-3838-4805-8d86-c319f0ae5063", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a507aca-f3dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1684236754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236754, "uuid": "453c0ab5-736d-4399-a240-375999266cc1", "comment": "Malware payload (Tofsee)", "value": "9b30c442d1e5f79e00beb59519f49bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236754, "uuid": "06bdfa5a-59d0-4d6e-bfda-05a81bab1ce9", "comment": "Malware payload (Tofsee)", "value": "c30132d930b44ed9f7cbb78be47c9c3fb0bd0d34c3e0548304802c7c617cd185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236754, "uuid": "484fe689-3975-43f4-b111-4f5ab192f642", "comment": "Malware payload (Tofsee)", "value": "e3f97e75276ba3b4756275bc1796396369b07b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236754, "uuid": "263e4d61-db7a-412e-96eb-28d923888f0b", "comment": "Malware payload (Tofsee)", "value": "0b74eb545be335801d35062b278f9f34b9de7734d5476443d745e7eb1cc2d1a0b4d15043e6cf0a1a41b1f4d3ee11d5c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236754, "uuid": "d3fbabde-2fb0-473c-ba2c-0a39a7ab2311", "value": "T18C44194392E17C51EB264B73CE2E8AA87ADEB5504F58776B12189A1B04F32F2C573F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236754, "uuid": "494a36c2-f250-4000-afa7-6ab221a46852", "value": "60946fdd5682e6ea801f7726d24d2022", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236754, "uuid": "c1adb4b9-73f1-4390-8187-72ca6c4448d1", "value": "3072:JoB1eK1AKuLq7ITFIiAq4pe5/kdg82Pd+YzF+UFOFQh91ESuPjco5E5WqFmcJObK:GB1IKuLiITpAqHFo0+oOFO7BI5qFBSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236754, "uuid": "62f8be63-ab6a-4063-9e65-73a2d5d70a02", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236754, "uuid": "0f1d0390-5244-479e-bc9c-b2b68ae61627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236754, "uuid": "c2f96a5f-2fd5-4f92-9d7f-f34f12acf5b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff09b2c2-f3c5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684226723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226723, "uuid": "32530122-6036-476c-af91-97bbe70a9137", "comment": "Malware payload (RedLineStealer)", "value": "066fe8d79a067c7f56821646ea2c4ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226723, "uuid": "296e052f-4ebf-4c37-abde-34918fd0efb4", "comment": "Malware payload (RedLineStealer)", "value": "c33e2dfbf17bb5b1450e775a65c083cdb6852fce4bd31f70ac69f0af3d58494b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226723, "uuid": "e52d370d-a56b-44f9-bf04-5d1bc6399023", "comment": "Malware payload (RedLineStealer)", "value": "d699de8ca24f7a747b6e72f7d631f4f5da51ce74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684226723, "uuid": "9f6aa5f0-fe8e-4aff-9fcf-ba458758852b", "comment": "Malware payload (RedLineStealer)", "value": "be566747d4d8f05715a6f7ccb5bd584914504a077174e3674a0844f53de95b2bfb3755d5b9e319a381c056a32e3a79a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226723, "uuid": "3c126478-684f-43bf-b601-156ac5a39e57", "value": "T1F84523436AE888B2EEF8577108F713830A73BC419D39935B62299D5B0E73685B53533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226723, "uuid": "4a29cd8d-d001-44a7-ad51-361ef0823577", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226723, "uuid": "ffdba773-723f-4a8a-829d-04ab622b3594", "value": "24576:yy3uFTUYNPJxkrvVSkB+jdbTL1w6cImGp9nd/JbQRPXO:Z3MUYNPGNSkKTu6Tnd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684226723, "uuid": "347295a3-e5d0-4bb8-85df-1c30f721c319", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684226723, "uuid": "c4e6b3cd-3517-41e9-8c15-df6439c05fd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684226723, "uuid": "0afeec4f-8415-46c3-bdee-9a1eecbee3e0", "value": "066fe8d79a067c7f56821646ea2c4ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08456573-f3c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684225020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225020, "uuid": "1c3460ed-4f2c-43b6-b030-1f8406dad132", "comment": "Malware payload (Formbook)", "value": "c273dd89ab5301f2ed5f16c37d829c7a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225020, "uuid": "ce60fea5-e94c-48b1-a138-90b694c7a4e7", "comment": "Malware payload (Formbook)", "value": "c36067eb18244174ad104ed9a0ba1f0865a84e71b949175f5928480fc4f606b9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225020, "uuid": "c650ad66-e099-444a-a171-10f6d9039740", "comment": "Malware payload (Formbook)", "value": "0dd0ad9b3fa1837c6fc1da03bb28c9f4d8affa07", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225020, "uuid": "00116255-79e7-429e-acce-b343b0d5ba99", "comment": "Malware payload (Formbook)", "value": "5a9824653724a1022e227c5edafde45c9fbbc132daa6b45cebec8be0ea3eadb9dfd274ced636d016531ea5a9fcbcd04b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225020, "uuid": "3d749614-b53a-485a-936b-24eed0da8b8b", "value": "T1B7845A9239CA71AFDD2F4674035FEAB22A755CD0738248AE4F80760D5C3694A80EEDD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225020, "uuid": "f8aa2397-fb83-4abc-924f-4c6576943f63", "value": "6144:2hRbPZVheNA+ff0qhBh8unGslIMB917OVxFLGEHhmKJuflhDa4xl40s:8Bnhe2erWMoHrHhmKJkLhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225020, "uuid": "7df807ea-5ee2-44c9-9ea3-94bb3ae3df3c", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225020, "uuid": "a4f21771-df25-43b3-ad43-09b818396b4f", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225020, "uuid": "ea0bc3f7-f9eb-4dea-9536-26cd329f4a54", "value": "Transferencia.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4823a1-f436-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684275011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684275011, "uuid": "e37689bd-c17b-414e-98d1-3a667c6b43b7", "comment": "Malware payload", "value": "e438c4379563d938e0bef040e3ff16cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684275011, "uuid": "14e91aa1-70d1-47b7-b488-a39431295273", "comment": "Malware payload", "value": "c3da33eb4710273fa2eb87c35fb3e38ddcede5924641b672c2acc1506b2a6ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684275011, "uuid": "e42fe67e-57a0-45a8-ad3f-6dc197e382ec", "comment": "Malware payload", "value": "510e6639ede57de8edfcc003eae0ba95c2d9e743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684275011, "uuid": "afac85b0-470a-4b0d-bcf2-e417a1eebc2f", "comment": "Malware payload", "value": "91ac87ca8662237b95e45bfbc46d5ce7ab6d7f5deb95d0da4fd0f53c39266bee571b15fe442d93d9e13773859b62fdeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684275011, "uuid": "824b3509-12ea-4ff5-832e-380af029267f", "value": "T121E58D4133E40E5BD1BF57F6A075D16847F2FD5A67A6D38F1D9268AE24E2F008812B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684275011, "uuid": "81e4daed-feb2-4461-98e4-76575c356489", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684275011, "uuid": "e930ef17-38a3-4d3b-92d4-c37fc8d057e8", "value": "49152:ifTdCmejIE61xttujlS6RsOuG1wrFH4w8sBNd/9fBHH:GdCmX/ujlS6uoRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684275011, "uuid": "5f7b59f5-6cfd-451c-b719-7c003819b4a4", "value": 3246992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684275011, "uuid": "291a0508-9708-4567-9deb-1d7885f25bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684275011, "uuid": "f17e75a3-6b99-4ce5-bb26-4b5402595a9f", "value": "KeePass2.53.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c538e608-f37c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684195272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195272, "uuid": "3af8a502-da17-41dc-8fb0-c97d4a8d507e", "comment": "Malware payload (Amadey)", "value": "35a087f3b291e12be485b71df2c47645", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195272, "uuid": "693edc31-6b1e-4c10-b2d8-d298b73385ce", "comment": "Malware payload (Amadey)", "value": "c4ece85b7ab73fd6b5fa0c792b5606a3a57bc6a409e4d2150d4e530fcb39442e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195272, "uuid": "3f60a669-e4c7-4746-b787-060e88446c89", "comment": "Malware payload (Amadey)", "value": "edb39df6fcb34e5c7be8fccf66ba617f9691abac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195272, "uuid": "8d697000-26da-467f-8369-a9d73e7b3d69", "comment": "Malware payload (Amadey)", "value": "5662e538124705a443b46baa146336c9223015ca80850518e57f3134423f8c338132ab9c07967233eb7aa0bd1957882c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195272, "uuid": "989c5ef9-f185-4657-83b2-d3a51e476a2a", "value": "T1EB34AE3232D09471E26706358E66C7E11A7BB8724F75AACF1B90552F0EB02E5CAF135E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195272, "uuid": "62af2934-2ae5-43ad-be7b-622c71ec53cb", "value": "21150e4f7b9effdd3707c48abd03e889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195272, "uuid": "929bfb34-9c5f-4f0b-9153-163159e44c47", "value": "3072:Kp+S488rcafzbl2JbXZNBLi9IUxmacm9ynQVvjTD0b1Lhq3mz2vF3+Z:08ZiXFL8matIQNTQbBhzzFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684195272, "uuid": "d76eef4c-abf6-4207-855f-0ab4035fffd2", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684195272, "uuid": "cf10fd51-2831-43d5-8397-fa9d088faf3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195272, "uuid": "86089ca9-df7b-482d-a6b0-3034a549599a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798780b9-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243679, "uuid": "61bcd56a-c766-479d-91f5-3c2887b05421", "comment": "Malware payload (Quakbot)", "value": "2355e5ad0ace3d93c331c50ebb699fe9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243679, "uuid": "d4b880ec-514b-4e47-b95c-7d89405f3069", "comment": "Malware payload (Quakbot)", "value": "c58500b529512bb44f2ac1f100a25b7d92f1eacafe8862143e2835ecf3bb96a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243679, "uuid": "110d576d-2fac-46f8-be2f-6984dd6555eb", "comment": "Malware payload (Quakbot)", "value": "90609ebbec297d1fbb8f60fae1388bbb67c28438", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243679, "uuid": "8bfc18b9-2b6a-4a68-9d7f-a69d5b886894", "comment": "Malware payload (Quakbot)", "value": "8a01b9bdd07b9fcbfb2494356415c4a80d00269748078ea27ac39d3e97f4cb577f46be6bf7005ed7984a401dd762a21a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243679, "uuid": "c686bf9e-3c74-49ab-9c20-534c3c86a7ee", "value": "T112347398835168728B577D666B30B4A99BFD1AB082C8864BF49F7314F2DF98DCCD5320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243679, "uuid": "27bd26fb-15f3-46e5-aa34-ae6eb695f7d9", "value": "3072:q/P88Ab196EaI43opEzHqBt3O5yiZMy8eTLGROJwXpfAH6YvFCFkfEve61DNQaHd:q88610lupfAaTkMeHMJrj7wFjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243679, "uuid": "a6a7280a-96d5-47f6-a4d3-51e0856af532", "value": 233685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243679, "uuid": "2f9f6ca1-b49e-43b2-9d14-d6f655991352", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243679, "uuid": "f1849a35-2e90-4e54-a91a-bd8c0cbb09a6", "value": "Ljxck.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff36385-f402-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684252843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252843, "uuid": "7b5f7905-a323-4274-a1e4-22fc64c7e8ca", "comment": "Malware payload (GCleaner)", "value": "879f4b2697bd412e24a0384da9c22007", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252843, "uuid": "ff0631ca-ecd1-4aa3-adc0-a6c76b3e448b", "comment": "Malware payload (GCleaner)", "value": "c73a67c6e884304b6f804d26976a9aa2e0ed8c0e684a360ca68f6a661f38089a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252843, "uuid": "983184aa-d94c-4714-b3da-9d9b5f74180e", "comment": "Malware payload (GCleaner)", "value": "ed279c32f547c6e8be279549db145031f56ba23d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252843, "uuid": "d5fc59dd-6a08-4e1f-81ff-bd1718c10ac5", "comment": "Malware payload (GCleaner)", "value": "2291a8f93b1bc989ab5095891193bb801c113b1053dcf51b8251d27625abb3144935a2cdace192549e299dc64117dca8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252843, "uuid": "8e25984f-b700-4e9f-948b-c73350599787", "value": "T19A9533835FA20E72D5820AB1DCA5DB5080B6A2135D68D55F3ABC7DEDB6FE1F06D02720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252843, "uuid": "cffc320d-8b3f-42cb-bba5-ac2f72118dcc", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252843, "uuid": "8d64be4f-d46d-42ec-a017-f1a9011372b4", "value": "49152:Mn2kGLueU4F9nRI9AJm49aP3OtBP+KkawAG5cb:MnnGy94F9RyYg6R+YwXcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684252843, "uuid": "c91bb0c6-6a15-4f6b-ab15-a16c54aa04d2", "value": 2005383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684252843, "uuid": "dc574df5-2221-46f0-8543-cd771850e2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252843, "uuid": "44af1df3-60a8-45e0-8365-541fc28e9d0b", "value": "879f4b2697bd412e24a0384da9c22007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737c7bee-f400-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1684251829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251829, "uuid": "42ddf0b0-62ba-41c9-bb9d-98cdd4fb0d32", "comment": "Malware payload (ModiLoader)", "value": "efcc26a6d153ac602c53793818aafbfa", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251829, "uuid": "35c484e8-347f-45fc-a3ad-1f38500c5e2f", "comment": "Malware payload (ModiLoader)", "value": "c764db08719f686021be955a1342d43816ec436011de939d9e7075c8013b2833", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251829, "uuid": "c7ce7b81-24b8-4f97-8515-89c5b1c5bdeb", "comment": "Malware payload (ModiLoader)", "value": "bdd937e6ed1c13a230ac645efeaf92905b0ca880", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251829, "uuid": "4b2c39c9-fe60-4290-bf7b-49cf0fd744aa", "comment": "Malware payload (ModiLoader)", "value": "cc3c2a2c592910e914bc5ad53a94c7b22d51f76b5e9b36cab1bd76179e8f28bb0727f629ab93c609800d3e950ac1ba66", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251829, "uuid": "000f0e84-5642-4a60-b059-20dbb45d73c0", "value": "T17F8423EF75D54E1BA4E008B3E4A57D09A2B45E0DBF037052951636DF2E228F32778692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251829, "uuid": "dd8ffc32-bd64-4bf4-8580-c25e0189b937", "value": "6144:S+2xnJ2w/Zyo8swinui+XMSivAt/7YZDhnZTy9ZYWcdepcZyJZvcI:S+up/Is/uiUiq/kle7YWQepMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684251829, "uuid": "fe79ebed-a609-4782-bbc7-de0aa955d9f0", "value": 371915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684251829, "uuid": "b253d135-c6bd-414c-8cd0-88daaca3e7c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251829, "uuid": "c2e44cf9-f60d-418c-a1af-31397ed45423", "value": "NUEVO ORDEN 1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e30f41b-f40e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684257860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257860, "uuid": "90e03809-66c9-4582-a0d9-ce7434a270fd", "comment": "Malware payload (RedLineStealer)", "value": "3e29b6ceed99ecaa3604ec4130be35a2", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257860, "uuid": "112ead48-4599-4dfe-9b69-9223a9cc2601", "comment": "Malware payload (RedLineStealer)", "value": "c768057b3effeca841525b10ec52166132ba93566e019989b79fdff2aadce29b", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257860, "uuid": "71420ccd-01ce-4ef5-a737-6d1be8f28fb5", "comment": "Malware payload (RedLineStealer)", "value": "1791b2bd2ca71ee187aa9d6937aa01591eec8de5", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257860, "uuid": "4ff02552-2ea0-47cd-8346-ac6b27b81232", "comment": "Malware payload (RedLineStealer)", "value": "7ce1edeefd9ff8645364f944fa8582fda340b410bda9cce9efd23f1e44aa46720f6368dbcb098d127b37da8f51a7afe1", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257860, "uuid": "7fd76b7e-e6ff-4d58-9c8c-b19d3b4fda90", "value": "T10D452343AFE84112ECF15B7012F316DB0B727CF25A6056173781A8AD0DF2699E87637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257860, "uuid": "1d7544be-db9d-414b-bf5d-d5ef90b2773e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257860, "uuid": "a88d26f1-eefe-411f-aa27-d62f0c659f01", "value": "24576:LyOoDqiySPCSMZilP4Iuc8DytAj5WsIpZbNoM3E:+J13D5+eAjoVpZbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684257860, "uuid": "e0896f34-b1fd-4eaf-ac4c-3346e9ad3239", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684257860, "uuid": "44c7e338-f8bc-4c40-8317-3a4299e733cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257860, "uuid": "9969a8f9-9e9a-4f57-85bc-d9b5586991ea", "value": "CanHazCode.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73414b61-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210167, "uuid": "8cc45ed4-f5df-4f5e-b5ca-aa4a395096c8", "comment": "Malware payload (Mirai)", "value": "e51a521cc6acda2516e69952c48884f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210167, "uuid": "b9d79111-2f75-4e19-854c-463f33a1a38f", "comment": "Malware payload (Mirai)", "value": "c91d79c6631d5d16de7a54f00c47d101edfc8c895e7febd05aa6fa71d74d396c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210167, "uuid": "f76e4e4e-6e71-4ac0-8f9c-c05974b6f129", "comment": "Malware payload (Mirai)", "value": "b344e2fc14bf9ab4a044425bb3fa25a0f50d2e89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210167, "uuid": "e9a002ce-796d-423e-941e-5c8f4f1b1f97", "comment": "Malware payload (Mirai)", "value": "fd2b20a477e48a456c61dcbd4dc922e64102b5362aee57593c58eb8187e4e5ceb92dac85e5bf63c8c59fba58d46cf234", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210167, "uuid": "b64955ce-1a58-40b3-a46d-784186dbbc74", "value": "T17AB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210167, "uuid": "c7bfac92-f94d-4931-a7bc-70088d2a775d", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZRoamm/QcuLB1niDNb:YuFX0GIk1MHyphWamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210167, "uuid": "f2acf9a3-2fc9-4863-b72b-a576a7b53428", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210167, "uuid": "0221a1c8-278c-4fcf-a760-6b4dd44f410e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210167, "uuid": "0bddae2b-ae34-4822-a5a7-ff7e16788c9a", "value": "e51a521cc6acda2516e69952c48884f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dda8441-f409-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684255631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684255631, "uuid": "f1cf509b-aee6-48d5-8681-14a83e0b324a", "comment": "Malware payload (GCleaner)", "value": "f5d0ca9f52138875795dbdee6eaa9de0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684255631, "uuid": "35dcd5aa-ccd6-4808-aff1-577c6b8866e5", "comment": "Malware payload (GCleaner)", "value": "c9ebce956fc5e83fefcd9512e6e76bec83d34991ac602983452859350605fb3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684255631, "uuid": "91cff7f6-6069-499d-a1a0-2560080ee5a8", "comment": "Malware payload (GCleaner)", "value": "471c5bd8cbfbff2902e9dbc5fa38e20b18be365d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684255631, "uuid": "6e6804f1-548f-4be1-93cc-30a66cb8dca8", "comment": "Malware payload (GCleaner)", "value": "31bd786b62e0e96ce9dd6336af981f595179e0a6da27a25df770eca0cf829cf31dc0377884f830f992203fa72690e0b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684255631, "uuid": "01be149b-9dbd-4f2a-9f5d-97e0d865d80e", "value": "T1259533623269AE38F743C7B40C57B50089BB7D66447BC89837A8092E6F7F46DD888713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684255631, "uuid": "4cf7c11f-6447-456d-9052-1b740e86ba23", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684255631, "uuid": "d04bbcca-5ca4-4022-82e2-53e7741ea684", "value": "49152:svUliFViGVOHunNis4NaizkPD90GqJCAG5cP:sYiF7seNi9kWGuCXcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684255631, "uuid": "39016056-9ff7-42bd-a1e1-da70ed563d9f", "value": 2054837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684255631, "uuid": "392b8e8d-73ed-4666-beb9-8e36e7dc87cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684255631, "uuid": "67d5a105-54aa-451c-ba56-1b498f2ecce8", "value": "f5d0ca9f52138875795dbdee6eaa9de0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa2f835-f3ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684244601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244601, "uuid": "d22a2c26-85ab-4a42-bff1-01fd2cf3ce28", "comment": "Malware payload (GCleaner)", "value": "57ec00cde231a93b2d34cb154cbc9f41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244601, "uuid": "4fc8469c-8e69-4a50-8929-b5ba340cf3de", "comment": "Malware payload (GCleaner)", "value": "ca070a02e64d3db2af40a3c182f1a3ec94c9164e5f1525f33594ff241036f399", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244601, "uuid": "bfb0ff4e-02cd-4363-aa0b-98e3dee844e5", "comment": "Malware payload (GCleaner)", "value": "7ca411d23e07f5a0bafaf1ee1a9c575cb37f3cec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244601, "uuid": "91e4e786-89dc-46e9-99ad-303053503158", "comment": "Malware payload (GCleaner)", "value": "c44ab48ab361cbe04dbd85fea5ee124f44485e058b33787cd7ec047c10e7d6318ea7de916dae399b0d6808ebf794a79f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244601, "uuid": "32ce5de0-aa00-4306-a305-30eb1ed3f5d0", "value": "T1A495334F50B68AB9E2A69C705CADEE55C8B778B31934040DE3C21FCEAB96CE13485F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244601, "uuid": "7c70f099-9da7-4f84-b6d8-274c354cc011", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244601, "uuid": "198202e6-6581-4da9-b4c3-815e9a414d6a", "value": "49152:ckVACP+umAYTaQU4MdV2Do6qFglDyVktvMzrSmBL8AG5ci:c0P+uiGQcp6qFgxLvMzemBL8Xci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684244601, "uuid": "9722e4a6-619f-45b3-a1b1-b828d07e55f9", "value": 2001955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684244601, "uuid": "d9ccdbac-b445-4f90-8890-bb8ea4f0ceb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244601, "uuid": "69c4b276-07d6-4fd1-9070-4ece1b3dd3b7", "value": "57ec00cde231a93b2d34cb154cbc9f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1165b4-f3fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684250340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250340, "uuid": "644c83ae-22e6-4998-b773-ce00a2d09dec", "comment": "Malware payload (Formbook)", "value": "7e15632b5a8b73c85f21e9f335e736c6", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250340, "uuid": "4797a850-033f-46bf-9227-2a3a2be8f365", "comment": "Malware payload (Formbook)", "value": "cb95c84c76d9fab78e073b407d225cfb678fe4ad7ff5091c2a4543ba7f81dbe0", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250340, "uuid": "bcb4a455-6dbf-4e05-8723-26e3fd06bf12", "comment": "Malware payload (Formbook)", "value": "0f9fc6361000f375319034455086e1191d534e17", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250340, "uuid": "6f92c6d5-b352-49c9-b6bd-775a1fbf201e", "comment": "Malware payload (Formbook)", "value": "395d700935516f42007836e9f228c5cb7afb58486efedf4f164ec9819fd8cdb3261c76627ccd2ebe7589ede07dab48e4", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250340, "uuid": "1cdd9e6c-ac16-4902-89e6-c5b9e29be414", "value": "T1D3B42389F17F15A3FC466F460043355B81724A2FEC5B030590B68BB26E6F2BE4FA5A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250340, "uuid": "a1191cf8-cb8e-4b59-bbc8-76ddc285d1f7", "value": "12288:33AD0iWZuvClM6KSoqGMqpKa4xkgY2oc17Z/ApA3ZIzC60ACU0WKb6s:/iWkqizSoq+oFY2P33y0ACLWDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684250340, "uuid": "62ceb78f-d901-41ff-8270-967b797bd1c3", "value": 535142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684250340, "uuid": "3de2cc14-3607-4535-9561-321bef5b8f92", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250340, "uuid": "6ca3e30f-317e-479e-966f-d924597c77d6", "value": "Purchase Order_231313_20230.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f6288d-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkTortilla)", "timestamp": 1684232073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232073, "uuid": "aef46474-cb1a-4c60-9c4f-a5d4c40882f4", "comment": "Malware payload (DarkTortilla)", "value": "9a5e8c738264d80cc74543cf56f36025", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232073, "uuid": "26b0d480-ad57-49c7-afee-548ab46f354a", "comment": "Malware payload (DarkTortilla)", "value": "cbc037ff8f5cd121fa517e02e79d154dbd05f495f197822671bd980ea97dca5b", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232073, "uuid": "c3290e24-2569-4da9-a1a8-d275c5a16eaf", "comment": "Malware payload (DarkTortilla)", "value": "3eb21086378880c2fa31262c440614516130fef0", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232073, "uuid": "0828adf7-c2c5-4e1a-bacd-04f39e9a5a00", "comment": "Malware payload (DarkTortilla)", "value": "09649333eded3ad2a237a28897450eb59ca68c99509e7eda677c80c6b087900048b153eaef8575ae9a662da6ad0f3289", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232073, "uuid": "93d02620-8ec9-4f7e-97a8-aa020eca2843", "value": "T1B985333211DB1CDAE162BD75A7C0B27ACF6DFA7F062FA4A55481479E952F8C0DD00A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232073, "uuid": "24bd2662-fe29-4363-af41-9ede1dcca38a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232073, "uuid": "4d44267c-e611-441e-8be7-89640faa0bb8", "value": "12288:E4/cOS13ZjYXegrTuXXlC+pEXdOMnrtd9AIJMf:EFIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232073, "uuid": "4003dfb7-be5e-40ac-8e39-6dad54201aee", "value": 1799680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232073, "uuid": "d69315d2-3298-45e6-b427-2be0a6f61548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232073, "uuid": "b8e913c8-42e6-4ab3-ba04-a734dd55bc55", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b872235-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684235360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235360, "uuid": "d38d1707-365c-4bbd-a459-783e8789ef1b", "comment": "Malware payload (AgentTesla)", "value": "1b952b0cc1ce6a54c8f5a02852e43d5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235360, "uuid": "cbf0c4b8-9031-4ee9-9e93-2d4eccffb2f4", "comment": "Malware payload (AgentTesla)", "value": "cbe733c88b4d67dc50ab4dcd96b0d0d60241261553954fa3eb41fd8b0d63b634", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235360, "uuid": "831d0fee-6967-419e-9f6b-e339e0694701", "comment": "Malware payload (AgentTesla)", "value": "a3772dcc9e5209dfdb75c7f7e9ad9b8ab03ec77d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235360, "uuid": "6b8e6467-6872-4d71-a2e6-a1e9d15ef9d1", "comment": "Malware payload (AgentTesla)", "value": "4ebc1170df352672753df181be52266a347d4e3ad45fd79964116532d3121ad5d10448b8d23ff3c6a79f73f9f68f3aee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235360, "uuid": "3a79c01f-e434-4b46-8ceb-710e83b796be", "value": "T11673A4FD1FDA4E3AF5E81A79AC590397B7B8AC059843F30E2A0574F40EB77D90921291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235360, "uuid": "fddab6d0-af8e-4531-8064-bf1bd30c0b24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235360, "uuid": "a0d86bca-3ae2-4bad-8782-67c17923f8fc", "value": "1536:EDZ2TMxMoPOVeIBQ8JTuGpAJQYY4Xo25SfdU:EAMxA623AoaSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235360, "uuid": "3d218e36-3c7c-4d0e-b9ba-5586f2a2501a", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235360, "uuid": "a7876498-d7cf-43f5-ab89-70f5d60150b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235360, "uuid": "7b2dbb97-5477-4da1-b48e-d43f23c51e01", "value": "ordem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98be4a84-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243731, "uuid": "1daa2fa5-da7d-4c5b-af01-0975cf0d9746", "comment": "Malware payload (Quakbot)", "value": "9ad40be016a771623c743a21a332c1fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243731, "uuid": "561a833b-6969-4bc3-bac3-f3bc512da7fb", "comment": "Malware payload (Quakbot)", "value": "cce0ae8d8db23493d60ac5277f2a780e2f991a08a129e899852a5db91c725e7e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243731, "uuid": "c3efd641-0e9f-41cd-8fae-2a46ea695680", "comment": "Malware payload (Quakbot)", "value": "0b0956429e8d3017b94ee66654bfc1c3ad3e880f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243731, "uuid": "925303ef-6feb-4925-afac-a03fc785f8b0", "comment": "Malware payload (Quakbot)", "value": "0c0249450d0b16a20b2a3e253ee53bae40fcfb4884a4322f983475d21c9b0e50b010d00d5a079d3e171ba17e5dd293d5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243731, "uuid": "7b75626e-db00-4413-993c-dd435d0ce12e", "value": "T12A1448E84F6228624B4F6D367AB0D1BEEB691E54C2D0488BF89B31B1F5DED1DC4D0A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243731, "uuid": "32460c80-137f-407b-9313-50f169442289", "value": "3072:oIn1vl2w9+Cfj2hcWaK9ikZqzbXTGVnmWMDAiMVH2C:oInpl2w9+C72hcWaK9ikZqbRfDAiMVWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243731, "uuid": "eb81cc15-1a0d-4b95-8d43-54558a5e10eb", "value": 208752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243731, "uuid": "3373090e-c108-4447-a082-f7f93e5b76a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243731, "uuid": "387fef4d-95f0-4fa8-8a98-ed630b3a5b52", "value": "Nfcdr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d16ffc8-f3d0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684231229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231229, "uuid": "bb294206-a784-4d47-9ab3-ca9443d93a38", "comment": "Malware payload (RedLineStealer)", "value": "788891daf03e0ec0bcd464bc5772e02e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231229, "uuid": "783d63d1-26b8-4cdc-9908-2e205b0aafbb", "comment": "Malware payload (RedLineStealer)", "value": "cd4f920fec7fda949ee2029e95f33b34b6d6a6bcf584a8e9532ca86ab93911e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231229, "uuid": "f5aa2101-ad35-4982-bc14-64658770ce4d", "comment": "Malware payload (RedLineStealer)", "value": "0b3207cc6b828d239cc0931ceceafc7237f2de0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231229, "uuid": "2ed3020a-b188-4490-af81-0d4cb4bcbd9b", "comment": "Malware payload (RedLineStealer)", "value": "1f40ee6d0a0dde7f2aae68b66a986f6415c54bf3ab056dd4724cf4e3b95ce68361d3e5954424acb8756f60ea8cc58f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231229, "uuid": "010477cd-599d-4c26-a1f5-37d121b25d2a", "value": "T14C452363A3E8A033E8B9A7B058F707C307357CE06C29825F3B51B49D987369166753A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231229, "uuid": "7c6b2fea-c556-4c2d-864d-8a34673db790", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231229, "uuid": "371d49bc-1a73-4376-9e46-57f3897454e9", "value": "24576:Iy1UWqGkWLMJIy/SmKJdtsHu9CNDy+5rSyKRDdkEJT71N2kraDoK:P1UfyyTQJdt8KCNDtKDBJTpbraD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231229, "uuid": "27b243c2-76ec-41cc-a8f5-5f70ef80017c", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231229, "uuid": "8d5468ca-347b-40de-88bf-a2896f34a280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231229, "uuid": "dc3bbe1a-7d17-482b-8924-f9d4566b48c8", "value": "788891daf03e0ec0bcd464bc5772e02e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042ce216-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684232315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232315, "uuid": "92adcd50-ef09-42b4-b6ba-863ac6ed18e1", "comment": "Malware payload (Formbook)", "value": "c2c5608797a537b3af5a4b1ef3898490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232315, "uuid": "8584057f-0425-49ea-9ef7-2dd4caea416c", "comment": "Malware payload (Formbook)", "value": "cd94bb8956e12aa67943b6bb657f17d2680b848b36f8726283a2037d1d588461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232315, "uuid": "811d2157-ada9-42c1-874f-d11cfadbc027", "comment": "Malware payload (Formbook)", "value": "c98dabb52ab26eb5d3d7ffafaad37835f790b3f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232315, "uuid": "379a0daf-b450-4cdf-84ad-d671020c2c0c", "comment": "Malware payload (Formbook)", "value": "05f46e3931c75ee3423e82079cee43a4ee0014b4b5b7764459494ebbd73fe7a95e807e75a240e823c65ece5671b3da88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232315, "uuid": "0fa0159d-77b0-4f98-8530-fedfbefe52c7", "value": "T1E0D4D17010AE46D0F01FCBB165B8FD72023270F3A9E9D9750B6A91C4CE67F506E98A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232315, "uuid": "cdcb2bb8-3e7f-4660-b4ae-54ef9e7b7232", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232315, "uuid": "725f75fe-bbbe-46e5-8ba9-89bbe0e4fada", "value": "12288:gY8v5iYGiK+n0wC2Pf8GTG8K5gm+IFwo3vkOdyaC/dmkG2QRKHGcsdb:ukwCGNQgm+8lvk2K86kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232315, "uuid": "f82c7929-1472-44ef-8b95-c386367db6a0", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232315, "uuid": "43007b1a-94ff-45f1-a5bf-ce63c3293847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232315, "uuid": "154c5432-2dd5-4342-b354-c6959e3fdcb7", "value": "ZAINAB JASSIM RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7385f983-f3e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684238085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238085, "uuid": "396c592d-8a5b-4b03-833d-aea3f747c4e3", "comment": "Malware payload (Amadey)", "value": "219e2fbea7714bcdcea230c0218278eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238085, "uuid": "360ffa6f-a5bc-44ff-b56c-7078093bbb74", "comment": "Malware payload (Amadey)", "value": "cd9536263c3d901bd2581658a95431cb9f77d14939cd66402087dc39b06434fd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238085, "uuid": "8e6e0ece-f23c-4418-865a-d5731928f832", "comment": "Malware payload (Amadey)", "value": "0373b0538c98c344fbbbcfa03f9ae0b488aabc55", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238085, "uuid": "93e0acf4-9df4-4d87-a192-554abf5e6000", "comment": "Malware payload (Amadey)", "value": "37587e91419d8e891918a421d5bc37079fc6ffc7ae437302ffcd5f69cd18b118f9d8ffa440c6138f4d0d60cce931d5f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238085, "uuid": "f3b2368c-555b-4fdf-968a-20bf800c3260", "value": "T1A1452323EBE955F1D4BA27B12CF613870A3ABC108878C7AD2D54A80B1CB27957172777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238085, "uuid": "2c2c73c7-e9f7-4972-8540-96313915ac3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238085, "uuid": "ba858f18-a20c-4519-90f2-16957845c34d", "value": "24576:AyRGHA11fFdhcMfoh2u6P0jcjXJPgAw/sIKsSPQmc:Hs21fBSyen/s/slm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238085, "uuid": "aa3dbf8e-1cc5-43d3-9b8b-437a236405f1", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238085, "uuid": "4cf22ad3-c453-445a-a7fd-89ff50fdbe6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238085, "uuid": "95b6f7a7-b779-4241-b958-706c0b508894", "value": "TurnItOffAndOnAgain.py.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafa6f49-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243761, "uuid": "03e3cb56-a940-4db4-88c2-4ecb1d97cdef", "comment": "Malware payload (Quakbot)", "value": "058b13ee6283f2f2a21ee5a9a8b832ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243761, "uuid": "4bd2d127-9c4b-41e5-a0ea-d789d254b809", "comment": "Malware payload (Quakbot)", "value": "cddd3bb0edb790759ced30ec3c67359c1c233c1883847cb56ed8da89c7e5ad0f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243761, "uuid": "ff58c7e0-79de-4e8b-8d8e-d27f2ecb9e6a", "comment": "Malware payload (Quakbot)", "value": "0fe7f2f81a1f33432d70f1f9925caf9af0429b33", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243761, "uuid": "f04932d1-65d8-4013-afc6-7daa176c3315", "comment": "Malware payload (Quakbot)", "value": "c61a40f93ab32ec5593423a7b4ada1f94bef4734237706c758b6075a93bebb35605984011c67689c5ddbaf3d8845abfe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243761, "uuid": "df7d296d-c3b4-46e9-a46d-21cbe6ed2c9a", "value": "T188448690431528A69F5B7D36AB21B5A1EAE91EB4C3D0838FF88B336572DF60CDED1510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243761, "uuid": "574503af-b5b3-4b50-971e-0a602a107a64", "value": "6144:Sx0TA1oaDKzWpseMaaMijdFilXWsN67pLNWY9b8cjMViEi6RuB4WqPg:SGLz4WV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243761, "uuid": "74d44106-ccb7-4257-a0e4-888d2905dff6", "value": 276938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243761, "uuid": "e256753a-1778-4c8f-876f-881251477987", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243761, "uuid": "f8ba80fa-7cc6-4fbf-b466-e4941a9787f4", "value": "Qaacje.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b7fe41-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232685, "uuid": "4b4f5697-5041-431d-af98-3529d85f8b05", "comment": "Malware payload (AgentTesla)", "value": "cbbed27bc3cfba04a905ed8c79a39475", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232685, "uuid": "14a7131d-7a27-4fab-a59d-1a7f22d3fb55", "comment": "Malware payload (AgentTesla)", "value": "cf599f4ac8687578eaf120368869e271c425962b9af352d6b206c9a238e8000d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232685, "uuid": "a3a6ec7e-8aad-4189-a765-c6f91c3f2e82", "comment": "Malware payload (AgentTesla)", "value": "08161535644583cc802a420f47132228a06924ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232685, "uuid": "7761073d-5f28-4110-9d29-74a231fe7aae", "comment": "Malware payload (AgentTesla)", "value": "bbd039d0f065afa697d7f4fa87b7c405d506f7a0ec8873da983052397ceef4ebc2c5d3208183ce81c1fc9db4f2ce79b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232685, "uuid": "22f0c6ef-3230-4509-ab5b-01adb94dccc0", "value": "T1F4F4F17060DE49D2E01ECAB1617CFD7202B170F3ADD5DAB4172E9184CFAAF586E4894B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232685, "uuid": "086dc6a1-d400-4886-8976-0f51f741e7e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232685, "uuid": "082712ac-fc78-411d-bf9c-ea7276ef8926", "value": "12288:Tqev53+XiAXs7rMmQBgWRS4NShawWieGZ5pnBl0LYldlzM+t:d5+X5uMmQBgWRlfiDpBlbPlQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232685, "uuid": "7da94025-b89c-4eb7-af62-42546bc4db44", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232685, "uuid": "a3389f01-6932-4bee-be66-abf823650fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232685, "uuid": "852fe3cf-e4ac-4874-a3a8-0b26ec5f3ed2", "value": "epoDTL977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb76a89-f3db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684235877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235877, "uuid": "f7123c9d-f641-4bf1-b5b9-48a1ef281593", "comment": "Malware payload (GuLoader)", "value": "23ac589b6f73b49d983c7bc11a844eff", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235877, "uuid": "7fdf34fd-44cd-46bc-88a0-a993ade46adf", "comment": "Malware payload (GuLoader)", "value": "cff95e5e1d6c497b0262c0f9cfc62cdddde0ae225e485bb866d105d5529bb1b9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235877, "uuid": "f62dc547-2bd6-46b9-907c-712c935f0c8a", "comment": "Malware payload (GuLoader)", "value": "8e1e089570f581156170c337c1a9662b5f4541d9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235877, "uuid": "d82034cd-52e5-4fb1-a4f9-2c55a9312d32", "comment": "Malware payload (GuLoader)", "value": "5567c32b410bb339b32bb26147c462ffde4ac00b5325855743504740603fff0fd7b61865fadd5977c75ff3683a023bbc", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235877, "uuid": "e3bca1f1-65e2-45d2-997a-b6b200842f6f", "value": "T1A04502133AC4B0B3D04E29712AA3D646A674BF116AE15707375D7BAE0F38F819932D5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235877, "uuid": "5f4313e4-664f-4571-9aea-0b311837cb07", "value": "12288:WEu4mI4d8CgrgCQvQyflYebLk0oLydotPuq:eJ6veJflYeHkQdIuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235877, "uuid": "2c6a5054-2ad1-47e3-9832-05422f0c7102", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235877, "uuid": "033338b6-3571-4c8a-8391-8a91673da389", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235877, "uuid": "1ec50bc3-8b9c-4364-9c51-b8dcea6cce0c", "value": "Ordine_0117291.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1ce28d-f3d5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233565, "uuid": "c43ec684-4e08-411a-bc1c-1ecadf88cd6e", "comment": "Malware payload (Mirai)", "value": "342bf063b6ce388a3d50922cf5c95f1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233565, "uuid": "d2dd8dac-05a8-41cc-bf00-7848470819bd", "comment": "Malware payload (Mirai)", "value": "d0ed49556ddefb5286fb051646e3b3e25e974775d9f496ca91df5d203c9bd519", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233565, "uuid": "cb193e34-b156-472b-97ba-e0c986afd027", "comment": "Malware payload (Mirai)", "value": "0f507404e0321b83f043b4d2cccf6760a52c2dce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233565, "uuid": "35da5e17-9152-4672-8673-dc634aaa3d69", "comment": "Malware payload (Mirai)", "value": "4bab1170b2a2d9bda8d140903ab68cdb21ea98580f51edbb04dc2ec16f4d99d7e223797fc9eafe5808144399caa128f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233565, "uuid": "752f748a-88c1-4d9a-9b71-9dc166c13528", "value": "T1A1E2F297C371A492DE786BF1F96E85CA2BBC4BACD53730A31601672829570539F2CC93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233565, "uuid": "7405df97-dc4d-427c-8b53-856db87bcb54", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9X1dKVL9q3UEL5Im:Porm1vpALgUJ1dXL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233565, "uuid": "1e8fbc16-a6d2-4049-83f2-fb580ec898d2", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233565, "uuid": "00f87a00-5e8b-4f56-921e-60fd86619db6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233565, "uuid": "e911f7b3-271c-40d6-adc3-762b28808883", "value": "342bf063b6ce388a3d50922cf5c95f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030bfae7-f3c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684225011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225011, "uuid": "3af5c773-ab01-4053-8283-aa7b7fdf8b52", "comment": "Malware payload (AgentTesla)", "value": "e7b4f70e6a8446474295e56bb95fac4c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225011, "uuid": "c33cc94b-e1ab-41bd-a1db-af6d07a49965", "comment": "Malware payload (AgentTesla)", "value": "d1817dbc61bde07efc096a55c25876bc2af4152ff79f86eb2a12a636aa61c3d9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225011, "uuid": "88208f5c-aed2-450c-bd74-b91ea5b4a4c9", "comment": "Malware payload (AgentTesla)", "value": "fe3c68570645cbf56e3fa2ef01b5f52d1f6163b6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225011, "uuid": "9b8a595c-515f-4e10-b644-eae135afa770", "comment": "Malware payload (AgentTesla)", "value": "648c2c2127b90f741d029459c06d1d0b600c450b76dc98e74b9f3adbc56efa15c857883c7df6d8271cfb545641eab3ee", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225011, "uuid": "49694f55-c013-4e87-ac75-74193b171f79", "value": "T164F4333C68C4AACD9564CDB1A7B0F308C7B02E11363A44D57AC9B04B29989C6DFED7D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225011, "uuid": "9da1de1b-4cc6-442c-b5ac-0e8647212a48", "value": "12288:PPybELNJG2sHuWnipSmIjLNkE0dMvq8hAQ697z9c/S5VcSbDgdXBWcLOr2uvPRfJ:PtLHG2sypH2kiLhcf9Rlgtgc6auvPRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225011, "uuid": "6b20fdbf-9536-4070-9f37-cbc9e8d85ef6", "value": 782663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225011, "uuid": "b20dc145-4fba-4624-a440-d5fa2284517c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225011, "uuid": "e5297341-7d1c-4f6b-8da4-7424cc5059d5", "value": "RFQ FOR MEJDAFxls_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468d1fa2-f3e9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684241875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241875, "uuid": "703fd098-caec-45b6-abde-a2179f65c66f", "comment": "Malware payload (Mirai)", "value": "f565b1dc8dc7e05404e64087c5e1be51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241875, "uuid": "eae218af-2edc-4ee9-a1e8-638c77863f42", "comment": "Malware payload (Mirai)", "value": "d2417150a6cb32d412b50333edd31842d1ef5f5e455601823cfe9606b9cee11c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241875, "uuid": "8f667cd3-34f2-4830-a965-6321545e8f28", "comment": "Malware payload (Mirai)", "value": "0bfbb5681abc0d8ee786280c04156389d1f11c74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684241875, "uuid": "6b450b7b-f810-4897-9c58-370df7150826", "comment": "Malware payload (Mirai)", "value": "238788bb2b70904fec88a143898a56c53eb13565de2e86ea70a918b700140d16cc3558f677c6a4bdd73ecd1e706a1983", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241875, "uuid": "e39f3a9a-f1a5-4a9e-9ec8-92b241da67eb", "value": "T116534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241875, "uuid": "4578db09-e030-4090-82ab-0c9816b27ab6", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/MyV8SpXCpEMea/J9KCrMvuBxANUr6FV+tMiwWbd:MvolWm+l1pXgdjKCAWBxANee++bWbvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684241875, "uuid": "8cc1615a-9629-496b-95dc-bdd412ccb03a", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684241875, "uuid": "20c64234-57bf-4a02-bfe7-03882d578f6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684241875, "uuid": "4ba438a6-c173-4f6e-aa68-d53915115ce5", "value": "f565b1dc8dc7e05404e64087c5e1be51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24aed5c7-f3e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684239241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239241, "uuid": "6b60c0c8-510d-49e3-ba82-d7484bf1297c", "comment": "Malware payload (Mirai)", "value": "8d5c4b25e6208de9fef99513d16f4b48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239241, "uuid": "9b4d10e3-5031-468a-b3fe-24ab37fcb904", "comment": "Malware payload (Mirai)", "value": "d27cbf89aa22ea13ad1bce7b81ae19cb681addc1283bf3c1de0b1d5838e7ca8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239241, "uuid": "b4f649f0-05d4-4f29-998e-59464b06a653", "comment": "Malware payload (Mirai)", "value": "fc30c78bcff4b640b03a372df6e80e1bfb41cf03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239241, "uuid": "2a6c338e-efd3-4fb5-baec-d2e46b6ba5de", "comment": "Malware payload (Mirai)", "value": "bfabba50c29520517cf81626ae702ab74bbc33ac64351175a7359de962e858d2d02a867d9118409a54c606b08f46bb37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239241, "uuid": "ddc3d370-5a6b-4861-be61-a0e7ac3c62f9", "value": "T1B363B61A6E628FBDFB59833447B78E21AB5823D527D1D641E25CD6002F6034E681FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239241, "uuid": "f376b0a2-8087-4278-8008-f9b65856d47b", "value": "768:bPWek0n4CjdGQKKWgmg0EhFkFkeYA+QofxXyApGqFDjOZ2uyyQ5NeNTP4wnKIZ:bj/hTmmjAofJym2Uu6eBPZnKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684239241, "uuid": "d2552182-70f3-4ee3-822a-75d978bc9dac", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684239241, "uuid": "c94ff900-ed12-48d6-9d93-2b2140f1fe1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239241, "uuid": "6f447230-cd5c-455d-a0d8-e6c7c6655a52", "value": "8d5c4b25e6208de9fef99513d16f4b48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604cad97-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210135, "uuid": "c6961690-4b47-41f8-830d-69cdc377f872", "comment": "Malware payload (Mirai)", "value": "6c29225ff2c54bf2ee9b78bfa4c79657", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210135, "uuid": "873f2451-bfef-4835-91d4-d004a450a670", "comment": "Malware payload (Mirai)", "value": "d3b84ffdce97451380545fc74dde608bfcc3093f26843776b72b1f2dd59a4d00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210135, "uuid": "db7173d4-fa85-4215-8d85-734f2def4346", "comment": "Malware payload (Mirai)", "value": "8c9ea050b2b9e6e0c7d87ccc59f69674925e852c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210135, "uuid": "a58bf33e-bb39-40e6-b3e8-cfe0d56a171d", "comment": "Malware payload (Mirai)", "value": "d9204482868fc70a197c3994a6f7881737799ad63a9a6f821dc75ab0e180cc938c5c714a36ec8e5b6db4383cc4feb243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210135, "uuid": "2571f849-0b34-4274-8f71-afcb46aa20cc", "value": "T134A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210135, "uuid": "992ea980-a2d9-4e57-b217-b347dce8cdda", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fkHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fkHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210135, "uuid": "4f24f2cf-d17b-4cc0-9f4d-951a00f3acd5", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210135, "uuid": "191f70bd-7a2e-4219-9ac5-2d98fe0c8257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210135, "uuid": "713fe558-0afa-4a50-8a3a-9a2793e37e35", "value": "6c29225ff2c54bf2ee9b78bfa4c79657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d06e6d-f391-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684204370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204370, "uuid": "11efdc60-17aa-487b-837e-61b656d53146", "comment": "Malware payload (RedLineStealer)", "value": "59321d95252021e52ffba58396172b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204370, "uuid": "c48cd0a4-dd93-4d1f-ac58-91df993b9e2f", "comment": "Malware payload (RedLineStealer)", "value": "d500ea1a07cbb42d50931a580888925858bfc12434649b3bea6cbb6449a2ce8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204370, "uuid": "a635dc09-520d-4dbf-bc6f-8d0bf4a5ae43", "comment": "Malware payload (RedLineStealer)", "value": "0d6b4ff95b085d4aef7e63007008b1daa1853679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204370, "uuid": "a2a147dd-b277-401b-b8f7-96ce7eef57a2", "comment": "Malware payload (RedLineStealer)", "value": "6aaf90bb62ebc2945d5a7af1cd6dd94093f59f9d1f623cb5ea7ca7c3e20acb6de34d67b89046274e07597c87c1e08cd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204370, "uuid": "69b27696-9ac2-4b52-9ea2-b1c71a880e3c", "value": "T1814523129AED8A64C9F06774BDF712831B31BCB548B4C32A2755898E0C733E5693732E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204370, "uuid": "3cc84c6a-218f-430f-b896-bc65254b7341", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204370, "uuid": "2a969756-f3b0-498d-bca3-2153e940936e", "value": "24576:Yy5fitsGbhvIY/S7+4IYNyRfo8rahwZCv5KIlidYji5Uf6KU:fFitsGbhvbjhQ4Y2gQqrjiWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684204370, "uuid": "3bec8c6b-b00d-4241-982a-ad9d01862740", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684204370, "uuid": "7fd478cf-e67e-4e3c-ba73-a1f7ef27793f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204370, "uuid": "86da21f3-79cf-4ff8-98ed-aae56b29d4c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b369b99-f37d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1684195578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195578, "uuid": "a8b67e13-b424-4159-8e74-be922d4fc9a6", "comment": "Malware payload (CoinMiner)", "value": "1a0aa2a4834e1fbe2da672a2dd629c92", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195578, "uuid": "4a0ab66e-a2b4-443a-9eee-7bea40fd0ce1", "comment": "Malware payload (CoinMiner)", "value": "d5178474cc5b93e7f726ae674f20d2b3faffdc7bf6c498bac28f14e9857cc459", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195578, "uuid": "8fa65a84-e979-4654-a663-ebc9ec5a6437", "comment": "Malware payload (CoinMiner)", "value": "78f861410e03a72115005cdb54214af6189c8c4e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684195578, "uuid": "3c71b8a2-5609-4575-8259-9a448b5bba1c", "comment": "Malware payload (CoinMiner)", "value": "b9646f1e9efdff482760b8f48e29da6f9e6f54bfdab9c84fc632e820854c973dd98056ea38b37334bc7d80a065e3ee66", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195578, "uuid": "b9245350-5598-42ee-afc0-e070972aa6f2", "value": "T10D34BE1272D09072F26706318D7AC7B15B7BF8716F65AADF27A01A2F0EB52D1CA71306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195578, "uuid": "d84f146b-08b3-48ba-9c99-179abb82ec64", "value": "21150e4f7b9effdd3707c48abd03e889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195578, "uuid": "caa53a67-8f7a-423e-b703-4c9af6f01338", "value": "3072:Ap+d48tF8JfG1R2povLjuV6wsUx5zDIXU83h+tiS16gfN3VVEEMp3VJZ:dtz3vOVh53I98tOgF3NMplJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684195578, "uuid": "dfa82400-dab0-454b-b4d8-81d715895523", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684195578, "uuid": "48c55fc4-2deb-495c-a1ee-bdd216739b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684195578, "uuid": "02b2bf1c-5133-4aad-a6cb-81b7e86d7830", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e840945-f3e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684239258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239258, "uuid": "d3d5b043-b57c-437d-9ee7-10324d55e11d", "comment": "Malware payload (Mirai)", "value": "f91284c8d4fe0c546318f5cb81f0a5b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239258, "uuid": "812892a2-1f7d-4fa5-b79f-6e1ce9bc3156", "comment": "Malware payload (Mirai)", "value": "d64d1482bf2db039c700a8cbf570624314a48ff12049c0233092ed4252c1c6af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239258, "uuid": "944f4d97-23e1-4104-a75a-a588b46da374", "comment": "Malware payload (Mirai)", "value": "c93d28ec6fe4e4ef771c02eea227c3a90dd924b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239258, "uuid": "c206db7d-a829-4282-8193-42135b9acfd2", "comment": "Malware payload (Mirai)", "value": "77e8fc54e5f4962bd598fff7cda405efc8ec6a3c74a0bfeb7b775b155cbcd19da13f40b3806ba59ee4d82df136e10717", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239258, "uuid": "97194581-dd99-4a30-a222-274060266da3", "value": "T19473C61AFF620FF7DC6BCD3745A8170239CC554A12A47B3A7934D828B65B24B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239258, "uuid": "7be40cba-da1b-4e50-a405-871c3eef0a1e", "value": "768:K3sJmkqElhWHgJvd8p6Ef5Des4ReDB2wJ2iwgugBI2ZpMIXi5Ij7+eOcIoJhwneS:KcJmk51w5B4RcBvC8W2ZpMe7+pcI3ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684239258, "uuid": "b26b1b31-7010-4973-a031-7c004b61e524", "value": 73796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684239258, "uuid": "4677644c-cea7-4ae4-a23c-5a9890fe0c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239258, "uuid": "4da6daeb-c01c-425e-b228-bc757ac761f9", "value": "f91284c8d4fe0c546318f5cb81f0a5b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2a071a-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243742, "uuid": "497740b2-8f5d-4d38-bb85-1c7a03819789", "comment": "Malware payload (Quakbot)", "value": "7fa4cd6abc456b227f41d429720c5f4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243742, "uuid": "bcda38f2-49bf-4545-a494-8f68fecd77c3", "comment": "Malware payload (Quakbot)", "value": "d730c09aae25eb5a35bebaa5842293bfa0012aa62a3405319dba452d024df5c2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243742, "uuid": "0920bcd2-232e-4bc5-a1a7-b57e90cbebf0", "comment": "Malware payload (Quakbot)", "value": "e478b4cda0ca0876d6dfa88191234e0bbf13ef2f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243742, "uuid": "dcb6b735-361e-4e8d-8b0e-2a73a6753a75", "comment": "Malware payload (Quakbot)", "value": "b4ddc76441964da31b3b860b3437d2a77548cde3dffa607897334c68034205477406c0fe03a9d078e40691e80c0c30e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243742, "uuid": "7dcbed4d-ed8b-486d-8051-da702b647a6c", "value": "T15F442090434558B5AB5BBD26AB30F5A19AFD1D70C288838BE88F3355F2DF58CDED5220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243742, "uuid": "8d8f2751-c654-40d6-a989-38f179a1148a", "value": "6144:FZA6rJD8H1W+B7iHyTUbTgmUUPsqAb8v96TA6M+:nh+5T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243742, "uuid": "9e23c810-9050-4d21-8719-392cd17e54bd", "value": 271783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243742, "uuid": "5e536d44-1f6c-41d0-bb9a-4f9b736acf9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243742, "uuid": "3031bc14-ea2a-46d9-b8e5-a14ac4f16407", "value": "Pxzarz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03042efa-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233601, "uuid": "ce4ad400-0253-407d-875c-bec0fe72105c", "comment": "Malware payload (Mirai)", "value": "b3299aa80ff8c90cdf9164e387bb9a80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233601, "uuid": "a682207e-393b-4484-b2b7-98addf34b4cb", "comment": "Malware payload (Mirai)", "value": "d7c8d91a4ad627db8d689e604d89017c62f7b7aa0a1445a3fdbaa4075cdf2dda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233601, "uuid": "0cf024e7-2d2c-42d0-88f2-0c4acab59137", "comment": "Malware payload (Mirai)", "value": "fa966e041a3661859e019c4b423a9c78538e32db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233601, "uuid": "b4e310fd-0b83-4f52-981a-1174931317bb", "comment": "Malware payload (Mirai)", "value": "7207f9acfe9c877d1d02001e5f9511dbfe9ac77568ed2cfd91b6a208cbdefa19e11b47aac13f724df5aa705b240f8f5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233601, "uuid": "7e38ec53-f1f2-42d6-bd30-7979bf9f8a22", "value": "T12263F6B8350AF2ACE9E9A178F4432DF2295106183EDDD1D3B0479036FEB6788A56DD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233601, "uuid": "8c4da0d6-99e9-4c65-8f67-b9d23fcf5ce6", "value": "768:pIV2CrRexHy+AQxGXyg1l8v+rVDl1bc1ZdlJFro0IRKwQ+DhaFLQWFzftLyBS0:pHEAk8GigRTbc1ZfJGk+DhaFLFFVLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233601, "uuid": "e94c2840-5f2e-4e54-afd4-24697b064737", "value": 66988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233601, "uuid": "e8bc5c53-f6b3-469b-9e7a-77d4d22f01f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233601, "uuid": "f95cbecd-75f3-48d2-b7b9-c95cd55b9d62", "value": "b3299aa80ff8c90cdf9164e387bb9a80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14c57b0-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684234296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234296, "uuid": "4fd61769-0779-4bbb-805c-41f24fd3245c", "comment": "Malware payload", "value": "74428f91a5ce455721f2c07d64becaa4", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234296, "uuid": "f172990f-a2fa-487d-9ac4-3640783becc4", "comment": "Malware payload", "value": "d7d264e937a60b73741ab7001a362b2e58b90540d3eab5121a6cfac66bf67ad9", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234296, "uuid": "7c6ad22b-87ba-4010-90bf-493e6e367596", "comment": "Malware payload", "value": "4833557bd10805ce2a8e26fc16c9cf2e861e0737", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234296, "uuid": "6b2b145a-439a-4f76-9abf-269b6d797c02", "comment": "Malware payload", "value": "ad026e5d6c6bf323a5c6c56a62e4f18dfb8f4ac5da9e07091a53e5e843706bdac959d3781ff777af2a3868e34f1f55f1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234296, "uuid": "ae220e04-6fe8-4a14-b582-4a21eb3b8297", "value": "T1A254EF137600CF43E415C7F57F838DAA1B06FF12999278D724923B8F6B7095289DA26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234296, "uuid": "be2a5159-8ce5-47db-820c-f4917c6a31e4", "value": "6144:c2aFJkKXiDU7w5sZP+zr3BhMof0P95d6nhVdH8qMWlDBOyZ6eP1VzOswVM:c2aFiKXKE+zLIof0Z6h3HJMfy0e3yvVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234296, "uuid": "1359963e-79e0-43b2-88d3-82a6078a6cc0", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234296, "uuid": "de282c8b-4996-4b88-a410-7372364b5a16", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234296, "uuid": "ff380efa-0d3f-43c2-b931-531423f2a3df", "value": "Document HAWB R129724.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62afc68b-f3c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684225172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225172, "uuid": "248fb61c-ebda-446c-95ce-20ff151ef73a", "comment": "Malware payload (AgentTesla)", "value": "13278604c15ed4348d9930adf07a4581", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225172, "uuid": "20365c13-b3d8-426a-9197-d3b0be48e639", "comment": "Malware payload (AgentTesla)", "value": "d8c7505747b616cb5973d7afafacde6ce281d838cfe3c90d6192fc26be5e8165", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225172, "uuid": "41a1955a-ef27-429e-8546-3f4af67db0b0", "comment": "Malware payload (AgentTesla)", "value": "bc06c033b8c2ac5216fc05ff3e0cc38ae554076a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225172, "uuid": "2715f842-4b9e-4cff-8306-f71e41291bda", "comment": "Malware payload (AgentTesla)", "value": "8fb7c72d0132868485e19147b7d8c13555d8bf05c4a0fc86ee17a005d811dbb6129d9e7a8f802490b900ebf62090aa7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225172, "uuid": "f50ccc25-6563-4778-9992-9e47480d2c35", "value": "T13DE44E3D4AA6C9EBC0BBC3F49BCC5A5BF97C9837B5449A2F44C60742624164EA1C60DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225172, "uuid": "678e0ab7-c60f-4967-ac45-c22fbfe57e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225172, "uuid": "8972a57f-2f07-4503-989c-275738e60f85", "value": "6144:aEAYdREgD8PS4N5I/jSqZZBrlfw/3ZPlqC3o3lxbP2BpAt1cEmRcrKjd9qSjNAsN:28bD8PSljS8Zbf4l02/AmRtxUAZHj8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225172, "uuid": "aece171e-0689-43cb-b570-a3fc4fa141fb", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225172, "uuid": "8de5679a-0fbb-4d8a-88d8-2c0feb738f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225172, "uuid": "e0209246-8995-4f5e-8fb5-1c06267e6f59", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84d0c29-f3cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1684231006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231006, "uuid": "f9f866c1-1f15-4e7c-8014-c2c785392e1b", "comment": "Malware payload (NetSupport)", "value": "b43c763750aee030732bacbc95c07ac3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231006, "uuid": "6c42e8e9-8052-45da-a147-6d27efaf83b3", "comment": "Malware payload (NetSupport)", "value": "d8e72bd2a42a9b6902f94dd22ac19803f6c5ce8e4fced2c65029538d6c394ada", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231006, "uuid": "75467690-1a1e-4e33-a88c-a9a1d6d491bf", "comment": "Malware payload (NetSupport)", "value": "94b8f97c65515fe160c918c588be25fd8f53947a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231006, "uuid": "573ed332-00dd-465c-bc09-230c6d64f746", "comment": "Malware payload (NetSupport)", "value": "6cbd06cda7650698a5d3617767df9473708460d7d8681c867bae73f61a568adcb3b9f064b7b9f2e918eae29a883590f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231006, "uuid": "1ed1b06a-f7a4-483b-9388-7996f39d5f6a", "value": "T145E2D98836D3B052935BF07A675E8C85E66949130BC56D0FB81D6178FF86C3CCAE47A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231006, "uuid": "7415ed45-823b-4668-ad52-31cec54cf72a", "value": "384:N4w9rfGI2F5xE0iammRlxSdMOOJDyFu3+harJ5xHsuPRrweSYkZrmRQaKuPUZEvr:NBhfj0JBUM1Dyw3zLsuPdwEALe8Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231006, "uuid": "33759049-8687-4da3-8f63-491ff9e4a85a", "value": 31239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231006, "uuid": "9bf1e0ab-b357-4625-8192-a6195042a6a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231006, "uuid": "923052cf-355a-446c-9a88-b43b4ade13b3", "value": "doc4233595_6191429_44.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1fa9c2-f3c1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684224621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224621, "uuid": "33f5d39f-8a16-4f71-b6af-d5c23b16fb93", "comment": "Malware payload (RemcosRAT)", "value": "022922748c81a0d331f30c24187aa41a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224621, "uuid": "da8a97d5-73c7-4182-86f3-32ceb04c7a6e", "comment": "Malware payload (RemcosRAT)", "value": "da38425cef4712b8fd31378e6576d94f01707bc7e52b6f70d782f7dc9c07e876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224621, "uuid": "5347975f-34c7-4c4c-a849-da3a7718f3c6", "comment": "Malware payload (RemcosRAT)", "value": "4bb11dea1d0a37ed395a8422fd6551f7c930fb89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684224621, "uuid": "94a56311-18f7-4c77-8ac0-b28f9d4695e0", "comment": "Malware payload (RemcosRAT)", "value": "7e1458319b9f6d75c8c165219abcbae3497ed3b590e62c1cae014d3afc19c455ecfee7a88ecdea30cf65d63207e191f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224621, "uuid": "a9ef4465-b620-48d2-b44a-afb88f843d40", "value": "T1B2057D1AB1D2A933C1A37B385C679B04641CBF29182BF95337DABE4CDB36A423C15D16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224621, "uuid": "d551b26c-7fc1-4767-b608-148b958b065c", "value": "b994e2b35fac0eca9b95949a165480a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224621, "uuid": "db514297-1464-490d-a260-ad8f70e7e1e2", "value": "12288:IEaSIJxsS4ISFSs417nXbaGBazVb8N0K1Wqp:/F0mcSFS77LaG6VIEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684224621, "uuid": "375c3906-cba9-43dc-8ca6-c374993d1d44", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684224621, "uuid": "a9469126-163b-483a-ab86-12c68e491175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684224621, "uuid": "b975e5ae-328f-4d93-8bd9-64ec144a9bdf", "value": "PaymentConfirmationCopy0010933736483339882836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bab7e4-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684233787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233787, "uuid": "48590314-dd37-4912-9b78-b4f7b28f2241", "comment": "Malware payload (SnakeKeylogger)", "value": "0a979daf08e1f12735ca18f8601d1920", "object_relation": "md5", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233787, "uuid": "06749565-7b3c-4ac6-8501-8e33b31f2cca", "comment": "Malware payload (SnakeKeylogger)", "value": "db1514e42b561d3851aa327b612b8075d4b9387eb054dff98a7b1fe026238e35", "object_relation": "sha256", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233787, "uuid": "20c08328-2bfd-4cf2-b070-e82f32816471", "comment": "Malware payload (SnakeKeylogger)", "value": "714cf11831454271880b9983d9cc8e919c7143f0", "object_relation": "sha1", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233787, "uuid": "494455ff-69dc-4379-bea9-0c98ec09806c", "comment": "Malware payload (SnakeKeylogger)", "value": "062b7b1ea25125139a903ddfd2d49967247f78bb0a1ce167fabe33cc8b4096d9f8a035b6c9694d792dad39dcf185547e", "object_relation": "sha3-384", "Tag": [ { "name": "CaixaBank", "colour": "#413AE4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233787, "uuid": "02381bea-4593-4099-9e6a-79331ff417c8", "value": "T115C4DF7011AE8694E41FCBB165BCFC72437234F3EDD9C9750B29A180CE6AF546E8894B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233787, "uuid": "82e8c10e-db78-4583-a499-b7673f08a323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233787, "uuid": "9c30ac2e-adff-49c8-80f3-2d823f7f0672", "value": "12288:aP5n6v53N9pBoQepc3FvfN74EtgqXH837X8:yFWxpB5b3RfsqXH07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233787, "uuid": "ce1b4475-8501-4b14-bbf1-5874d215367f", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233787, "uuid": "20d550b0-8a5f-428c-ae62-0716256e7f55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233787, "uuid": "4090ccc0-36de-45b2-b4ba-2666af4db580", "value": "CaixaBank _ banca digital CaixaBankNow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f87447e-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234240, "uuid": "bffc8015-0019-4e65-bf21-16ccbaa443c4", "comment": "Malware payload (SnakeKeylogger)", "value": "45950d601f097e45a0172605c0330c4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234240, "uuid": "cccc9689-e7fc-483e-9430-2531506712ef", "comment": "Malware payload (SnakeKeylogger)", "value": "db5a4b5c89e2984ac0be6e61a93dcd9ab7bb42d81ca6083b4388ae962ec6ea27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234240, "uuid": "d86b8fb3-52dc-45cb-b6c6-81bac155a0f1", "comment": "Malware payload (SnakeKeylogger)", "value": "87efedfc68025377d2c7cbc530860c2a9b61348f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234240, "uuid": "54bb98dc-1d8d-49d9-a6ad-cdc99ae0612f", "comment": "Malware payload (SnakeKeylogger)", "value": "b98423a5326f80cdc6f35ab4a01eef8789a11204b89bbe741dfd16cc0614723fc7876bfec2c1a25cf92d8158fb097492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234240, "uuid": "e45a851f-20cc-4ba8-8e49-80983b5cef9e", "value": "T184C4D070609E8A90E01FCBB165BCFC7242727CF3AAE5D9750729B184CE76F502E4895B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234240, "uuid": "e64c4409-a52b-44cf-b446-519ccddadb52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234240, "uuid": "6dfbbee3-3f00-4e9b-96e5-6fcfe17a7244", "value": "12288:j3fn7v5ObNZ6HRzjYlFJmM6WFjkpIeqVaqqm6Uj:7PDyNeBmFsbvLm6Uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234240, "uuid": "e699b8ab-c370-4203-ac8c-8af2c647dd5e", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234240, "uuid": "889cd0ba-0c80-44a3-bbab-f90d0b853cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234240, "uuid": "2d65b780-1290-4fdd-a612-7703be3a2491", "value": "PO No. SER-RUB-0523-01-NS.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bcd989-f3f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1684244967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244967, "uuid": "162a7f1d-5f6e-4e46-9d01-d01e27c6f33b", "comment": "Malware payload (LgoogLoader)", "value": "4e8a9976b9268a74f55550915cc9c48e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244967, "uuid": "a51a7e88-050f-45aa-9d14-3a15277652b6", "comment": "Malware payload (LgoogLoader)", "value": "dc112ef61e884bb66de28fd0b6aeccf134daf61017c6e72c9cc5cbfe587a57bf", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244967, "uuid": "b36e5038-cb5e-47b9-bce1-6b5b91e2c28a", "comment": "Malware payload (LgoogLoader)", "value": "39c669c302c498911b80f6c00ab48592d31f4f77", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244967, "uuid": "3fbd1abf-19e2-4b43-b809-5d8e5bd57704", "comment": "Malware payload (LgoogLoader)", "value": "44b30b686fb0431ac2612b98cdff5be154caed1930680c36b2f688439afe5521ebf73328756f15d4fb3e12ec37278e1b", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244967, "uuid": "859cdcd4-350d-47a6-af23-fb12650ad254", "value": "T192656B2039FA501AB173EFA54BE474AADA6FB6733B07945D2051038B4723E41DDD2A3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244967, "uuid": "0d5472a2-1269-48af-9799-615d21c976d6", "value": "24576:XAxiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiF:XAxiiiiiiiiiiiiiiiiiiiiiiiiiiiiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684244967, "uuid": "6882d7ac-dcb9-4f21-ad55-54e0b1f3de9a", "value": 1511800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684244967, "uuid": "0f2932c2-0004-484a-bf25-88b26576befc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244967, "uuid": "8e42fd28-206c-4e30-a4e9-457977b56605", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfff386b-f39a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684208202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684208202, "uuid": "93d78331-14e7-492c-ad50-3f033837f1a8", "comment": "Malware payload", "value": "c28a65abf719b7abdf34da2ee31175a9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684208202, "uuid": "c571b39f-ac19-428a-83b2-88afc26e0eaa", "comment": "Malware payload", "value": "dd73dd9071385d6f7e58972955128e0fb7ed14e69eec8fad060598b65a7aaaef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684208202, "uuid": "85f59f41-c764-4621-91a2-f6631224f0c9", "comment": "Malware payload", "value": "d8299972e8ee6dda3bf279f3d6a833219fb3d1e4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684208202, "uuid": "04ba5ba3-2518-40e1-869d-c95f52262e31", "comment": "Malware payload", "value": "1939e0e68ebda7c7c5b210dce0d5bcec015309507d33c35469c306cfba74e473bc1be452a547872725da6f0bd014478f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684208202, "uuid": "628e77d2-3bc7-4a82-bc72-75e5391f4ed1", "value": "T15D8733BC7E6832D438FD503D51F59CF927A7A80E2B81D130263DF3816F59698AEE5881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684208202, "uuid": "f432b134-140e-4f80-b479-58e20d3f821b", "value": "786432:EqPXqPhqPJqPJqPiqPHqPgqPwqP8qPiqPtqPXqPnqP+qPQqP+qPAqPJqPHqPnqPd:OFT2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684208202, "uuid": "380f727f-a473-4c57-b279-dd6d15d6cead", "value": 36963018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684208202, "uuid": "1d6da549-1918-4353-aca0-2edc6f4846a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684208202, "uuid": "83bbe629-f973-4d83-af18-5a681a1b7d10", "value": "Album_Over_Night_Girl.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de04984-f3d8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684234532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234532, "uuid": "84411335-5ad5-4542-a4a9-0bffad0c0cd5", "comment": "Malware payload (RedLineStealer)", "value": "a73540107b755d7381b6a9814b338c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234532, "uuid": "28bc5cd7-2abc-42a4-b121-c3b869986c35", "comment": "Malware payload (RedLineStealer)", "value": "de231880b05a6073784ee84b65047399f9183740b4514b16f721e82ae93d440f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234532, "uuid": "61b98db3-98a6-4858-bedc-19d027e50aee", "comment": "Malware payload (RedLineStealer)", "value": "d1d82a13b8bbf7b84f4880b9bda0de8ae570bd2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234532, "uuid": "b235ac12-c237-4f27-9476-bbd186e387bc", "comment": "Malware payload (RedLineStealer)", "value": "a508ec6fcebbede5f7345f26af967993f1e12c998e800ee4e9b22237b65d94a958468e86cecca6eff50b2e1fb02495ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234532, "uuid": "f6d18fe7-464f-4e60-b5c3-85ec07be0718", "value": "T175452306AADC8172D9F5077058FA1B8303327DA11D3867AF3399A91B0C727C8697677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234532, "uuid": "d061028f-b6c4-4f7a-a89d-ba86fc68c18a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234532, "uuid": "1087bf67-e827-4f65-b012-4e39846c9d8f", "value": "24576:rygfH403m0F5aVda6JfGvATAhm5jdD4xMVdWk3+3eMxI:eaY0jQV4mu0Ah+jpB3Qx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234532, "uuid": "f9eb34cd-5052-419f-bf06-e201ba43adac", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234532, "uuid": "cccd8f18-f9da-45d9-9862-7cb6a560c9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234532, "uuid": "e1be1d8d-4ce5-4424-8249-00f535aed0c8", "value": "a73540107b755d7381b6a9814b338c4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdc3ba4-f3f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1684246717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246717, "uuid": "85acf7b7-35f7-4256-ab96-b28c4be29c0f", "comment": "Malware payload (Glupteba)", "value": "7fc2add67a63bbbd82b96951c8209f1c", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246717, "uuid": "1ad68c1c-13ef-47e3-879e-40ff4cb5c234", "comment": "Malware payload (Glupteba)", "value": "dee253eb6d34ae0817711a085370cc16920bafb6b2ce0e26dd3e588522b68b45", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246717, "uuid": "e9ef0a7b-3e9f-43f6-b249-539ce715134a", "comment": "Malware payload (Glupteba)", "value": "7789b7a4427e9f45de7059e4aad1da00a8af6dc0", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684246717, "uuid": "379cc7c0-feb3-43a1-9f40-30ae4be842a9", "comment": "Malware payload (Glupteba)", "value": "1876aab2df0d334458f7059309d9abc233f3478edb662086237b8a7fe51a4d90520e3b7ef669488d3c20c79ebcf1bc80", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246717, "uuid": "7ecc728a-da77-425e-befb-a370e4468165", "value": "T1AC16232792903C55F2638B720F2ED2F87E1EB6429E1967AE12649E3F01B05B1C1B771D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246717, "uuid": "70ac23dc-9ebe-43d5-a0d0-4b08ace49bcc", "value": "c3a2d6b32d97c9ca2070467dc08d5fc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246717, "uuid": "015f0b7e-7940-4358-b4b1-00332b98721b", "value": "98304:f444JB7KkyPVW2PefyRigvmMxSwsgSvBa/jxLTOkpMKFiJ:sFKkovPefxMxSpzBK17ptFiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684246717, "uuid": "166e904d-237e-4580-ae33-a360b1eb74a5", "value": 4365688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684246717, "uuid": "a9038e9a-8065-46cf-bdac-938899f4c86f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684246717, "uuid": "570131c3-199e-4685-9f9f-d7e453e1049f", "value": "Unlock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076d2efd-f3c2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684225019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225019, "uuid": "c2512985-575d-4a86-ace2-8de180de900c", "comment": "Malware payload (Formbook)", "value": "7372b378ebf5045e01c1fd25982235e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225019, "uuid": "e4c33d60-99a1-40da-b56f-b3c058ae3a8e", "comment": "Malware payload (Formbook)", "value": "df58322b2a0bb94b05101e0139e92fa8fdd9b6603b3cdb4f4bf80b6353d587c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225019, "uuid": "8d83bfb0-f54e-4205-af99-bd425b48ec11", "comment": "Malware payload (Formbook)", "value": "9c659d4b71286e06ef17b5e81ec1b1de8d34d328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684225019, "uuid": "207ed3e0-a545-478f-a563-5092636ab577", "comment": "Malware payload (Formbook)", "value": "2f47bbe71a09fbb08d89c8acd0382353d43b9efbff0c79160ac34d7d7b2bd0645fc1744175aa794d3fee452617ff58d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225019, "uuid": "b12c7f55-c5b7-45ca-ab40-abd1bf49fa85", "value": "T15A845A9239CA71AFDD2F4674035FEAB22A755CD0738248AE4F80760D5C3694A80EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225019, "uuid": "96197c6b-1df0-4c38-a36a-3adebd28827a", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225019, "uuid": "428dea59-e314-489c-b03a-7347f8c38d1e", "value": "6144:7hRbPZVheNA+ff0qhBh8unGslIMB917OVxFLGEHhmKJuflhDa4xl40sq:lBnhe2erWMoHrHhmKJkLhsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684225019, "uuid": "c4fa36d4-a2b7-4844-8c01-b13832c4ed11", "value": 399467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684225019, "uuid": "e1b80d10-f1bd-41d9-8afb-42fe6ab6e7c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684225019, "uuid": "a26312fe-0aba-4559-938c-4f05fe8f224a", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9eff68-f3d1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684231529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231529, "uuid": "6e466c6c-4b48-4df3-b205-973968797947", "comment": "Malware payload (RedLineStealer)", "value": "294d179d83f7b7d09736d4d154b6b5e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231529, "uuid": "4068c20d-9396-4406-ae43-cf335f4f4d25", "comment": "Malware payload (RedLineStealer)", "value": "df5cf9f1b720208eb9bc689b74aa5c8f9c96d93dac00e1350c730f248af6d566", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231529, "uuid": "4f202c9f-941d-48cf-aba3-e57ac4fe75c9", "comment": "Malware payload (RedLineStealer)", "value": "202069716691c2a0572165e2ffeda7c623530cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684231529, "uuid": "49b5a50b-9134-4864-b6a1-f6398dcdb820", "comment": "Malware payload (RedLineStealer)", "value": "24593793deca32bc05b2e28b968bac455e7bae6093a4b05eec9be0db419a6a3715382b7065d4d0626114e357c147a5f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231529, "uuid": "ceab150d-1c50-4e2c-93f3-b0d58852b65f", "value": "T1CD452246A7D98473FDBA577029F506930F327CB5ADB552EA3289A81F0C366C8E830747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231529, "uuid": "aa2d11ec-db43-4126-a310-bb507d92b6f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231529, "uuid": "41cdea46-5add-4c06-8cd5-57b8bf0c9480", "value": "24576:zy2JOdBuxbf0NCZ2NcktMy4/BLFlI1vuO5y6TZrqkDg:G+dfQg2NcCM5pqGS2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684231529, "uuid": "c61eba18-0c0d-4553-af60-ebd82a6c4927", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684231529, "uuid": "230b8dea-34b2-4662-a979-a0997483daf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684231529, "uuid": "407baacd-b05b-44b1-8ecf-834104ab7e59", "value": "294d179d83f7b7d09736d4d154b6b5e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbf20e1-f3fd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684250423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250423, "uuid": "ede2ab4c-2d94-4a60-a38e-815757f08f93", "comment": "Malware payload (AgentTesla)", "value": "3178d5fdc2c4d5d40d1347982415f650", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250423, "uuid": "d978624b-73fa-45ca-99f6-820112f66641", "comment": "Malware payload (AgentTesla)", "value": "df93f9ce611ac7eaeec6d5eb825051fc46def0644bc78e70f317e852f01655d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250423, "uuid": "aaab31af-c034-4cac-96ab-58c68e881195", "comment": "Malware payload (AgentTesla)", "value": "c9b688fae2b4ebbf195f7d73a1a89423c099ea5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250423, "uuid": "4e92098b-1e04-4255-9e74-832c56fd95f5", "comment": "Malware payload (AgentTesla)", "value": "cb24f567cffcc1a7c67cbe49dcf459cb57a8ef51066ff5218f51838c9c2609e9229ebd65fd650e3db78b9390cf0af653", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250423, "uuid": "8eae6094-951c-4661-9932-c92b804c489f", "value": "T1B21571394AA689EBD17BC3F49BCC4957FABCD833B454D92B18D60382224174EA5C21DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250423, "uuid": "6ca02793-fc8b-428f-96aa-f806c03eb10f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250423, "uuid": "842b75bb-cb4b-40b1-a532-2b3723e8a57c", "value": "6144:RHRrajp5MTGSadCYtS4N5I/jSqyCEnRdF5RzWT1+EId81jxtEUKJJOCpx1sAQ7bx:RHRrxGDSljSVHf64d8pxtUV1sAUwIiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684250423, "uuid": "db96a440-2cca-4a12-a845-55eea35d5e2c", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684250423, "uuid": "85e68836-23ea-43b3-b5c1-6f3493b72582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250423, "uuid": "05ea6287-563e-445e-9e14-f5f46c7ccf7a", "value": "Order No. I20220052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea608c4f-f3a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210797, "uuid": "f5314ac2-7429-456d-9158-6c8a8b474044", "comment": "Malware payload (Mirai)", "value": "bf0e9256b88e0afbf6d952e2e137156a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210797, "uuid": "b0a5e03c-e01d-49e9-8423-63acf7d8dc87", "comment": "Malware payload (Mirai)", "value": "dfaaef0fecb960c1f372d8004897e363a4016394e7d11e27f367efadf94ffc6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210797, "uuid": "edc378dc-9d82-41e0-bfa9-457b8c4e40ff", "comment": "Malware payload (Mirai)", "value": "d0219d574b24b9745e12edd2861a7080d792221a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210797, "uuid": "0f59412f-4237-45b3-af44-5452a4e2ac18", "comment": "Malware payload (Mirai)", "value": "efa600650ff3ec9414c10edeb48d9939807bb8b88d4e2055016ff30ff53ee4bd94b49b745ea2d3ad7355278048dcaf40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210797, "uuid": "9c2d1bbf-6dde-4f04-878f-1096919155e6", "value": "T13DE3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210797, "uuid": "a7624bac-0701-46b0-a977-03da1682f464", "value": "3072:JW6dm9tS1aRGQdK76t/zC9I5mrThPaLEnvPrNb:c6IG+LCCmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210797, "uuid": "19494891-05d9-4351-b065-d23215fd060e", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210797, "uuid": "d18810b8-8ca8-4982-aa9c-950148351727", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210797, "uuid": "2d8f71f5-f7a5-4a60-99ab-aaab78a94616", "value": "bf0e9256b88e0afbf6d952e2e137156a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57d106a-f400-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1684252020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252020, "uuid": "44327bd3-b5d0-4448-a0b5-79e3fc96e783", "comment": "Malware payload (NanoCore)", "value": "89c3b6e04296f5b1e625f8b46893433a", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252020, "uuid": "7992a76b-f440-4c33-9255-63a0d20f4a96", "comment": "Malware payload (NanoCore)", "value": "e1064b1cd43da52ed5a322160681c715530b57ff843ec8b5c83098d02a99c38c", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252020, "uuid": "2eb0a3f2-a009-45e2-bf6e-be4b99ad6e30", "comment": "Malware payload (NanoCore)", "value": "db3481ee5a81decc65c88e36ec8705ce1092e217", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684252020, "uuid": "13bfdbf4-cc5e-4dd4-89d8-5da8b8120996", "comment": "Malware payload (NanoCore)", "value": "8f0b4ef050abdb9a73bbeee3573d146f0a98ce50533fdc1773385d61207436029388cc43915a384584aae30600be1024", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252020, "uuid": "e1a1402d-f5a1-40ef-927b-b7cdf98970e9", "value": "T1245533B7128D3613431B42A9D7A64D4227BF4D34D2591B6F1A82F2B0ED6A31BF680737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252020, "uuid": "aaed5b4a-fada-494c-b570-72f64b4f3200", "value": "24576:NrQ75KHg6k+9kQvoilGM8R1xBLOBOt7OOFnV2Kvqz5dZjbjQYankOzCh+D:NU75KHLk+V1lPKTBLOoKEVkdxQRkYC0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684252020, "uuid": "39dc76d4-ac40-41d1-aee9-2189da4f7889", "value": 1360160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684252020, "uuid": "3623536b-747a-4818-b948-4af119921685", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684252020, "uuid": "8fbe7132-27d7-43e7-810d-4c2f2f00c643", "value": "builder.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d04ef57-f3e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684239309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239309, "uuid": "89e44298-1674-4253-80ac-c5e698750d95", "comment": "Malware payload (RedLineStealer)", "value": "b9352f9dcaba6a6ebeed5c756dfe5e74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239309, "uuid": "b77274f2-4700-47bf-bfb3-15dd343f9b46", "comment": "Malware payload (RedLineStealer)", "value": "e25c3f7621547050d8b33edb42b6efb31f3eecbfdf5ff347ca2396a67fb41b27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239309, "uuid": "c77c1577-c322-417d-95f7-b3f343955388", "comment": "Malware payload (RedLineStealer)", "value": "cf0fd4f388aac8302606d59f83cd576cdfe94e92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684239309, "uuid": "a0ef6c8b-89ca-4691-9a2e-dab86d6228d2", "comment": "Malware payload (RedLineStealer)", "value": "f9a59ccd12ceb3e69a53fbb03eb15ccce4661853de6ca55268bd3401f787511dbdba7131ef6b3c55c5fb1457b9155e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239309, "uuid": "70ca65e9-5617-4a3b-baf8-1d40da324c96", "value": "T173646B02A148B0FEED59E4345DF48BB34668E57123AF2DCBBF8C361949D02B0677725A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239309, "uuid": "0936d97f-a68b-44e6-828f-93154d74eb84", "value": "728c6b1d6104d08ae563f697f3b86300", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239309, "uuid": "a47bde1a-f1b6-4f15-9d5d-718738feed09", "value": "6144:+xbI/NDkOBOsjD6YYnRtaEMBCWJTZtr2agP1l:+xbIlDNBOsjD6zOEiLg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684239309, "uuid": "1df2701c-f41d-4772-947f-31fd31e44f96", "value": 328472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684239309, "uuid": "a09d8d21-f7fb-4689-8b33-205f7ae589f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684239309, "uuid": "c39c6c38-3e51-46f5-a275-755234b127a4", "value": "b9352f9dcaba6a6ebeed5c756dfe5e74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fdd8b5-f3ee-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1684244159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244159, "uuid": "056f002a-34e4-4f7b-b55d-84976c3b01b7", "comment": "Malware payload (RemcosRAT)", "value": "ca41df4d9de1d275305b122337031c2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244159, "uuid": "36362b4e-549c-4b3a-98aa-eb5e0ef4293d", "comment": "Malware payload (RemcosRAT)", "value": "e2c60159ad9908ac2a1ab446c1866dfe5a59b1535ca29f111ae56833996d82b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244159, "uuid": "ab785e36-4165-445e-898e-4d97bc2a9712", "comment": "Malware payload (RemcosRAT)", "value": "cdf707e2fa81364e6ba39da254ba52d4aa8c9468", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244159, "uuid": "e8e54d4d-84ae-40f2-9954-9ea337e5916a", "comment": "Malware payload (RemcosRAT)", "value": "9f03ad171496579005905f1abebff5722186ff7f66df66dcac17cc9cdfb58d6cdcd1833405879859d6ee7e9fed65e84e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244159, "uuid": "e013790c-bb59-4b0c-bb3d-15f18846aa3c", "value": "T1A015F13150AE8B44E01BDBF169BCFC76037230F399D9D9710B69A1C4CE6AF505E84A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244159, "uuid": "5657846e-49b0-441a-b600-9ca9bdf6623d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244159, "uuid": "c86ffd40-f96c-4fe3-a2ce-dcbf1890ab52", "value": "24576:K4C3C4//c9QzeFGAF44xVulNw0jlJivP:zvCNCBtxVe68lJqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684244159, "uuid": "ace42587-dd4b-400a-bcf1-ce5971b5668d", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684244159, "uuid": "024f66ab-3ef2-40ca-89ad-d4aa2778b9eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244159, "uuid": "422f8696-2bad-4a7a-8608-1bf156c9fe1c", "value": "ca41df4d9de1d275305b122337031c2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de27c51-f400-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684251712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251712, "uuid": "264cbfde-4c54-44e6-9f9d-4d926b1cec2e", "comment": "Malware payload", "value": "ebd4596ebd8521357572113fc66c95e9", "object_relation": "md5", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251712, "uuid": "60d9dbed-cd06-4b0d-907b-7219b9e11c30", "comment": "Malware payload", "value": "e30a79cf97f2445919d5d3475f94f8328545f11db1916d2c2d26bd415e72fc1a", "object_relation": "sha256", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251712, "uuid": "47dfd336-f422-4872-80e1-42f3c4a7f7c6", "comment": "Malware payload", "value": "733b1f86c7c736a5cf4bf90448df170ff99340e0", "object_relation": "sha1", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684251712, "uuid": "3838bd32-ed7c-4f0c-be6c-052ac3a93922", "comment": "Malware payload", "value": "d05ddbedd35cb9c1cf8a32d91dee78697084485ca3cbd334a1951ca47242782b70bbca6af397ad1303a86f2c7586b142", "object_relation": "sha3-384", "Tag": [ { "name": "1684145503", "colour": "#9E2B12", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251712, "uuid": "0d637767-11ed-4030-a9f9-f32e613ba5c5", "value": "T160148891565168728B4B7E36AB70A5619EBD0E70D3D8198BF89F3340F1DFA9ED8D0320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251712, "uuid": "1d6873aa-b000-4780-b33f-2fc5eaaa6d02", "value": "6144:Udi3O+ompp+vgZDTjswH242DGx/CuLfU6e75p3ZKMdT4XRuXkH:l3d273tPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684251712, "uuid": "44300419-4b90-4df4-bc7e-5a1f2b5e8fd2", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684251712, "uuid": "334f0b19-3c86-42a0-84d8-0248614cf389", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684251712, "uuid": "f02c7829-dc0a-419d-aa3e-3e5b45832696", "value": "Emrd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "971cf985-f3fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684250171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250171, "uuid": "37569acc-5beb-4d65-b795-9126b7eb4e8b", "comment": "Malware payload (AgentTesla)", "value": "b0fae3a8c839aaf953aab5a37b9fe89b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250171, "uuid": "d4a7f2ed-9661-444f-914a-363d9a3fc876", "comment": "Malware payload (AgentTesla)", "value": "e367503036cdeae21a4acf47ee9ab16cadc3685394919fde85860b97ec825d38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250171, "uuid": "1127f899-6cdd-4ef8-800f-38776ac6c9b0", "comment": "Malware payload (AgentTesla)", "value": "8335eac07d3d54a4623d7c78dafdef4943d7a572", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250171, "uuid": "c2a19caf-54a3-42c1-badb-0ace21ff2bb9", "comment": "Malware payload (AgentTesla)", "value": "404d4c109f35523949f1a7eb369ea72074fa71385768bd08f89e19b006f73a8bb1fdfe99a2eb59ed8141207898786fed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250171, "uuid": "32e57416-06ab-4af4-ab1c-f635a8a58848", "value": "T1C4B42360667B31C48118C0D1B56D4F8BEF4425B379D6C8B72B3674228A226FCFB9C799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250171, "uuid": "4a57aefe-b822-4b0e-ad2f-f21b9617fc3c", "value": "12288:RJOWfAT5rGhpf32rZ4A0MQVHBhNO7fzJjZLenjptM90TLk8r:qxJup/CZ4JVLU73IGCvTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684250171, "uuid": "8bd1c408-b0be-47d4-9bf5-aa66af2462f0", "value": 510312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684250171, "uuid": "c52bc685-8994-4874-a773-ef57eab43caf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250171, "uuid": "c7e636df-07eb-4b17-9010-c147128d41de", "value": "shipping documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c88d8a3-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684235335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235335, "uuid": "c2d347c2-ec40-47bb-85c6-ab829c86dd1f", "comment": "Malware payload", "value": "3ebf72188e38f772c0a05b5d0c3a5d70", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235335, "uuid": "be2bc9c0-ce71-4b4b-83f8-58ebd6e300f8", "comment": "Malware payload", "value": "e4633233efcdcaaace6cf1978cbcd5691881ce335517d094addaa10cee547ba0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235335, "uuid": "76ececf6-744a-4ecd-ad08-eb1849051f9d", "comment": "Malware payload", "value": "e40cf03d2c13effdf943ccd029e472ee150bb735", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235335, "uuid": "baad3586-a389-4993-9e6e-4f5be850ec22", "comment": "Malware payload", "value": "4de3c97fd1a7b26b475e53a26382a6cfe6a953e8208589c37d52241e101a624c2b9095604278e4b51675907126593e2a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235335, "uuid": "e672d857-a2c5-478d-b66a-a0bb3041c845", "value": "T144618C1447E6020CF3F3AB3A99BE66954E3B7946AD31C78E0049814E62F1A40EC63F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235335, "uuid": "aec6cd48-cd49-4d13-84d6-63aa1dfbfca8", "value": "48:8v5asU9Dmel0iglZ+/Y7pQfYj1sAT1rTRRSJxo9AIH:8v5+B0+k6YZsErTR0/SAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235335, "uuid": "386ac7a3-2bb4-480e-af67-c012b97dde08", "value": 3424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235335, "uuid": "42c5a34d-e584-4048-bd94-1cbcda627e6e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235335, "uuid": "0be68452-f2ba-4057-bc9b-861f1c58da9b", "value": "Swift-Copy.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1367e706-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684233629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233629, "uuid": "eec6c35b-19a1-468a-81b7-4544fe8f6ae0", "comment": "Malware payload (RedLineStealer)", "value": "97cdacbbd437ea30d46ca678bc56b181", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233629, "uuid": "9918a3cd-f00d-4e18-9050-46d873ddacdc", "comment": "Malware payload (RedLineStealer)", "value": "e6ca8a212971ef311d9651da1043b803b80fd0698b1bd8aa91fc8f197e532d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233629, "uuid": "7a3d7ecf-e5fa-45b9-a6f0-9271e15fbba1", "comment": "Malware payload (RedLineStealer)", "value": "5e6aa7965c31fc6fb78dafe6c90646aa6d353cbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233629, "uuid": "076b4b52-d95a-4564-ac50-4dd315d68292", "comment": "Malware payload (RedLineStealer)", "value": "6aa49183112868d644b61eebf0502d6b5cccf284bbe2ac3c9da696c89a48f6f36cbc0f4cfde81a9ce35069dc4392dcbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233629, "uuid": "0a82b0ea-2e10-438f-97c7-73e052284cd5", "value": "T13B452313EBC84169EDB9937580FA07670F397C915CB0866B6780A90E4D227E0E97937F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233629, "uuid": "1c9be2c2-63a5-4269-9564-ddb892895fe3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233629, "uuid": "1f265706-afdf-498b-aa62-1af0d8dca999", "value": "24576:ry7IkkqdAPfqIC/SOou1vDaaL/1fbDoZWCnkAcrwqDJ+Em8H:e7I9qdAnqNMuBF/FoZWCkANEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233629, "uuid": "14d0d98a-080e-4e88-8798-d40868db02aa", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233629, "uuid": "3db3a89d-e339-4086-adb7-d9dc36690364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233629, "uuid": "2d6e75fa-557e-4032-aa50-a7441eae820f", "value": "97cdacbbd437ea30d46ca678bc56b181.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be2b99e-f3df-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LummaStealer)", "timestamp": 1684237696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237696, "uuid": "aa8ca413-ced1-420c-ba44-6fe368d802c3", "comment": "Malware payload (LummaStealer)", "value": "ad60c039352b7cc14e2d9e20658b4f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237696, "uuid": "482d2f8c-2c2b-4d5d-a5b3-a822ca5faaaa", "comment": "Malware payload (LummaStealer)", "value": "e7e6d5bbce9634227bfd03d13847dfe1a574663eeeb238307afb6cf71a105afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237696, "uuid": "f2cd8b79-b372-4bb0-9870-2504d8311ac3", "comment": "Malware payload (LummaStealer)", "value": "27f06407aec208e505a375a5240790b1b0209b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684237696, "uuid": "2da9b14b-fbb3-447e-b9f3-b926a436a4f0", "comment": "Malware payload (LummaStealer)", "value": "66dff4dbb120192e8184c39e30a79ecc2439475fdae3ed34b05c0183f654a777825cd3450f60f20bd554ecdcd9a3896b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237696, "uuid": "be7cedae-d18d-4d70-b259-dbfb464532fa", "value": "T1EFD533AF37530045D00287BB9218FCB1EF53B518BC9502EA798E7BCD1F88578A485F99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237696, "uuid": "84cbd6d6-55b6-4030-ab3a-345030a31868", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237696, "uuid": "db1e9c0f-fd14-451c-92dc-889e7bb11974", "value": "49152:nRRivn9urgLOOYRFjyohx6/sAYowbyrlzNToB+5qrohaF+OaElRsSMlN:RAu8LHkFjy8oUAYYViB+57aFboD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684237696, "uuid": "37665441-a3b8-4c71-8353-a8175e8ca7e1", "value": 2998056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684237696, "uuid": "f62b5da4-d5b5-4f5e-9151-b5135af0fc7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684237696, "uuid": "ef186cb8-5045-4bdb-bc0c-c15748dee1c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02c740d-f3a0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210806, "uuid": "f8ba86ef-8511-4647-9249-28ec009243ef", "comment": "Malware payload (Mirai)", "value": "ae498a8e9ba705c990f317d36708011f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210806, "uuid": "e1e9cf23-a92f-4764-a3d1-b333a7c697a2", "comment": "Malware payload (Mirai)", "value": "e8adcbe01f9303f82ec813bcb934f85f47d45c98ad1f8fa154ef3f7f705b4cb1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210806, "uuid": "201bcb7f-6e4a-4067-bce2-5faf45b76ece", "comment": "Malware payload (Mirai)", "value": "c977ae0c8c1d2c8245dea475aff3e01bfbd9968e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210806, "uuid": "13f70c8b-c664-4ad1-8eed-bffa2b30f039", "comment": "Malware payload (Mirai)", "value": "92d1ac2d25a24f5c4f09abd3c6cd4665fc45824c3b19fdb24253f73dad892abd787a7a1820a7093270976ffa89ec685f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210806, "uuid": "26e5a5ff-c960-47cd-9459-2d6252aaaf52", "value": "T154B33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210806, "uuid": "5b88bb9a-7f2e-4f0c-ada3-df4e6e063cec", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeA4+TRCm7FnVqfJXFWbNb:T9a2aLqkrM3sm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210806, "uuid": "615d6cb9-2f57-4033-b07b-7f1b6e3f2a57", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210806, "uuid": "e5b458aa-c084-4021-bf27-9ff4b6a0a79a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210806, "uuid": "508d035b-7eb1-4fed-a049-12a842f7811d", "value": "ae498a8e9ba705c990f317d36708011f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54faabd-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684233927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233927, "uuid": "1ca19df4-68ca-49bc-8fff-d054f5dabb5f", "comment": "Malware payload (SnakeKeylogger)", "value": "3e3fd6edc4d00f108c735a51310f53e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233927, "uuid": "6a6cc4c4-2463-4e86-b183-f0c8982d1363", "comment": "Malware payload (SnakeKeylogger)", "value": "e8f4a945cb876f35ab40ee024ba58f486969bbb9834803b140a62dac6e040599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233927, "uuid": "6881d3db-bba6-4e6a-b3ba-9f0fdb6e239a", "comment": "Malware payload (SnakeKeylogger)", "value": "39d30198d965b47c075e95cf0e5dc952679b3fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233927, "uuid": "b8550e61-c7cc-4bb5-9d4a-2ae08e89597f", "comment": "Malware payload (SnakeKeylogger)", "value": "292c1071529d65b5d6729da080ffac21424ca7ed459ffcb0d03904b8ed4fede8c8f59778b1feea3fd9594158d070c42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233927, "uuid": "a1fcd22b-1229-4dca-aef5-ebde7944a64c", "value": "T1DAC4CF7051DE4A94E01ECBB2A5B8FD7242313CF7A9E989790769B284CE36F111E48D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233927, "uuid": "65abac71-a55a-47bb-bede-7dd0a5d8e469", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233927, "uuid": "36cfa7c1-82ad-4c9f-89b3-90d44f3a5fd2", "value": "12288:MUenpv5yOOmBVrtaTa6X34Vc9CUO113WQqq8GgEQTLtv2:HyJ3X2aU59CFpD8NxTLtv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233927, "uuid": "4bd415ba-9759-44d9-833d-6049fa0cd6ee", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233927, "uuid": "771eb61a-875d-44b6-a80b-8cf431b884ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233927, "uuid": "b5e42ff7-c07f-4883-8d9c-471e812badf8", "value": "PO SS316L -GI 20230323.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfedd14-f42b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684270449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270449, "uuid": "a93cf422-d11f-43d0-adfb-0e1f6558fdc7", "comment": "Malware payload", "value": "f8835d26a3d6c676f073a0333f3dc785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270449, "uuid": "ca702025-1b00-4744-b66d-36c0347ae26f", "comment": "Malware payload", "value": "e8f751257028ddfce1d6e1f3b24410f614e3d9f0a7296e811faf9de52e63db70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270449, "uuid": "171fa834-74e0-49e5-be78-ac3e70c7892a", "comment": "Malware payload", "value": "4a0ec86decfe34022f318fa040e3b1aebe5062d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270449, "uuid": "69d34355-a19e-43a0-ad90-98845d29d3ca", "comment": "Malware payload", "value": "2025da7e0bda7436565f568d61eae8f809c9af224c68046f87d22849237bbd41f93953a85e6ef6ae1da1c688b418faf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270449, "uuid": "fd482e40-0400-4ec6-a7e3-1a6e5f565e92", "value": "T19FF4C0A231589D63D12F85F0D26479B007B032E395DEDAF41EAAB1C79AD3FD0BA48507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270449, "uuid": "72b23432-0d5c-4295-a880-b77a106d4df8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270449, "uuid": "4946e8da-eb25-46f6-8915-72a959b957f5", "value": "12288:0mwvITY10brNJcrfs8EFVYtHi+aPYPD6d/czAmrxFGv5//5:5W1UEoktHRaw+d0smr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270449, "uuid": "484274e6-29f5-41ce-9c26-fc9a0b0c8542", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270449, "uuid": "158371f5-0b3e-41ca-ab14-a9b423e48667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270449, "uuid": "95e32dd1-23e1-4d33-bf27-8f2f5aa665e6", "value": "SKM_C3350191107102300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bbf9c9-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684234275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234275, "uuid": "3f829b2c-468f-4d81-88c0-0c0ab27d4f54", "comment": "Malware payload (Loki)", "value": "049696ad4a17c74cb91de198c859ac99", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234275, "uuid": "9531092d-8e92-43ca-b646-e1fed587b658", "comment": "Malware payload (Loki)", "value": "e9238a3a614724ab84410ce8411ad58b04e6c292d5d1d20ac77ef535a605d74a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234275, "uuid": "d99cc348-a445-4a40-9d6b-d6b505ee52eb", "comment": "Malware payload (Loki)", "value": "ba8421932454268b47f1bd55351b65dfafb548fa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234275, "uuid": "02b5cf74-de88-4c29-90e1-837b01fbb706", "comment": "Malware payload (Loki)", "value": "481f3f6f754321bea27d683cba0a66917899a3ac10c799624c07c00652561046afee01e493b1b17adfb167e4959078d3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234275, "uuid": "da7ca6f4-1ae3-48fd-b63d-a54094d978e4", "value": "T12E650112EA95AD1EC94907B12B87A884531DBD72BAC81A473B5C375F1FF3AA0E543C0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234275, "uuid": "b1179828-398c-432b-b096-f25de8abe2ab", "value": "24576:cLKV/JDLwBkbn+MXUu9bDLwBkYR+MXUl+MXUhNsR1i/VlIf+brWbendkiJe2:cLKNS4+MXV98t+MXK+MXONsH4VamG4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234275, "uuid": "ab504144-628e-44d0-bd20-7d2adf8e9918", "value": 1478656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234275, "uuid": "b7c8d8a5-6c7c-4057-811e-474f8b589f2b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234275, "uuid": "94d7a757-2835-4e9c-88b5-999daf4bdb96", "value": "mv Pacific.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1bb564-f40e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684257880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257880, "uuid": "fe564bb6-960b-4786-8070-deab22f9380d", "comment": "Malware payload (Amadey)", "value": "8a10584bf150376e72d2c27edac79543", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257880, "uuid": "835fc9b9-3464-49bf-b53b-adbc3fadd457", "comment": "Malware payload (Amadey)", "value": "ebe7e46e0f8753e65c439ce3fe0eeb6830f5e9537dba3d555f0c4aa13b657ad0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257880, "uuid": "05ea7c3a-8c45-4bd4-989d-1df83e5638d0", "comment": "Malware payload (Amadey)", "value": "052d0e47168b83f425baa39d92833b7e6b3f4615", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684257880, "uuid": "d6752a4e-9845-40aa-b253-004d35379bba", "comment": "Malware payload (Amadey)", "value": "f0e258bce6cc24c311113926c133918629afd3da1cd2fba54e622021d6d0a5139ba420c20a8b4fb54bf10c88c7db89aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257880, "uuid": "03bd32cb-0954-43b8-ad15-16c48b0d1f0b", "value": "T11C652317D7CA4036D86D1F319CFB61874E787C724BB8472627A6699828B26C5723333B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257880, "uuid": "77b37a8a-b0a0-4ee9-9549-a77182c39c19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257880, "uuid": "15ff705c-16af-4bb4-b2d3-97716b5e1cdc", "value": "24576:uyxS1ujtn8ngUK+VjhSSIUObohPtUYN2QWCoE17LcxmScQpgw8kclWRWoY6x9:9k4jt2ggVQSdfh1UA5+E1XcpcQapWR9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684257880, "uuid": "6a6ac869-900e-427a-8c0a-6089e55e4543", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684257880, "uuid": "af6d58ba-c0f9-4715-a02e-2f629a4ce24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684257880, "uuid": "c0d34e48-a4fe-4f4a-8a0f-ca6b2073cd32", "value": "server.dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4b0b81-f3cd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684229830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229830, "uuid": "bb5d193b-13bb-47fd-9318-c6429016f4fd", "comment": "Malware payload", "value": "ab06281727cd66d676e0ef918186043c", "object_relation": "md5", "Tag": [ { "name": "cdr", "colour": "#277922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229830, "uuid": "1eb69db5-017d-40cf-9155-0c31bb1f13b7", "comment": "Malware payload", "value": "ec0c4e6329341ebd54b4c552ec3de056dcac322fe4ceeef90f8572627f631daf", "object_relation": "sha256", "Tag": [ { "name": "cdr", "colour": "#277922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229830, "uuid": "372c0898-34a1-436c-b84e-ff7ea0e625af", "comment": "Malware payload", "value": "c4f96996b9f9e1c243a4de48c139d628e04b6ba8", "object_relation": "sha1", "Tag": [ { "name": "cdr", "colour": "#277922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684229830, "uuid": "63eb536a-6ff4-4ac4-89f8-ca0b5df9641a", "comment": "Malware payload", "value": "cbf11149a2cd3f46fcc0404d4368efa5bea13707d70395ddc6893a59ac996502fb82dfeb5d7c4fa18ede19c7fd21418f", "object_relation": "sha3-384", "Tag": [ { "name": "cdr", "colour": "#277922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229830, "uuid": "b82c0c2a-da9b-49bd-af99-7265e4921168", "value": "T1687533FC85738099C6D31534A8DB8B5BDF359FD2808037432A6AFAF854AEFC5060E956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229830, "uuid": "37af3e99-6a94-4bbc-8d44-4c4361479e71", "value": "24576:54zCjiJqSVz3FLnWd5gCDc1WaK5UaMBERxu7JFMT443nVN2Vo4d0Ob2j1M67qcCD:oyh2z3FDHk5BwtGkwqVTuOb2+uhCtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684229830, "uuid": "7505f2df-29dc-41be-83e1-cc60ac57171b", "value": 1635448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684229830, "uuid": "28efc178-1f6e-4a56-8fdf-c0c7b005f695", "value": "application/x-vnd.corel.zcf.draw.document+zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684229830, "uuid": "66f554cd-b4f5-4baf-991e-3077795e17ac", "value": "GEEK15.cdr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e48814f-f407-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684254880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254880, "uuid": "f5ec08eb-48ea-47d8-bc54-90174045e994", "comment": "Malware payload (Quakbot)", "value": "35095deba6d4f930f703894b6ebd6eb0", "object_relation": "md5", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254880, "uuid": "4d788a2a-abbc-4a0e-876e-b6292ced71bb", "comment": "Malware payload (Quakbot)", "value": "ed072d025d7043ac40a79713312cf5e67aaa4facf50e1f1fb61d183d62cbe0a9", "object_relation": "sha256", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254880, "uuid": "0ef9d49a-fded-4396-b39e-0787da11f424", "comment": "Malware payload (Quakbot)", "value": "c80b3b5509a23e3d35b689e63a0418eabd4cd40f", "object_relation": "sha1", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684254880, "uuid": "cca4c810-c8d4-4fc8-a6f4-ad18ae6846f9", "comment": "Malware payload (Quakbot)", "value": "7f908213d16b797a95588e228178c774ac98bf4c91d626538c00ac7d380f33b6ab91119a9683ed1c545c3240a698bf91", "object_relation": "sha3-384", "Tag": [ { "name": "1684249586", "colour": "#49C0FE", "exportable": true, "hide_tag": false }, { "name": "BB28", "colour": "#421FA8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254880, "uuid": "adef74f7-8c37-488c-97ad-4badf0200fa7", "value": "T1D4F49E33B7A1C47FC31703B1484963552CFDF1A50D371B47AEAD4B2D2EACA929B08A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254880, "uuid": "eb45e193-d009-43ef-b536-daab6f852d23", "value": "70f14b5cb667842cb2030f8ea7a53ffe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254880, "uuid": "ae331f20-7c31-4a8f-9250-fe2c93ed9ad2", "value": "12288:wRup73d7AV/GmnKRu3I6MK9T+UDg2RAknST7z:wQpbd7AV+mKRu3RH9T+UDg2RA9Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684254880, "uuid": "05f2a857-48bc-423f-9a2c-f43b7f78dea1", "value": 748469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684254880, "uuid": "160de98c-699a-4f50-b342-d464c5574418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684254880, "uuid": "d110e4e3-f2a0-44e8-80a5-cd071d12636f", "value": "UpdateMePlease.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21c2d2c-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243773, "uuid": "9cb401b6-8602-4c9d-b027-4504682808a3", "comment": "Malware payload (Quakbot)", "value": "a2bc8a8886bfc4de81024ae74fa5efb4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243773, "uuid": "62777da5-4529-4287-a474-7d79c372903b", "comment": "Malware payload (Quakbot)", "value": "ed350496af5d3d902ecd056615e030562f2bbdd2c0699951360562b8a3d068d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243773, "uuid": "64896eba-387f-44e0-8d0c-8f39b0ff6e8f", "comment": "Malware payload (Quakbot)", "value": "1e72691f75351c4a02e12276ffbea10f283e6afb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243773, "uuid": "410631bb-a992-4e4b-9fd0-fa246a8c24a2", "comment": "Malware payload (Quakbot)", "value": "234af46a10e3f835a820ccdea4dd7b12e990fe7c37328737e139029c27b6010b89bcc53b760cef217d0e5de1c705b78d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243773, "uuid": "63e67ca0-a1c3-4d42-a5ca-cdfadf121ca0", "value": "T1105420984B5118728B5B7D62BA74D4B9EB3D1E7082CC968BF84F3161F2DE98CC8D4721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243773, "uuid": "8b3f1d10-5e45-4f83-90ba-363c56b3facf", "value": "3072:ui6VrD7WPIe3TJraBlYApksU9ZyMoSXb4N9U4HVIlQ:361XCIOBa3YIUjdWV1IlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243773, "uuid": "1c08f484-136a-490d-b77f-0292710d17e1", "value": 294327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243773, "uuid": "6915acf6-bf70-48ab-8568-9698de2d81a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243773, "uuid": "8f0b9a29-d959-45c5-8b15-6efe51edf4f2", "value": "Wassnfa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4c6027-f428-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684268862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268862, "uuid": "86bbb938-06d3-4f73-ad30-599704edd086", "comment": "Malware payload", "value": "9b5bb37fd2c1be54b433676fe5793d17", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268862, "uuid": "e9f4150b-62a9-4def-a68f-3811a97237e3", "comment": "Malware payload", "value": "ed3d667a4fa92d78a0a54f696f4e8ff254def8d6f3208e6fe426dbe7fb3f3dd0", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268862, "uuid": "1033f1d1-c258-4308-9e26-a5c32ddcb011", "comment": "Malware payload", "value": "4b6bbad0799b75cb65d5bdb7502bc18991566658", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684268862, "uuid": "101c8d1a-6c99-4d57-9e17-7c68dea3193e", "comment": "Malware payload", "value": "cef23891996ea13007c682e87114ccdd3201b0407bb404d3886bc26ad69aca6cacedaa924a1f525fbc597e657378b04a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Camaro Dragon", "colour": "#E9E30F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "shell", "colour": "#705F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268862, "uuid": "1c17d823-a3f9-46a3-ab4d-53be5cb53ffd", "value": "T11FE18247B7D2EDEBEC5893F88BE7E31493A0A5624A829343C14DF2A43D123182D3A745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268862, "uuid": "b63b6283-67bd-4caa-bf94-e728c9f80e1b", "value": "96:YEKQhNEV2RPemj2gV7fSCzWMCZB3/6qO/22WYr3CekMulWMG4o/vsllm+MtZ3r:1KQhNu2QgV7fSCa15ShSe40IvMtZ3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684268862, "uuid": "cdd097c0-eab4-4b4f-8850-09586bbdd85b", "value": 7429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684268862, "uuid": "7902d561-6cf8-4dd7-941c-cd365bb7415a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684268862, "uuid": "97ec7c55-14e8-4811-bc37-e17f0c58f9ca", "value": "ed3d667a4fa92d78a0a54f696f4e8ff254def8d6f3208e6fe426dbe7fb3f3dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a828e6d-f3d2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684232111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232111, "uuid": "19da427e-fa4b-4341-abdd-5a3045e547fd", "comment": "Malware payload (AgentTesla)", "value": "cde7c1f79b8159ab607119c438fe119f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232111, "uuid": "5f86531f-16b2-44f4-9338-59d83d6bdc85", "comment": "Malware payload (AgentTesla)", "value": "ed4b9afcb717295f5fb71bcc6f408dbbed12c6858ee2f20a1f7bd2ab72074fc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232111, "uuid": "7d8ee86e-617e-48ca-9fad-162778b848c7", "comment": "Malware payload (AgentTesla)", "value": "435013ae5ba8fc9ee9948255b537512f0c9ba6b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232111, "uuid": "6ef16e4e-7d6e-4882-a0a7-f8337d00c8f6", "comment": "Malware payload (AgentTesla)", "value": "7605dfcf87653456e3865edc8f4a4ee6bd58e3e9eb31350e7159c037b6efdb348e0567b921002fcb477b08ccf12b50bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232111, "uuid": "47498995-1e81-4eba-8488-ac4de4e72c53", "value": "T14DE4E07050AE4A80E01FCBF165B8FD72033175F3ADE5CA710B69A1C4CE6AF516E8895B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232111, "uuid": "bfeedc80-32c1-494c-b455-5dfb2984196a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232111, "uuid": "65e7ce32-7f23-4f69-a15b-93651536111e", "value": "12288:BY6v5DlZnhAkWsPpibPmLq5iKtwI17fZxtmkII5S5//kQfj6FiwyPA:/hHnqkWcpEmLcth1LZx2US/M0mFPsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232111, "uuid": "dc880ace-566f-4c3c-bcdb-79cf56e7ee84", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232111, "uuid": "cc0b2d1b-2bc5-4358-ab7f-a83b46d278a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232111, "uuid": "c1112f23-90ae-4360-9291-b7560bb9f6e2", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fb177d-f42f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684272068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272068, "uuid": "b0c7661e-60d4-4fe9-8356-bb2627ec07fd", "comment": "Malware payload (AgentTesla)", "value": "8bf173aff4199d406af58097f9a02434", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272068, "uuid": "3a085f54-443b-4d8f-b487-5221c1cc8472", "comment": "Malware payload (AgentTesla)", "value": "ed9248192c85ed4a3053e0c5bf1763cb1e39ed9514122a29542e439461c89f9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272068, "uuid": "0ce45a5d-6e44-43f9-b4d0-4ad426e4593e", "comment": "Malware payload (AgentTesla)", "value": "95bf3e1a2ba4c7b7992e4aa7e3291fca187b50a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684272068, "uuid": "3a954ddb-0f6f-4e79-bfaa-14df5698ef60", "comment": "Malware payload (AgentTesla)", "value": "18ece020ca7c8de719b58b8339882a1741ed05771ea225817aa5f055d0c5b007020df32fdd693ec2ea379ad398d6aacd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272068, "uuid": "8f5a3518-281c-46d3-bcbf-b9c02e97154d", "value": "T17AF451390AA58AEEC0BBD364A7CC499BFA73D817F15C9BAD54C6034272436CE60C61DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272068, "uuid": "97ba2610-0f1a-474a-af75-8586f36a7590", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272068, "uuid": "f0bc675e-7edf-42ee-8732-cd220a3e8de0", "value": "12288:vf1Z6SljSn+1fyjVsjQbM+AqVX5zspuvwQ:n1Z5PfyjG8I+PzYKwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684272068, "uuid": "23521012-0a4d-4067-909e-b2cf0ad2e8f9", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684272068, "uuid": "22b72d8a-3ed8-4662-bf6a-9b3d0c2e7ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684272068, "uuid": "deb8daa6-8c9a-479e-8656-5d7931316f13", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796f143a-f42c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684270737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270737, "uuid": "393c255b-0014-4a64-a112-1ffa6bc27273", "comment": "Malware payload (AgentTesla)", "value": "3cea5ae4447babef4917c3178b77bb05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270737, "uuid": "68ff59ab-be0b-42f3-a505-f0ac3d9035bb", "comment": "Malware payload (AgentTesla)", "value": "ee6eb7d56a2ee539b39d8c06bf3984e7e4ba0a28657463f7827e59e3ef9ae6b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270737, "uuid": "9a7b0803-807a-440d-84a1-4b3b4aed4c4a", "comment": "Malware payload (AgentTesla)", "value": "400a368fd9cd67b00ba05d27cbefb5111956c159", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270737, "uuid": "4ac3237e-23ce-40a5-be90-9d559a8d0559", "comment": "Malware payload (AgentTesla)", "value": "d475e59dd5ec9cfc24dc0013c3567fa77b21f76a5227cfd9891b1bf1e9da4e873c2e5f7639212949e22ec9c7a9a872fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270737, "uuid": "e7e48239-2276-479c-a637-d1c936ece082", "value": "T172F4AE2061BD0B45E03E97F156A8FD2903B275A3A2FADA210EE5F4CB4A25F005F45F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270737, "uuid": "687ce143-2ca2-4e9d-972a-5e92865f9195", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270737, "uuid": "75642032-c693-47b0-bfeb-5742244b02ae", "value": "12288:chHtwMnXHmR9+zCCI0ukK/viGp9T0CF8XKJ7jYCUBbKDP5YNv5/hBu:SCxc7IrLmpXmvZObBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270737, "uuid": "1d4d8f60-51ef-49f4-9572-610783c37aef", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270737, "uuid": "dadcacf4-b538-4435-a70b-8398fa40afc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270737, "uuid": "14d377f5-434f-4bd7-b2b5-8e66dcefa6d7", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860f1955-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243700, "uuid": "d5ad2bcf-ece1-45c6-a2c6-3383b7efbae0", "comment": "Malware payload (Quakbot)", "value": "5766bc8031a485df0b03b1dd15b82d3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243700, "uuid": "ca484a4b-fd1e-48f9-96d9-85392ba0b264", "comment": "Malware payload (Quakbot)", "value": "eec2d6c95416d1ef00e5e37fbd36ae388a24bee4986cde2d9cfebf6d25263a95", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243700, "uuid": "c64e0866-52c3-4d4c-a802-e77a6f9895a4", "comment": "Malware payload (Quakbot)", "value": "2cdf7ee78a24e06f9fd5d3e7d515bf60774c720f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243700, "uuid": "838796ec-349f-43bb-97b7-f924f3a4c128", "comment": "Malware payload (Quakbot)", "value": "de016a2f247bbe1de5776b62a5ab7b3e05e6a123de1267fe909533c438cdbc5e51ee5abc4b779feefae97d23e736181e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243700, "uuid": "e24b0e53-4050-430d-8b48-5ea0c9d1ff50", "value": "T116240DD14B9598B29B47BE66BA70C5A1DB7D0E6082CC964BF09E3260F1DD2CDCCE5720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243700, "uuid": "80cf2a2f-7e0b-4514-ac67-21afb38b4e9c", "value": "1536:mDS8/yqz10JirHyPUGNjb03yySCpyzn4QrYO9PmJNxw5xUPKY0HdOSLLdmU+xcAm:t8aqz10DH8yQK4QrYO9PmNLx9xIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243700, "uuid": "8a3ccdeb-1dfd-4fb1-82a0-43a4ba5a64a7", "value": 223494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243700, "uuid": "7687e756-928a-4d5e-9551-ba54f81eebf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243700, "uuid": "46b55cf9-e8c5-4ffb-afe2-06a68c8c2c9b", "value": "Ckbt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb8158a-f3fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684250346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250346, "uuid": "8c3a9cd1-ca99-4cf0-8ce9-c2ef6ae6dca3", "comment": "Malware payload (Formbook)", "value": "bcc2ef5edecc627633a5c2655b5422dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250346, "uuid": "8e52ee9f-69f7-4c50-89e7-c85ae4a4a65d", "comment": "Malware payload (Formbook)", "value": "ef201fa6a83547a8b5a1514e948d4208ee20bd4d37c1fe57d81bb1c2dfb1caf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250346, "uuid": "d7c6197e-06c9-4c06-b77a-63a9a5625cef", "comment": "Malware payload (Formbook)", "value": "6e4d3fc6bc3552d8f1304c60c3b1b9253792a97b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250346, "uuid": "7f0680bd-c7c6-4a4c-9055-015f2026745e", "comment": "Malware payload (Formbook)", "value": "ecacf3b14276e086d3940a50ff4b49af9d6d09198faaec1c81b15bb8a9e2b53fb066997656914be307b049a7117935d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250346, "uuid": "3f21931f-2f4b-46ce-a20c-554de4a9576f", "value": "T1A0D4E17060AE4690F01FCBB165B8FD72027270F3AED9D9350729A1C4CE6AF546E88D5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250346, "uuid": "acd4dc1a-daeb-4064-9a98-58a31dead295", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250346, "uuid": "a911299c-0367-4ab8-bf8c-ea3c86b323a7", "value": "12288:zYyv5+7XdJV1D0K6E2RzIDLdeKiLk71tb88:V45J6BcDoLI1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684250346, "uuid": "0282d491-e21b-4a86-9819-8de6cb0b438d", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684250346, "uuid": "9860ce49-38af-4296-9b0f-cedefeca9fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250346, "uuid": "de9421ad-898a-4977-83e1-8a6e7b37fd2e", "value": "Purchase Order_231313_20230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f694758b-f3e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684238734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238734, "uuid": "c857bb83-1af9-4cee-9c26-38777d2fc0ef", "comment": "Malware payload (Mirai)", "value": "34a8b1d4765d6f3abc6572fe19918fdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238734, "uuid": "8ff79812-50f6-44ae-8a05-b45f7c9e0e9a", "comment": "Malware payload (Mirai)", "value": "ef57c19f459555f879668b77b7ce0fec3bb5560e7230eb27ec446226fa2691d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238734, "uuid": "ead5bdbf-7f54-4b8b-a959-2c7b35f9c178", "comment": "Malware payload (Mirai)", "value": "bf44fdb8771aed382a480ad841d7267e9712cdd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684238734, "uuid": "0c9320b4-7b9f-4ff0-9b8e-0423a7098efd", "comment": "Malware payload (Mirai)", "value": "32d8d08f7473710ed15ebc7560614943613695e27304dd06d4b2142043b73741b9972008902d492b2b537e39e4961f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238734, "uuid": "60c34423-b271-416c-8a2c-b0c705fd5db5", "value": "T185336A77E45A5E94C086417075249F351F23B2C893932EBB16EAC2B55483EACF509FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238734, "uuid": "0fc81c0c-cba8-4d26-8940-d99d5af143a3", "value": "1536:8aWjW/cXGET6WtZqKAlSW4UBOCVQV5nO:8pjWuGEbZtAuUBOV5nO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684238734, "uuid": "eb452fa0-5029-464c-afa2-83063de39726", "value": 50584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684238734, "uuid": "86398a2c-442d-4fe3-b258-609aa132bb21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684238734, "uuid": "0f3125b2-9799-4308-bb37-e4dfe51dccae", "value": "34a8b1d4765d6f3abc6572fe19918fdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3628451-f392-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1684204772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204772, "uuid": "03b00d0f-7334-434c-9394-3cccba17d8cf", "comment": "Malware payload (CoinMiner)", "value": "82ff9121d81cda00c2c8f2a5bfe0197b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204772, "uuid": "1b942235-140b-4e95-a823-c887d28bd66d", "comment": "Malware payload (CoinMiner)", "value": "f00da337728446c18e023ef2a1641f4f4033741ccf534ba99203005fb26eaa1a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204772, "uuid": "4170cf49-0b2a-4bd1-b4c4-e7b31cbdd846", "comment": "Malware payload (CoinMiner)", "value": "1607b80fa502ea3534f697d7065b192ac0237ff8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684204772, "uuid": "699acfa9-ad89-4a30-a3f7-8fc18c29b6e4", "comment": "Malware payload (CoinMiner)", "value": "fe57a580061540993b69d9a62b3eb2d2406eb4341002d506aabe847639500a754fe87197981fd819b4aaf9162ec27fb5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204772, "uuid": "ddae91ae-fd14-4a07-9ff5-eca3caf5c6f2", "value": "T11BF6BFD239D826DDC0ADE23AE551A82B479FBC6A0A1BFED7D1D0F23A6702C413745748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204772, "uuid": "d655c465-7f45-42d4-a08d-1ac1c2d3db0f", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204772, "uuid": "e7ed2df8-ad50-47a2-abde-a85a661a8ec5", "value": "196608:qgTX24UQde9XR0IrM0rlRpl6uflQMh5o3CFolvoWaBmjVi9TH1e+lSH:qgSVRcqhD86oOBmjM/e+lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684204772, "uuid": "f73ee623-0d8e-478c-b751-01b6f5fd141e", "value": 15985664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684204772, "uuid": "c571685d-8ef4-410a-ae37-460d180f8dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684204772, "uuid": "d245cbce-69fd-43a6-8d4d-7eedf1a7c38d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e5db1a-f3db-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1684235814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235814, "uuid": "8ca252fb-1fb5-407a-9955-f078ad645371", "comment": "Malware payload (GCleaner)", "value": "e43b4b2d5fc246f04f1652a5cc3a9deb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235814, "uuid": "d6246299-865f-474e-a717-4d6bcc953a40", "comment": "Malware payload (GCleaner)", "value": "f077315ae8783ee24b4a74165ce2053be4eec46b470799f5f13d5802f272b685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235814, "uuid": "8d3e7ee0-1dad-431d-8554-f01eab721e7f", "comment": "Malware payload (GCleaner)", "value": "304769d7242447454ec77ab1970aba71748ca822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235814, "uuid": "f7d2a929-3612-4265-aab3-d5ddc5dd7276", "comment": "Malware payload (GCleaner)", "value": "95b176210e7f45c26af5240c5cbfe0af4ef9c877cca9e12c79538055651ff1a99b24b88f59d8ec657dabcf06fdd97a4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235814, "uuid": "abfc4925-4414-46b4-a4e3-904d151aab72", "value": "T16995339365F21E35E43AABF62C472328EE727E126025845337959D4D37BF2F76808B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235814, "uuid": "aa50922a-f976-4f9c-801f-b826244cabc2", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235814, "uuid": "b3c458b1-b0bd-42b9-87a5-4269f2d7392a", "value": "49152:ISuX2+C8qu0LIfHCKM5+2aRT3+jdsVtIDsxDYAG5cT:ISe2+C8yLIPCi2ah3+eQeDYXcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235814, "uuid": "ad4bfc9b-cef7-49a9-a141-50e20d7b47f8", "value": 2024043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235814, "uuid": "d484e68b-f2ba-4628-bea7-09fb8f5a2f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235814, "uuid": "c9598ac1-8d73-4bfe-a3c1-016f050c36ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3f2067-f384-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1684198479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684198479, "uuid": "210d7f30-f082-40ef-a8a7-0a1c30afe10f", "comment": "Malware payload (Amadey)", "value": "6468d68fbfd137439e393289f095461e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684198479, "uuid": "928d637d-2126-4f36-a9b4-e797bdf3471d", "comment": "Malware payload (Amadey)", "value": "f0dc05e0ebc9e0db1e3ff56d649a48b799d8f28b21c8fc326ea2e384c1f71f53", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684198479, "uuid": "3b652d96-c1b0-4b2b-9889-bfa24882bdc7", "comment": "Malware payload (Amadey)", "value": "15f7ac56045199cac3d9cde402269ce08064baf7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684198479, "uuid": "29d9c81f-8336-4679-947e-56c51ecddc5a", "comment": "Malware payload (Amadey)", "value": "a4a5b41410763a82c5e00986f6e22d6df234410e0469097fa77a8f9669b0680ef339f8ea4b6ad7a392694f2f1093998b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684198479, "uuid": "f4de71c4-0325-492f-81f5-cc67473e10d1", "value": "T1B6452352ABE69137E9B15BB018FB05C71F37B8A1A82D5B3B13805C6908F3B91E075379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684198479, "uuid": "1509f1ad-c947-42b5-a76a-f25c43444acc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684198479, "uuid": "a9702435-9ac1-480b-aa9e-6c59a496ee9d", "value": "24576:Qy1C50quxAIz/Sqbayvn0jkSTxWIh6vrvncZbRD6d83+u5UK6l:Xy0jSoN2ekkSTsC6vre283B5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684198479, "uuid": "2b0da2bb-9e6c-49cc-94a9-a0822ae7e784", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684198479, "uuid": "2f32cf29-08e9-4439-8603-2d7a77a91a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684198479, "uuid": "9d45474d-5362-4034-8c2f-f18edebf38d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f51c77-f3dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684236286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236286, "uuid": "2e06f2e8-fc5b-4611-a923-00a5c3acf6e1", "comment": "Malware payload (Loki)", "value": "df8ab976221bbbd5d47dccd29ce378d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236286, "uuid": "c92e512d-b0e3-4f4d-9f6f-0b1d4f740ca5", "comment": "Malware payload (Loki)", "value": "f104365d9d691369911b38002c19e70d462a50a243a35bca970cc00f80040f52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236286, "uuid": "f8a7549d-aae3-493f-bdc3-9afb2e6c2983", "comment": "Malware payload (Loki)", "value": "8c0531eaec62fa6c7f18befcd2732d88b968c8de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236286, "uuid": "e6ad0fc4-448d-43fa-a0f3-0ec01d7fda20", "comment": "Malware payload (Loki)", "value": "c74b224e7763fae46b419d995f877c0d22537004e8a04655ddb982f79e177ef2f58e4e83573645c95155e959be505712", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236286, "uuid": "2e9812a9-6a78-4acf-a9a9-7e6531a8696e", "value": "T19F44195392A13D54EB27CB73EE2E8AE87A9EF5504F5877AB12189A3B04702F1D173311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236286, "uuid": "142e82f4-2868-4694-90ba-f3fb4487d5c2", "value": "8507dd6e83303e4881d265378980e13b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236286, "uuid": "57a44cea-38d7-4dd1-8b5c-e51e0f90a730", "value": "3072:j6duWNYGxL5I28FNGkEcjfui1KmAtiozXjmc7phUN6V+52cFrmcJObl+G44:ouWnLq28CkEcKVTiaXd7MN67cFrBSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236286, "uuid": "23b43753-ad7c-4093-814d-7548860f5c19", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236286, "uuid": "7a111902-176c-4f05-977d-c30dca210a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236286, "uuid": "ced60e1e-0695-4fcd-861c-ea6f1db5c4a8", "value": "df8ab976221bbbd5d47dccd29ce378d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578799de-f3da-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684235461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235461, "uuid": "d1138964-0999-4185-9324-ed7e374dfe04", "comment": "Malware payload (SnakeKeylogger)", "value": "4f2580154b4ab4d50c523f539728ef98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235461, "uuid": "9c2a833c-206a-41d1-9455-4c373c4f0e00", "comment": "Malware payload (SnakeKeylogger)", "value": "f1e1cd828f56e8ebc2fbec269ca886b2d4701ddba9bf6d76ffa318b94e897e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235461, "uuid": "c558228d-5c1c-4f08-976d-01d1b0b786bd", "comment": "Malware payload (SnakeKeylogger)", "value": "a7c32086d489c6a1218d7b63ca1a2ea39d61c79d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235461, "uuid": "3ec8cd11-a125-451d-9149-e87ef7229330", "comment": "Malware payload (SnakeKeylogger)", "value": "fc021009ca1bb944c27a9ebe7500081a4c4882d7ab1c55e1117f1ab984236c2b83cad23a663d63f6cf168017a44ba85a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235461, "uuid": "3fd16647-f389-4c18-92b3-728394bb9787", "value": "T1F7055CD1F1908C96EB6B06F16D2A643015A37E9D5CA6C10C5A9E7B5B76F3302209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235461, "uuid": "dd2043ff-7e6b-4b13-9082-37f4ffc2903d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235461, "uuid": "e9fd2258-b9dd-4b0f-a349-3ff710f1ffc1", "value": "12288:UKysSV41pnri5YqWGRiQTWlTFh/KHY8xixAPf7JB96G:s4bnri5SQTWlD/K4ZxgfdB96G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235461, "uuid": "e2fcdf0c-6af3-433c-abf0-4aa726e18379", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235461, "uuid": "7f859513-4080-4f60-a2b9-78817ee76af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235461, "uuid": "5706cdb5-c6a4-4dbe-8c7c-29aa94582364", "value": "Fotograf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125cf1d4-f3dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684236633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236633, "uuid": "cc6718bb-c25e-4109-97c8-827655e44a45", "comment": "Malware payload (RedLineStealer)", "value": "bd745f43c090fd7fc5aeae0ec6b48d5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236633, "uuid": "29e27a6c-fa29-49b2-a36a-92e1d067e1cc", "comment": "Malware payload (RedLineStealer)", "value": "f23313732951aeb7b3c9582641133fdefad1ea524908df534e30c8288e76b243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236633, "uuid": "d25d0aa1-0cbd-43c2-895c-a8ea01b77285", "comment": "Malware payload (RedLineStealer)", "value": "7814463e8a7dbeff016e0cd0907f646decf28158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236633, "uuid": "47fdb95e-9b46-4c5a-8687-1da691999b81", "comment": "Malware payload (RedLineStealer)", "value": "37bf43f5a425843c949c6d82d4d3ca6dea487083d546d4d30a847d280ca43e97eaef077f7c807a01f3555e82cabe2eba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236633, "uuid": "17664955-aba7-4f6e-b864-af96c01b9964", "value": "T1DD452353E5FA8023DDA52730C9FB03831E32BD226D55827B1BC2E46E6C72591B63536E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236633, "uuid": "43055b0e-9bcc-4844-b248-9ccbf184aeaa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236633, "uuid": "1b28eeb2-6560-4048-9974-a577c879b61b", "value": "24576:vyI+UWE60Rwn0LI4/S6i0Pyz2lTwvrcKm/OL0RAu:6Iwn0LpHqz2lczpmVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236633, "uuid": "1a199872-1ab8-4850-b193-16b30bf8da9a", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236633, "uuid": "180bce78-5c91-455c-b6b0-5595407c73e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236633, "uuid": "f32c4d03-0854-43af-a7c0-d3b07c5161e6", "value": "bd745f43c090fd7fc5aeae0ec6b48d5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6153db-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684234045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234045, "uuid": "18445b0a-6a3d-462f-8b05-5921831c5b58", "comment": "Malware payload (SnakeKeylogger)", "value": "93ef17a7d7ebf5cc5f72b42d8a98af5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234045, "uuid": "95896885-8834-4e7d-96d9-e4ba108b27bd", "comment": "Malware payload (SnakeKeylogger)", "value": "f23f7ede6683e9e571279757d2a2c25493d07b2a98ab653685b4dbe93e3d1b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234045, "uuid": "4fc25f73-8996-402d-ad3a-7317e48a3846", "comment": "Malware payload (SnakeKeylogger)", "value": "f776e85c6bf311c99ae76f55a732b6ad3ca0bfb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234045, "uuid": "d8425361-509b-475a-8068-9edf170c0c54", "comment": "Malware payload (SnakeKeylogger)", "value": "a0e4d656a4b9bebb0346e04d0006d0df4e6f43d205d026b2589323d0b6dafbc115a55da1a5e6a1597315502d8e977b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234045, "uuid": "58c44c51-aeed-4b78-a46a-a411b13622d8", "value": "T1D7053CE1B09488D6E85B4AF1BD3AB83014A37DDE94E4811C16ADB71666F3352309FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234045, "uuid": "d046a9c9-806e-4da1-86f6-1a94b7bc44f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234045, "uuid": "e513ad1f-bbf5-4519-8dd1-f30512f6193c", "value": "12288:kYqv5VhxWO79KEN4br0LoUOSEXJqPk1t2b6Ig4uvV9D:0nbt9Nc0LXOSE5qPk1wmpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234045, "uuid": "5d65810c-dfed-4d33-91fd-43dc6fa71229", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234045, "uuid": "9acfadcd-581d-4351-ab70-f81eb7d00cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234045, "uuid": "c73f861b-3fe1-4ecf-abd2-577bf75bb734", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64fd85e-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1684234305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234305, "uuid": "dbd8271e-c124-4daf-8702-964b57615103", "comment": "Malware payload (Formbook)", "value": "f51150f6c694ce9b88e003676fbf7339", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234305, "uuid": "a83366e1-540c-449c-98d1-aeafab4d92ab", "comment": "Malware payload (Formbook)", "value": "f2c01a2894fc6f41a5277342ff771175ff1860fdda3b9e913e18f0d3489ba067", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234305, "uuid": "37bd970f-8370-4442-949b-a4c25c5d1666", "comment": "Malware payload (Formbook)", "value": "f574893c88c7b4571bca8a77776d1e6175e306fc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234305, "uuid": "edddb95c-84cc-490d-8a15-2e3492e2b1bb", "comment": "Malware payload (Formbook)", "value": "347225d0ea516ce613088dbb47fa60fdb0b905a2f02fdb900cbe3e2eae38db012ca47592c7d384d458186631c6d635c9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234305, "uuid": "2d8ae016-fa01-4ea9-b999-041433365ae5", "value": "T165034C5EE79B02648F5103B3530B1E889ABDB23DB35551B2786C837033E9C7D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234305, "uuid": "58bb04e8-bc35-41a3-9b86-bcad1ee0eb50", "value": "768:BFx0XaIsnPRIa4fwJM6bLvnEZpkREHHcLj6P9cHIvRrIRH16:Bf0Xvx3EM6bL/EIecn6qHIZroHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234305, "uuid": "f198880f-19e7-447b-830d-b1cb46817fd5", "value": 38155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234305, "uuid": "57ddbabb-8faa-4724-ac06-232ebc120790", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234305, "uuid": "7e804ba9-8258-4fae-aa2a-c25d892d3b2f", "value": "PO20231505.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921cd82e-f3d3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1684232553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232553, "uuid": "c93b80db-5b10-4036-93bf-eeea24398e6e", "comment": "Malware payload (GuLoader)", "value": "efbcd56b2a63bc53cc2ad355f414bcdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232553, "uuid": "287c7e09-4c24-4161-96ca-aea186491494", "comment": "Malware payload (GuLoader)", "value": "f3b8bf70686bcddcd2e2a6c1abae4de80f03bfa98b8087763ef3bf5276d1cc90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232553, "uuid": "77a01049-eba3-4381-8c1a-6a5583d89546", "comment": "Malware payload (GuLoader)", "value": "573b2a179334951572b5f09f0fdc64929105b06c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232553, "uuid": "291fedd0-add7-4b62-b449-01bd30ca4810", "comment": "Malware payload (GuLoader)", "value": "e0a5fb79857043985536bced7137208d8b27c433ff6f5e738b5e549c44f654f115f04280a0283990aed6459327d7d296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232553, "uuid": "7eb24d83-9dc7-4834-8af6-e3ffb67df292", "value": "T17C059E62A94059C4F69909F590ADB87842DF7E0A98B4B11D3E447122FFF21E20C7ED9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232553, "uuid": "8de5db58-34b4-4515-9798-971ca620ebea", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232553, "uuid": "811fb089-493e-41a8-8c09-7be58b2a9aad", "value": "12288:jX/c1QavcW/wo9EytmGPuzG0qGJvmbo8sTi+cduT:jPc1FvF4o9rtmTzHvELCcdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232553, "uuid": "3770495b-164e-468d-9b49-85cd5234a9da", "value": 839144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232553, "uuid": "b77fbd32-f650-44a4-a00b-a0d6ec09806a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232553, "uuid": "13775695-e879-4921-948b-63e26764b3f0", "value": "Invoice and PL xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7f8018-f37e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684196199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684196199, "uuid": "4908ac10-7c11-4a1b-b8dd-5a79d5db4c91", "comment": "Malware payload (RedLineStealer)", "value": "2d8202656b05a8e2f5c7c36521170e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684196199, "uuid": "bb259571-cdea-4206-8455-65582a65f670", "comment": "Malware payload (RedLineStealer)", "value": "f516e21047e473abfb285bd15fd860e07a0e88706f3617e8988136ac0ea75275", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684196199, "uuid": "6e353ee9-9020-43ca-ba20-75de09f76424", "comment": "Malware payload (RedLineStealer)", "value": "c7094706e29d2b0ac7e18371b7aabcf12d9bc259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684196199, "uuid": "1a485abc-cf45-44f1-ab82-8c1e26367db6", "comment": "Malware payload (RedLineStealer)", "value": "b3b4b5aa8f644f0fe7ea97b34efd520e680b994e29c3a632a41f60936844ce237fadac02d0e475a0ed9c3fdbf2bdbc75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684196199, "uuid": "9711b245-2fb0-45b6-a02a-dbabe187de1b", "value": "T112452312A3DE4475ECF0177158FB07A30B367D616D65C32E0AC65DAA2CB3691A831B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684196199, "uuid": "3ab9b4e9-6335-4574-ab5e-a111d3ea9f53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684196199, "uuid": "258e8934-e65f-4aa5-a535-7e1d0cd194ba", "value": "24576:nygVrbomTIu/S900nM6cxcAjE/bx8AWsQPt9:y43hqMhcAo/N8AWsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684196199, "uuid": "46aa9d96-9648-4278-91df-f7dc7664409f", "value": 1176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684196199, "uuid": "dcbe9f25-fb29-4a13-bc4f-cbce7006b3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684196199, "uuid": "ea672cc4-6d05-46f9-8982-cf50124b7762", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c92c1d-f42c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684270709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270709, "uuid": "02e2a711-c928-4659-9bc7-4cfd70c180ed", "comment": "Malware payload (AgentTesla)", "value": "7ada39eaf15afeaa4666c44710e843ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270709, "uuid": "2ae782bb-d499-4168-903a-3c2c2ccafb85", "comment": "Malware payload (AgentTesla)", "value": "f56410c3c60314f4335561c9cc20256e7f02e078d6ba55bafe2534efdd9d9a7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270709, "uuid": "3086fbe9-31fc-41d2-948c-d104bdf03ff6", "comment": "Malware payload (AgentTesla)", "value": "9c2fb049b66372c042c6588ee0011f8e23317563", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270709, "uuid": "1fac45da-5421-45e5-b2d7-92e67e1dd317", "comment": "Malware payload (AgentTesla)", "value": "02217ccb640604eaa729938a18780369230b0cc06b5d980a61d528cbb5b28259a79593a38b7f3be4df11330d0c61f7b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270709, "uuid": "ed61d229-c5aa-4252-842a-5e6bdacae77b", "value": "T1F6F4BE2071BD4B45E03E97F156A8F93803B274A3A6F9DB211EE1B4CA5A61F005F45F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270709, "uuid": "5f79efd6-8878-4ebb-ba7c-ac45f35587d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270709, "uuid": "fd6eb4ef-4ccc-4293-9211-4ac8d464ced2", "value": "12288:XsGXfoqRmCJJH9ifDjwz4r64csWpu2c13f10Ayc7KzzLN8ilv5/:XbXwGJ6jrm4nWppc1GA/7Kxr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270709, "uuid": "07ffaed4-ab09-4bf2-b28a-8d3dfbf0f964", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270709, "uuid": "e723c658-58db-4ae4-bca1-3b6e52f6bcd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270709, "uuid": "4653134e-faa8-4422-a0e9-e2f704b4ede5", "value": "Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e7c1de-f38f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684203332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684203332, "uuid": "577d52d7-5bb5-49b7-b516-4bae6e5a5476", "comment": "Malware payload (RedLineStealer)", "value": "9e3490b5c53384b5db2d0bc5cca06beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684203332, "uuid": "b89ce2a7-9c47-413f-8312-4c6b44f1c4fc", "comment": "Malware payload (RedLineStealer)", "value": "f640de806454b0e3667a2c3f92fb7b733655e483564011a98b71c11289e0c56f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684203332, "uuid": "48a69abf-ecd2-437e-a357-2405529d0ea2", "comment": "Malware payload (RedLineStealer)", "value": "5a0194bc24a8d55f560285508c5df5bd6bfd5daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684203332, "uuid": "8d348f11-d324-4174-b0b3-fa0b4c059a23", "comment": "Malware payload (RedLineStealer)", "value": "8313da48af0c59ef6711bb766a0aea45cd2c9976f53600ccb7b5edee27670afc255a165b029dd40bf485bab96507f780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684203332, "uuid": "e15ec7aa-b77f-44a9-b1d2-f748f1274282", "value": "T1E3452303A7DA41A1DFB2273026F607931F383D605D28924B3786AC5A98736F5B27572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684203332, "uuid": "7235bc56-fb14-4593-b79f-c502a965ac75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684203332, "uuid": "ae20bd4b-f223-48e2-a749-1cd3d8ecfded", "value": "24576:xyiuEAMoF6g2KB0uUH/Io/S8hy5iU7880vZYe7uyXMoff9XzQpOu:kidhoFReuUfdyD880xFuy8OVXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684203332, "uuid": "73b20ed8-755c-427e-bdfd-112b730ce717", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684203332, "uuid": "1424c18b-f799-4af5-87e7-35dac52f1e80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684203332, "uuid": "e09fc029-ceb0-48b6-8d27-9c792a59ef70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8352e2-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1684234983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234983, "uuid": "b94ca627-d4d0-4c52-9ad4-158935f7cafa", "comment": "Malware payload (zgRAT)", "value": "d0d039e99de81646b09cdc70c03f5a3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234983, "uuid": "8f906cb6-f54f-4aec-84f3-5044af3ca95e", "comment": "Malware payload (zgRAT)", "value": "f77659c433b2f705397113b64ca555b1accb32d92f4033e391138480108342c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234983, "uuid": "f2a7a36b-70c4-40b3-8f25-634724d2a5bb", "comment": "Malware payload (zgRAT)", "value": "1fd9b396492e0e3a917786c95e9522ae5e140500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234983, "uuid": "f64a18ce-5a2b-4535-8262-9a4c31ba3a8e", "comment": "Malware payload (zgRAT)", "value": "a4736da11b28fa779c738fb61cbf3d6dd6d481997fa72a929a703c05a3593c852e4a2df93afb1836bada24cc30371c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234983, "uuid": "1566e360-86bb-4193-8c0f-d920bf499705", "value": "T1637402063BC79694D57E9E71A0E2452003F1BBC323B3DA917DC885E11F45792AEAE78C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234983, "uuid": "70da1486-344b-4253-9c8c-768baaedaa77", "value": "6144:rHP8Dd7kzJEBbwXkEJiCs6KS5xcfpHJGXK9eNe4UFm5SlEmn4:hakXkEJ86KQxwGsYe4U+SlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234983, "uuid": "1b27c348-41a2-4201-a2a0-48c055f65f22", "value": 344648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234983, "uuid": "66d0eac1-1146-45dd-baf2-e65aa271dad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234983, "uuid": "9d7f831c-5dfa-425d-9817-966433e542a1", "value": "Maynew-order #Brazil-098484OBZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5560e6-f39f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684210161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210161, "uuid": "61650645-59a2-4ea8-a8c5-d762d276ec07", "comment": "Malware payload (Mirai)", "value": "2ca7f9d34b913c3a0ff16347800c85c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210161, "uuid": "3b727981-c33c-4933-8dc8-df73727d752b", "comment": "Malware payload (Mirai)", "value": "f7cbaba74f753916307e93f8184d172e29f2f217596002dd869224aa98debad9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210161, "uuid": "99911259-ce80-4714-b278-0fd29f7c2f71", "comment": "Malware payload (Mirai)", "value": "82c3cffc2caedfd7652d6df66cb0273859060035", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684210161, "uuid": "eeebe2f0-b1cc-466b-9016-9f8c30af5e76", "comment": "Malware payload (Mirai)", "value": "3bc0a15802ae919358d14e2bbda71432f317e040154ce6e40294f400f3196b2b48ef5d5f467f767a7c38a3b51b9f8301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210161, "uuid": "c903d588-5e1a-4538-8597-32443ce736f5", "value": "T12DE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210161, "uuid": "ae6c69d7-ffbe-4f74-8989-0674649e00a5", "value": "3072:dgZc9h1jlnLA2PiXYeyCcQVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZQVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684210161, "uuid": "0c89919b-4697-4146-bbad-977f993271b1", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684210161, "uuid": "e8d1ffdb-a010-47ce-a971-9f9f1aa125a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684210161, "uuid": "06ac60ef-5051-4de6-89aa-f98220010a28", "value": "2ca7f9d34b913c3a0ff16347800c85c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea531c2-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684232762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232762, "uuid": "2cb71b3f-44d8-45a5-8037-913b6890b885", "comment": "Malware payload (Loki)", "value": "dacbbe9e13cfb6d9c69245c1fbc2ba43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232762, "uuid": "c79865b7-411f-4c2a-b5e4-b85bcda19130", "comment": "Malware payload (Loki)", "value": "f9dbe1921bff42503418284402eedad115506b454ffa177d32d25802d1a9890d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232762, "uuid": "f98cb131-a2d0-46ac-ae2c-80b2cfb8e3ef", "comment": "Malware payload (Loki)", "value": "8d237535b58fa9ffec52b4e43edee63137242b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684232762, "uuid": "40300264-0cd2-455a-bb07-6e1d49e504f5", "comment": "Malware payload (Loki)", "value": "d240811fe5c1b6a79ae4324cb4ed0bb60ecaa62e8ef8f4fb4e16dc02c4bedbaabf095673b1841c19841956d2f6ea0c24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232762, "uuid": "6489371e-9f8d-4f88-bdc0-0f3b3b1157cf", "value": "T199B4DF7010DE8A94E41FCBB161BCBC72033271E3EDE9C9751B26A284CE6AF546D4991F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232762, "uuid": "1e185e02-bb91-49ea-a1f4-7ba509814ea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232762, "uuid": "d5041eb2-6375-4814-aa67-0a3192151f79", "value": "12288:vKvntv5RPCeqy8Qynb3Fy7AjeCt6anonpzq4:C/NHCez8Qynb1yMjHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684232762, "uuid": "0f79b8ef-af06-4cc3-b310-4aa3ff55743d", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684232762, "uuid": "63c3bf1a-4eb6-4cae-82f8-4d561513cbb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684232762, "uuid": "6356a8cb-856a-41fc-b5f4-04f20053de33", "value": "yNYj5EXq3gEheac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd7a55b-f42b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684270398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270398, "uuid": "b18eb2a6-3562-4498-b828-95c9f359ef28", "comment": "Malware payload", "value": "c6a1ad3b908f951f9ecb96d579093cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270398, "uuid": "5adf5ad0-d9de-4d1a-9f99-752cea4dcb28", "comment": "Malware payload", "value": "f9fa348fde568abdcd5bf104b211e67f3427614c05349c1bc2506adf16998a68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270398, "uuid": "5555d191-3e6e-416f-8dce-e8f9acd563e1", "comment": "Malware payload", "value": "5492ca6f1749e441ddc70e4974fbf407ff6ba3c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684270398, "uuid": "9acf7a1b-f245-425b-916d-6520d267eeb2", "comment": "Malware payload", "value": "ed399de4773e0d96b52b0f7d9344f8536d6da9852467d85f0947f0e1ebf677fd6e2363d62e44db962cd6bd66c9bc83f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270398, "uuid": "d24739a3-5397-4a97-9b11-25ea1af032c2", "value": "T1DFE3C3915BF98816F6FE6BB9FC7101C597F5FC46EE33E20E040028D90A95780EA527A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270398, "uuid": "7c7f5bf5-6412-4194-9f8d-448581399325", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270398, "uuid": "d0f479de-e3c1-4897-8dd5-08ad845f786d", "value": "1536:Jq0vwxW9ldT+jarKVtNPDR7zqN912qfr7KFBgc5YoPaNWrL4qyA6eAyk7IpS3VRc:VDEaGtD7qfrCj/pKEJLQgs+WoMdp7rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684270398, "uuid": "ccd71b73-a664-4f16-8f64-524df136660a", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684270398, "uuid": "5b929619-610e-4f0c-96bf-95eac93b79ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684270398, "uuid": "fbffead1-50a2-4356-9ce4-466d86dd1481", "value": "hpp4-oba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f97a23-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243780, "uuid": "7f1b284a-c6af-4492-bc24-af1b6f1b7571", "comment": "Malware payload (Quakbot)", "value": "07dd54fd82c6beb21fa8c2119eecb352", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243780, "uuid": "abcfbc6b-548c-4b52-a540-6c6bc9cacc74", "comment": "Malware payload (Quakbot)", "value": "fa2dc81918c692a5e34a7ab8c04831a431dee4edf0de7230d720f7c5248443df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243780, "uuid": "6066ecd6-0f31-4017-b4bc-06c7c5ad198a", "comment": "Malware payload (Quakbot)", "value": "bae0f30a9ce95b9d4e9e861beed75999da6a49cf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243780, "uuid": "fd0ee418-083b-4240-aff5-495e319f7699", "comment": "Malware payload (Quakbot)", "value": "307f3d9a3a3531da24a76d53d28b8692bae9ceb0e6b7d884a7109000295246350a8664f8c2cd3985ab784646edc582de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243780, "uuid": "c4bea34c-1d72-4598-834b-2b39dd59b52b", "value": "T162548558435528534B5F6F36A72D84FAAEBB0EBDD2A4948BF80BB241B5DFC4CD0D1221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243780, "uuid": "d43baef1-ae03-4202-9388-61326937d041", "value": "3072:PuAA+wmXUKtMAA0Gw/RhB/qKK/RHoQ63c9dX9BPlY7vagN:PuAATzKuAA0xDB1UyidXBav5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243780, "uuid": "3625090c-0174-49d7-9d12-38806e219544", "value": 280651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243780, "uuid": "79d3e96d-c295-4cb4-9dc3-7a11882f9b71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243780, "uuid": "4c83f57c-b1e7-4d1d-9811-097178ba69db", "value": "Nksd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cc43f5-f3cf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1684230625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230625, "uuid": "65bf9174-98b8-45ad-bb30-32f62a58c8e6", "comment": "Malware payload (RedLineStealer)", "value": "4f4e4ca72cc5b9966629589f4e8289ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230625, "uuid": "4e61faae-b910-4457-b4ae-08b9f14378a6", "comment": "Malware payload (RedLineStealer)", "value": "faa60be2c9bc1b7d1004f166c16e8c40b9c474aa50ee03af578145d82a44004c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230625, "uuid": "37e335e7-2e46-4fc0-ad5e-15f85b9733a0", "comment": "Malware payload (RedLineStealer)", "value": "264efe42cf18ba8f3c6da54f7b1c5582a137fbe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684230625, "uuid": "67066735-4ff7-4861-87c0-78eebcba001b", "comment": "Malware payload (RedLineStealer)", "value": "6f17ca8f8462e6807dd786127759e6d1c69586d8bbc32dc789297fdb8e88fb7c84d731c5d6b0e6f2d12a65571ee1def8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230625, "uuid": "9aebd56c-3b06-4f80-98dc-3ecb2043278c", "value": "T1D9452352A7E60432DDF497305DFB0B831E717E625EB8825A3146D86A38B33E1627532F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230625, "uuid": "0194c17f-7c53-47dd-b22c-6c4a0c926100", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230625, "uuid": "9014330e-bcc8-42a0-9a0c-6c11d6f2bbd2", "value": "24576:iyLjb+LiIw/SuB4aCc5dDUN87GCSxY4n7PZjzH9ai:JKLiZRqaCAJGXxZjzH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684230625, "uuid": "e8518723-dc97-46d0-bd86-fa33f31ae616", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684230625, "uuid": "8ff1e167-6441-4a86-90fa-9f951b292d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684230625, "uuid": "f4c89138-da52-47ab-8fce-7ef4d5430c9a", "value": "4f4e4ca72cc5b9966629589f4e8289ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7533eb4c-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684233793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233793, "uuid": "4881c61b-6ce6-4ec9-9ed1-bed9b78b750e", "comment": "Malware payload (SnakeKeylogger)", "value": "e15b9c7de0e880d8d4b4e5285aeb26be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233793, "uuid": "01670700-342b-4d64-b652-ea8ac3058809", "comment": "Malware payload (SnakeKeylogger)", "value": "fab58afbd986a4fb766f06edadc553c09b6422d1a54100f8ef1aa589f28f32f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233793, "uuid": "720ae6ef-24c4-4e2b-ac71-5c3c94ecfbcf", "comment": "Malware payload (SnakeKeylogger)", "value": "de403cfb413befd7e2b1d5e8410276e7d6c477a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233793, "uuid": "a1c76f95-9498-4444-89de-6e311f0433e1", "comment": "Malware payload (SnakeKeylogger)", "value": "1eb69cbb47bbd0ba6994a1caef808449cae3bd1fb5a7f571449defce315bf2e1ce084507ae5087619ac1876355b89e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233793, "uuid": "20005337-5157-4ae5-a000-7e250939e45d", "value": "T101C4D07060AE4B94F01BCBF165B8FD72037274F3A9D9D9350B65A1C0CE6AF502E48A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233793, "uuid": "ff559253-2df9-4721-9af4-c3dfd98d163b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233793, "uuid": "d370c1d9-d838-480b-a45f-71a1aab5ff0f", "value": "12288:5Y0v5kwUdx/RbOHLL5RAwiyzf8kLnXhOUryeJ29:VlUP/R67CyzNXhOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233793, "uuid": "beff0591-48b3-4f40-9bee-0e900af31c0b", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233793, "uuid": "365fad39-4042-4827-b758-e53c09db0605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233793, "uuid": "296556af-c8fc-4d6e-9c6e-1858499726c8", "value": "MV GOLDEN SCHULTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bda7559-f3a5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1684212705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684212705, "uuid": "d0480ff4-f6ee-47ff-9572-5ebc31630419", "comment": "Malware payload", "value": "b3ca41760e938781e0be4b3564b523f6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684212705, "uuid": "3240b5af-87ec-4436-af5f-e3b009081861", "comment": "Malware payload", "value": "fb37ec57421b869a041ff5939b33c96d834f254d72c41b8bb943dcbb18108633", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684212705, "uuid": "d7a8d04f-f9c3-49c5-a041-913dbe5b6774", "comment": "Malware payload", "value": "0718aa8859f65bf1b7bcb79afbd8226505d83123", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684212705, "uuid": "4f9cc320-bb29-4e2e-800e-fda6dd30f80e", "comment": "Malware payload", "value": "fa36475717ef10830bea88a0fdc4167c50563d2b9cdfc29da5f0c22cbe4f9ac6c4b9d6323837d463284fe7a80ffaf319", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684212705, "uuid": "02f0e820-5b0c-4a81-b55c-59a30a16563c", "value": "T1EC873377FC921DD7133F0A762BE239992E677415D01B782AF2D5634292835322DB0FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684212705, "uuid": "c260a0c4-1764-44d3-a3e9-f766aa60adda", "value": "786432:nGKO0+PQXf4gT8MlGs0TkPr47Jz94xAFocOhdS2n+lC2xHnJeJu49Sy:J4PQXN41JTkc7JzqqocOrSGL2xHJmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684212705, "uuid": "aaef8ed3-0a1c-4ee0-80fe-b51be8acf97e", "value": 36651073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684212705, "uuid": "3674117a-d6b2-46f0-8a39-b233560aa481", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684212705, "uuid": "1a6a3f4d-5c4b-46e3-95bd-ffcc31518948", "value": "metamask.apk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb942d2-f3d6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1684233992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233992, "uuid": "427e16c1-2072-460f-bdaa-c9610432c250", "comment": "Malware payload (SnakeKeylogger)", "value": "ac87e5e4535704d6a1574a7734413751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233992, "uuid": "1d070909-b98e-45ae-ab11-ef7728a6ef80", "comment": "Malware payload (SnakeKeylogger)", "value": "fb8564efb19ac7b2777934eeff430c908f3a3e4989ccffcfe0b82453ac222c8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233992, "uuid": "e9b76b8b-4d2d-48ac-88d9-d5986252feed", "comment": "Malware payload (SnakeKeylogger)", "value": "4843ede63dfa47449f81171236cc520b528604e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233992, "uuid": "df2666f7-e064-4c85-bdef-e762ccfc156e", "comment": "Malware payload (SnakeKeylogger)", "value": "aaf7c62e65f74f2b4ae185b07346617163666cba558067bf94741963f0a6b6639c311d56b5ec5accf75091e5f5a9e2b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233992, "uuid": "4d7fe0f7-a244-4c36-830e-1ea8c66c42ca", "value": "T1F1C4D07461AE4A80E01FC7B065B8FD32033274F3E9D9D9350B69A5C4CE6AF506E84A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233992, "uuid": "91de97d9-0325-4da3-89fe-d49f45664d0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233992, "uuid": "2cfc6a0f-ba13-41cd-952f-7e02efa88b3b", "value": "6144:CYMCpEvyci+EFfaMajwPT+qSRRmOBJq21TsUGkLZaKPur6nzBFKSOZB3j/XamoP8:CYgv5fWZYs+qSLmAJXNqcbFKSm+NPad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233992, "uuid": "994c714a-0513-4c05-addc-6029ae1d1f39", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233992, "uuid": "6b44ae36-8054-46ad-a0cd-bd9cc9a31c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233992, "uuid": "988677b5-7a9a-4b5c-a787-f9d3f524497b", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d00b6f-f3c7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684227370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684227370, "uuid": "d2fdb7e2-1286-4db9-919b-71c4efbb9abd", "comment": "Malware payload (Quakbot)", "value": "ab02dcb1b9fcdb78d4260d01d8dfcc1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684227370, "uuid": "d62c308d-a678-4bd0-bce5-d19bd95a144b", "comment": "Malware payload (Quakbot)", "value": "fb9826579241237ae9590d669ea505a59b49af989ef5a2a51be23e59a685b761", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684227370, "uuid": "bacf77ba-08e6-4e99-83c9-6a6f9cd5e12e", "comment": "Malware payload (Quakbot)", "value": "5018cd742c1672c3a3364e8fd3b101ef466250ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684227370, "uuid": "0af8efd5-9610-4ef7-b755-df40f346a18d", "comment": "Malware payload (Quakbot)", "value": "bd6a47b63a95cce6acde7eed068e44b922d22f4db334ce6592c0f1dc34be41a08712910165e3055ca68189673c5206ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684227370, "uuid": "7fc48ec4-55e5-4f4f-b8c9-4e0be43569b4", "value": "T1B074BF04FA8359F1D080657521BBC3BB3E399A211727C6D7E7AA2F569C501E09A3D3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684227370, "uuid": "569c8b61-abb9-479a-a702-cccbd3db990e", "value": "03e0265867ad1e2e0d3ff921e60d4139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684227370, "uuid": "d351df0b-9707-4a62-9e3d-e2f00f106b60", "value": "6144:a/D0Hb7UDqr1yb1tux77q/Mt12SF7GhUdHMGMIvHQgx77QxxgHb9VnpTBJjT8UZl:oD0Hb7L1yb1tux77q/MW6uIvwO77cgHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684227370, "uuid": "12c285a3-3e3d-427a-a159-95b2cc124a0a", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684227370, "uuid": "b4b4e452-3ed0-4447-95b6-7d78e1c40cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684227370, "uuid": "aa6a3521-5bde-44ed-bce2-3eea81934fa7", "value": "aQg9MHOT1WJY.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f865a9-f3d7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1684234309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234309, "uuid": "1fe76979-a3c7-4579-a0db-a0cd18f35dbf", "comment": "Malware payload (Smoke Loader)", "value": "86e893d59d327a8428587fefd183afdc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234309, "uuid": "65024ccf-c702-4edf-b5cf-b37b621fb762", "comment": "Malware payload (Smoke Loader)", "value": "fbbeeb61e58f001c80e1566d80d2a0defdbdb558f5d11f745b66d25dd241302e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234309, "uuid": "8cd275cb-8fe8-4f5c-b713-d6f026ec9299", "comment": "Malware payload (Smoke Loader)", "value": "481bd3469621bf1ce7213641465d23739296ad4c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684234309, "uuid": "6cfbc5db-de88-485f-a8fb-4fcc735c3941", "comment": "Malware payload (Smoke Loader)", "value": "e34c4c4ddc1284030d4d098b4e7d41f1280c1e53b28fa9ccd616371e0798885bac0c294be838cb66554aa734e7b8e6f3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234309, "uuid": "c67dec20-1239-47c7-b8a5-c1d8ca89a474", "value": "T1C6650112E985AD5EC64507B12B8B7888631DBE72BAC41A43375CB74E1FF3AA4E543C0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234309, "uuid": "5f93aab5-733b-4e38-9b43-7a172d73a0a4", "value": "24576:XLKU/EDLwBkL7/yDLwBkKN+MXUV+MXUpNsMQZWR1isyq/n6Xef/1nS:XLKGzmxH+MX6+MXCNsnZW1VNyEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684234309, "uuid": "d1a87e7e-d4f7-4f9f-87fa-c5177fb4211b", "value": 1421824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684234309, "uuid": "178667e1-479c-461e-a755-fec6e9846c70", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684234309, "uuid": "c5014b07-382c-43d0-8129-df1b7f4acaea", "value": "PO-112030087.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e47c8e-f3ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1684244614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244614, "uuid": "6c7f7d9d-386f-4501-9de1-ac2056c6ba90", "comment": "Malware payload (StrelaStealer)", "value": "58e0c1f9d82603f89ff40c9df234c145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244614, "uuid": "22431bd8-9d99-4fe9-856c-eb3c071bf397", "comment": "Malware payload (StrelaStealer)", "value": "fcabbc5486b09579464f488772e07088342217e2f6a1b70474bc785ff4e27b68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244614, "uuid": "06e93e49-0d01-43fb-834d-68ad3c992963", "comment": "Malware payload (StrelaStealer)", "value": "5fa240f3db3714c3b9bc05575f626900cd04fc5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684244614, "uuid": "62e72890-3f41-4281-867f-8519cdd0c846", "comment": "Malware payload (StrelaStealer)", "value": "4b4da6a85990352dd8e99a18e70a00bd52cf92d9fa37993125793570772fd9292c246a4cfd1bd57614b5b633df3769ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244614, "uuid": "c88d317a-f003-40d5-b1ac-7777507ccacb", "value": "T175146BAC12D76D0EED908C30DADC66DD8EAB2DA5A75FCDF080B09F2017DCA559C47826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244614, "uuid": "60f8d58c-042f-4005-bc0e-5338a7b026d0", "value": "1e3c4e072d6a52ba210cdd5519484719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244614, "uuid": "051485c5-3ca6-453e-bb79-0093e316dca6", "value": "3072:RXDNeErDHsehR01hoiYhxg/qn97ZZlKGJKEuQLkP34MsQC4hDSXbm:A+iKJU4iP3hC4dIbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684244614, "uuid": "13800ace-81f4-4ab4-a486-9bbb1e1063a1", "value": 197512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684244614, "uuid": "0b066f05-7c57-49ce-b184-6daa7eee3da2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684244614, "uuid": "c5958e43-5904-4134-84a0-fc5aa6f47b4e", "value": "FATTURA_.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da68199b-f3d9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1684235251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235251, "uuid": "d3569d32-42ac-4e29-9677-d50907b3eaaa", "comment": "Malware payload (Loki)", "value": "6d551ca5cf5fcc90aa558b8a496114ed", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235251, "uuid": "7deee1d4-ba88-40be-9903-4c8db948d6e6", "comment": "Malware payload (Loki)", "value": "fcb0cbb8ef581523f208c4e0e86f6914364c5d747c8039547344ee85210066d6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235251, "uuid": "1aebaa55-fc32-4970-8062-cb1a0260c88a", "comment": "Malware payload (Loki)", "value": "adc132dd7b646c7a7d53f0ceda266da0da2965b5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684235251, "uuid": "58db0eb5-cebd-47ed-9e4f-b8f2e2b3174f", "comment": "Malware payload (Loki)", "value": "768c8509b0e737f7bbbbeea6c8803d88efa16d65a6a60187e65c09e0c6e147e72dfc0f13dfde82b52094da34ece0f36d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235251, "uuid": "0668fa3e-8e32-4ca9-ad5d-8882e915f237", "value": "T121B4D074519B4AA4E41FCBB165FCFC71433170E39DD9CA740769A288CE2BF506E8894B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235251, "uuid": "e390d6dc-8988-4c77-a668-5e8678f38fee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235251, "uuid": "d87dc6b1-3a80-4c60-9e39-5f67cadf0d20", "value": "12288:2lhnKv5lr2fdmN3ONU9bql78Z2JLDK5lKBHEd:M9mH2FuiZRKEHEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684235251, "uuid": "296e4494-ff46-4489-8463-fa3fcb941774", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684235251, "uuid": "856fe6e1-edd9-4342-bd4e-3e37f99b84ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684235251, "uuid": "74cbb487-7e36-4a58-a32e-9ba65c6fbfaf", "value": "DHL Receipt_AWB#20458209822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3798b22-f3d4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1684233011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233011, "uuid": "26cc4156-27ae-4a1f-a8d5-6ed1180373c6", "comment": "Malware payload (Mirai)", "value": "734d9893ebdeaec768058523d01c2e80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233011, "uuid": "4b329468-cc54-4f61-a667-386f70a5eaac", "comment": "Malware payload (Mirai)", "value": "fd13693e7955001c800d3ee1d3384923103b1a535f9eee5a94250e2a66f57663", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233011, "uuid": "0e42cd59-d663-4e05-bbe2-3a04176ded04", "comment": "Malware payload (Mirai)", "value": "7c438ff063f811eb0c202441cbcfe69c28066534", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684233011, "uuid": "46d89ba6-c587-4baa-8c9d-16dcbbfc2272", "comment": "Malware payload (Mirai)", "value": "5c10b988949cfa39ef36b78cc64942e20434dca6a2b21a32900880ecf7c1388b9c3a521f169065c4426014a5053494ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233011, "uuid": "ae7fa69e-4c34-45d9-a621-4a5cdd91d1b9", "value": "T1CD735D24A97D2E26C0D4A17B62FB8361F2F6230E2570965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233011, "uuid": "b9959379-9c58-4443-bad3-47a1eddedcf0", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8f:YwfdNu4cmZvFqI3w7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684233011, "uuid": "f5ea5cf3-045d-4f40-b756-c7d1f9d46033", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684233011, "uuid": "27d64ba6-8f67-47f2-b672-e1d9f308d97d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684233011, "uuid": "3766ba34-e35e-4b11-a657-578c81542b2f", "value": "734d9893ebdeaec768058523d01c2e80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de25aa1f-f3f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (EternityStealer)", "timestamp": 1684245136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245136, "uuid": "be6ce9a0-7757-4028-8b9a-a82bf746c1da", "comment": "Malware payload (EternityStealer)", "value": "2ae68a2dba8b4d6279d32fb7d70955fa", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245136, "uuid": "fd071d0d-4fc7-4760-b3cd-a8c44c33fef7", "comment": "Malware payload (EternityStealer)", "value": "fdb6a85d8a54244ce523286412d18ddefbf2b59e54f59576311d9f54e68a398f", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245136, "uuid": "1f32aacd-b9da-4fa2-ab9f-88444dabf220", "comment": "Malware payload (EternityStealer)", "value": "8a575e9c5c64ff797b9a7dca776a816e444f7485", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684245136, "uuid": "243b5757-5bf6-4263-94a9-0427031074e1", "comment": "Malware payload (EternityStealer)", "value": "8f7de69e694740c7526199684142b993fbda7ff6e498421418471d308882443a47253df0a2d8fbededf2d75b9ee18c0a", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245136, "uuid": "dbd9c044-1b8a-4a83-8981-b02ae6764fc7", "value": "T198B3E7183764462DD27C21798BF257F04373C3922BB5A649AF11F08735B12B95E23BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245136, "uuid": "a6645d1f-659c-488f-a050-0a8a101f169d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245136, "uuid": "d0bb9d58-4b66-486f-8312-6291c732ec3d", "value": "3072:06rBzfCEUmPVES5ca+Rop3rMFnobA+sMDJax2XZZji:0OBzfC18ES5dN3rMFnobW12XZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684245136, "uuid": "9deb6189-953f-4dc9-9e80-9d2876c1524c", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684245136, "uuid": "4a9ab4e9-1dda-4a99-878d-75144d18ebc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684245136, "uuid": "bf6a89dd-f756-4d35-a0a5-11e01d2e8af8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8322ee1-f3dc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Guildma)", "timestamp": 1684236563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236563, "uuid": "368171b9-eeb3-49a2-b336-6b7f51a77979", "comment": "Malware payload (Guildma)", "value": "ff2304b03a0c34a96a9b2dfaae6fe4f6", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236563, "uuid": "8531fd9e-a003-4627-af88-10de02317957", "comment": "Malware payload (Guildma)", "value": "fede07968987620b807e381e65f35cfaa602402dfeb610dfa861459b6b4642f1", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236563, "uuid": "a624d9c0-eceb-4daf-b170-43c2e5396e00", "comment": "Malware payload (Guildma)", "value": "598a471a19bac11098d6beb65f112eebadd860c3", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684236563, "uuid": "db681821-45d8-4728-bbd1-96662814d263", "comment": "Malware payload (Guildma)", "value": "00d4a9fc7eaa305d146e587e9b1b3eaebb4f83ab90bec5937df2fd88a689e9539da468852c7221bb67c2e492141c04cb", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236563, "uuid": "472f4213-2453-4e93-83f6-f61b8d7c3419", "value": "T1DE11320451BE7C45EC42B63AA48F1EC6C766438F171E732FC4E51F15A887E225B356CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236563, "uuid": "1cab3372-e68e-4734-986f-5d2198d4e54c", "value": "24:9g6qx6MC0sICjfw9V5obTHHDR9X5zWB7jpF4a4PY0hgV9V+2e:9lqx6OsISoRob3RzzmX4a4PY5VLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684236563, "uuid": "c5d37467-57c8-442b-acb4-3f1ce0cd7c4c", "value": 1057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684236563, "uuid": "eef635d2-4429-4ad9-8020-b7d181f37ec2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684236563, "uuid": "fc11fbce-7434-42fb-aa84-b5b279cc17ad", "value": "W82195845.633873.33428..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0d1afb-f3ed-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1684243736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243736, "uuid": "e9859de3-5cfb-41df-b96c-b9b63305848e", "comment": "Malware payload (Quakbot)", "value": "59557cfa8463ae5b2c35e0e1fa25cbca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243736, "uuid": "3eac7f27-2600-4640-a73f-a1d6c4b071cc", "comment": "Malware payload (Quakbot)", "value": "ff1e6a515791f043f32d510178b5d953ce1a2c29dbda0bdd26ef822fc1359dbc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243736, "uuid": "00d74c75-d6af-45ec-8cd9-b208c97ab9fc", "comment": "Malware payload (Quakbot)", "value": "d329307a472bfd6c928ad00719194af5aa942240", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684243736, "uuid": "96d15714-e217-4ffe-bf75-c0b1f03d6e4a", "comment": "Malware payload (Quakbot)", "value": "ad62dd74d34856fa00fef05297c4c2572c23fb3595d1a711b56c7efa73a034fe5800bf357c4fb4cbe16dc7b918128acd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243736, "uuid": "09e73bf6-d172-4f95-a2f1-bc06ec8b9a1f", "value": "T1613477514695A8B787476F76AA7085A2CE7F0AB897CC188BF49E3244F5DE6CEC4D0330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243736, "uuid": "4bdd8ced-9b1d-495a-bfdb-168da8682a6c", "value": "3072:+0jeGzG1Fj3Bp95DbgQrmZ/o/fK8kghIpw+/wc8pAUbnD+z75:pjNGFjLo7yK83saHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684243736, "uuid": "807222a1-b323-4bd1-8626-fe9db1a2875b", "value": 236072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684243736, "uuid": "03d8918b-3086-4c5f-a144-6ed7f20bab88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684243736, "uuid": "9018c090-2d1c-4049-91eb-43196644afff", "value": "Gutjejj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a48227d-f3fd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1684250417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250417, "uuid": "655c7d2c-fc8d-4e9f-8115-06e617c6c1e9", "comment": "Malware payload (AgentTesla)", "value": "0c012ed5d1f5cdf3f70fb22752fd729f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250417, "uuid": "d5da010d-96c2-420d-a2f4-93980772e138", "comment": "Malware payload (AgentTesla)", "value": "ffb8ceb54edfed684aa1e6603441465f3ec2956bf9b7b95418c66184bd93f1f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250417, "uuid": "7b648352-cc29-4ebe-928e-bff786c4eea9", "comment": "Malware payload (AgentTesla)", "value": "ce1a6d26e970c13cb224eb8cd6916431f5977360", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1684250417, "uuid": "3cb35416-9b7e-4303-b488-ede0c450f5f2", "comment": "Malware payload (AgentTesla)", "value": "e81a2ec2f7a1aec29a4691f76ec1de17418e9e335e4c6cd3300719505f88077876b8983037eb8551f8feefc5b2ed901f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250417, "uuid": "b4e08fbb-a104-4e81-8d86-7659e537cd09", "value": "T1AFB4233F6C755343321F9D65EE110ABA22E722B13A7FE001769C4A5D8AC4DC1D8EB439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250417, "uuid": "419ea6c8-ef6e-4445-9be1-b5971fcc7281", "value": "6144:08GXN5V+GumFfUwPIKS+N5I/jSgyCcnRdFfRX+Tx+Yadm1VxtEUiJJOS1x1wiQDs:0DgoCKSnjSBH5O8dmHxtsf1wik0ci3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1684250417, "uuid": "680f6a63-9653-4dfa-aca0-a872ee91f9c5", "value": 513632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1684250417, "uuid": "90a2f974-8c1b-443c-a09e-54795b668998", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1684250417, "uuid": "7a3b491f-49d1-443d-b58b-caaa3d8635d8", "value": "Order No. I20220052.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }