{ "Event": { "published": true, "date": "2024-03-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-19", "timestamp": 1710892981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e81ac0bd-4bb8-4332-8e55-aa5b6ba9a0b6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8417d168-e634-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710882372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710882372, "uuid": "d91fad2a-0bd1-49b5-a436-0d8a0e14152e", "comment": "Malware payload", "value": "069d5d5d298b22f34022134adc4186de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710882372, "uuid": "2b36875c-33dc-4794-8714-19ada53cb975", "comment": "Malware payload", "value": "011b7765f64a43c637f0db2b13ae9ef4fcfcae8f1a07cc8a474437795a22fe79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710882372, "uuid": "c8059e74-37ae-475f-ab0f-01d663fcdc5e", "comment": "Malware payload", "value": "05b0a78ad82e35e5859d1fdc3de76f3cd36a866c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710882372, "uuid": "00e73c3f-84e6-4521-b097-3261dcb733cb", "comment": "Malware payload", "value": "ce1524a84ef4439d83c18e9c6c497523ea0a196168d2ae1697c09ac6c2c4b5e8a56841150d0f412c57f134955c7942ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710882372, "uuid": "e7fa8b90-404c-40d2-86ae-b2db8c347a4d", "value": "T1FDD533B166747DEBE917813E4B95ACA00C621AD301E17023B4C39E704EEE6C7F96686D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710882372, "uuid": "7b69b131-b255-482d-bec8-7b374ff75908", "value": "49152:OULwdYcTqW4K2sKrYOC2f/NozOSnn0W1CAZhO8cuP/VG3lTZS724MICxYq:OULwdhJlXdBnnr1Cb8culsTZWCYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710882372, "uuid": "c1bb689b-a19b-482b-9194-b932bbff16b2", "value": 2818056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710882372, "uuid": "90b2b484-59d3-467e-8251-91d40e67a087", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710882372, "uuid": "9c799474-f586-48ed-b047-cccf4884d18e", "value": "CrackInstall.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b78a369-e5c7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710835596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835596, "uuid": "ceb8e5f7-4131-409b-95b9-f0fbc8887c62", "comment": "Malware payload", "value": "8f0dd3a9142d21284047d03d8f0125f4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835596, "uuid": "d0bf1db5-5c75-40ca-a62d-53c1f3c59c86", "comment": "Malware payload", "value": "01d46b910e5e5c0bee77e27f190ace46674465c95267d6ba7744d39cf76ed144", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835596, "uuid": "e3f8a2d0-6013-4cff-b801-62ddcd590f39", "comment": "Malware payload", "value": "a8072c63cc850de98765b48f0e4ed2d87a43ccc8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835596, "uuid": "315e9e37-c4d7-41e6-8bb2-4792232179aa", "comment": "Malware payload", "value": "ebed541c3bb98a2f7428cc26fde1856181b8bdda3a4d3f186e6098566416f29b7f012ffd8e4d5438185bf3bd058cd6aa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835596, "uuid": "9f2d61b6-572b-4379-a5bd-efa6310b24d1", "value": "T17E082356A1A540E8D0BAC1B98F6E8C13EFB174460770CBCB05E0E5A71FA79F19E7E211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835596, "uuid": "2caf2d47-bffc-46ab-97f6-03f463ee6e07", "value": "01796e41742c9f2ea3881f62d9a9c002", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835596, "uuid": "a5001917-3c8f-440a-9e71-b26b99f7dd9d", "value": "1572864:4NSR5q5+vmt3y6l5LU3wmTYu6pB/e/SpUAP54x5Yz9F5SghrbD+uz9uK2hJM0e23:4NSG5++t3tL0/TYlnG/SpUAP5Aez9LXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835596, "uuid": "07437490-3dca-4d49-855b-a8a32ac83b73", "value": 82012672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835596, "uuid": "0bb36cb5-1004-472f-a5a4-81bef0c102e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835596, "uuid": "307edd56-61b8-4b74-865e-c391626f01c4", "value": "miner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f917ba8-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710834636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834636, "uuid": "00d8ca0d-e26a-4bba-bc2f-617ce93d9b5f", "comment": "Malware payload (Gafgyt)", "value": "8f9fb8d2c65b6c331c8e4f2c291032fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834636, "uuid": "91343887-ba7e-42ea-a388-7a51708f5fb1", "comment": "Malware payload (Gafgyt)", "value": "0349c284c2b7f00496d51c67ea5d6592d421ec34b48d3244352cef9554d96c3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834636, "uuid": "74409fce-df2c-409c-8b52-58c92dfa923d", "comment": "Malware payload (Gafgyt)", "value": "fbd5898863ecf2b7f5599eb558689ac6d852a589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834636, "uuid": "81b037a4-f468-4542-b97a-9bcd5ebe76cd", "comment": "Malware payload (Gafgyt)", "value": "77a7339139bb0a0b81a3814619b42a455d788964a57c10037af9427eb8ddc6840840e12b4f88d48029fc3c5bb7a93eec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834636, "uuid": "de21ad0d-0e6f-4bde-8c13-083fac1d7bf1", "value": "T15B244C24E5404B57C2E323B9BA8E428E3B3247E573D773154A389BB03FC2B9A1D71925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834636, "uuid": "49cb2f8f-4c22-4c00-8f73-35050be68bac", "value": "6144:5ZzyacCwXJ4DbpW0vI5hbL6CBKH/WKcgym0wfB5RyAn:5ZzyacCwXJ4gP5hb7w/ugym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834636, "uuid": "a7b62454-9825-4803-a6e7-584567622393", "value": 209634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834636, "uuid": "eb6ab978-1172-4e72-b3dd-8dc1fe14f532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834636, "uuid": "865bf067-1917-4495-a6c9-41d3bfd3294f", "value": "8f9fb8d2c65b6c331c8e4f2c291032fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0c4bcb-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710854602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854602, "uuid": "72c114b9-3134-4b89-a5e1-930e8b8b6977", "comment": "Malware payload (Formbook)", "value": "3020122a85a0f8d46b093af285f40f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854602, "uuid": "317bc19f-1269-457c-baff-e8bc6e3cad95", "comment": "Malware payload (Formbook)", "value": "04334f460082a3429da6308a0b1d25122a31667bed6c5fcd5897240ca7d7c7c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854602, "uuid": "b6feb221-53be-4b35-94e0-74be2a23f4bc", "comment": "Malware payload (Formbook)", "value": "4d776bce9191d923b0f9d5824f3200c237ea12a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854602, "uuid": "b87f1530-affe-4720-bc7b-59c132e487e4", "comment": "Malware payload (Formbook)", "value": "517570e58fa8cba2ca96fb438e27e688b0e6060e1e76799cccc18ae70b2e13cbbdbdf66b77173fbfe39304b54bc20f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854602, "uuid": "61e28ee1-efbe-49e4-b433-c446fe9c4c58", "value": "T1BE259C0273D6C036FFAB92739B6AB20256BD79250133852F13982DB9BD701B1277D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854602, "uuid": "4337d113-c566-4dec-a694-2b5ed0145abd", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854602, "uuid": "63fcbf81-1074-4ddc-92d4-07f6ceccd61a", "value": "24576:pAHnh+eWsN3skA4RV1Hom2KXMmHaP6LHXm6SFpHm6sfTd5:wh+ZkldoPK8YaP6L26Wpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854602, "uuid": "df3df8fe-f094-4079-a13b-2b1be45c618b", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854602, "uuid": "d9252e28-7c21-4acf-86f4-dc743be95135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854602, "uuid": "fbd7c8bb-ae97-4b10-ab6b-2903269d55db", "value": "TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b812680d-e5c7-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710835644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835644, "uuid": "58b4ef24-2e59-4500-8c10-2742bf2762f6", "comment": "Malware payload (RemcosRAT)", "value": "b0e371680c2c465a447d8cb4ad0ffa57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835644, "uuid": "4332d63a-356c-4e10-9a9c-94cb877048d6", "comment": "Malware payload (RemcosRAT)", "value": "043c2ea7473300aeef75d4347969ea2c54784e16892fb535b293b9dddb32b02d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835644, "uuid": "ea722730-a691-4f17-a7bd-7778b7aa2246", "comment": "Malware payload (RemcosRAT)", "value": "b622b7dfb03b70219fe047abd365fe88a4316394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835644, "uuid": "ecee9862-b9f7-45e3-a4b8-f99643de49d0", "comment": "Malware payload (RemcosRAT)", "value": "6d19b9935bd63e21b404a5915d4714d82428df3a7d88401c56e46c9166b36662766a607888078ecf46c4caedbc712833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835644, "uuid": "62f24443-37b7-4f3c-b0e1-a57919ccfc07", "value": "T1953412942F26DC95F2C490F45401E1F472EA2C7A1EA7664D07E4BF17BC7E650BE8A063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835644, "uuid": "1c6dc75f-e6a9-430d-9a09-ee52be2f045f", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835644, "uuid": "4d56ddc8-eda2-487b-aeaf-be50f833ea0e", "value": "6144:4mvl3n8iOiB4RBucKa3h80tK2gBWvADGGw6j1:tvlX8i8RB5JvADGGnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835644, "uuid": "b9bb4e42-c1a1-487b-a156-3f6201db1796", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835644, "uuid": "7e9aa669-2425-4245-af5a-c23199568532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835644, "uuid": "043d5910-0932-45d1-b2a8-68cbe8a4e4e4", "value": "bUl0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30dd74a-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837031, "uuid": "cc0a4b8a-411e-4884-ac74-4726ef4a8cd1", "comment": "Malware payload (GuLoader)", "value": "c2550ac6a8fbf9484c31848123a7a2a0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837031, "uuid": "f68ceca8-21cd-4586-a8c8-9a9a9bf418a0", "comment": "Malware payload (GuLoader)", "value": "047dd61003f9ee79af3c23dda3e46ed3b6e2e226dffbda96ffb566c500d25d96", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837031, "uuid": "8050e904-a4f9-44bb-a138-3e42e6d00528", "comment": "Malware payload (GuLoader)", "value": "a0b115cbbefc35f7d8ce608877276926167ca70a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837031, "uuid": "7ba3cdd5-1252-4ac8-a003-285d475181c4", "comment": "Malware payload (GuLoader)", "value": "019ff20f7978f041bf3aca499af82929747bd3f92d9bf49a19d45a1449d59470ffa245b6e29335df24ebced450ca9b9f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837031, "uuid": "5dbcf47e-d66c-4b56-8a16-e7cf9aef7a3c", "value": "T108B4F1BEAD83CC85CE8B19B251B9E27985E86E411F5C9113F7C60EDB77A2C08750A437", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837031, "uuid": "2695cf93-9d59-4834-93a9-f0b47abd5069", "value": "93dfc16ed07ebeb5b405221f10d12c0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837031, "uuid": "71181653-f09e-4e1b-a463-1357dc6dbd42", "value": "12288:oS2dnErpbwb05qllUcX/5RYEzNzqSK0V/tit:L2dE1b405ql/X/5RvNeSK0V/ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837031, "uuid": "f325b467-5749-4445-b72e-3d3476a4e496", "value": 534978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837031, "uuid": "0b72db4b-c679-4f44-9e6b-a982a029095b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837031, "uuid": "268a2d58-2f84-4150-bc83-00740f63ceab", "value": "DHL Booking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef686c54-e604-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710861936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861936, "uuid": "70307fdf-94f0-49ff-adda-de90f159af93", "comment": "Malware payload", "value": "e04213f27f4e2c763e0b8910f7743af3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861936, "uuid": "1476c09f-3808-431f-8cde-3caefeaf0cf5", "comment": "Malware payload", "value": "047fcf6cf1e83002c31d9725f92abe3014bcb0a65a3078dcc6467036ba792547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861936, "uuid": "9395e7c5-82d8-4bbc-960c-67b9969e48d5", "comment": "Malware payload", "value": "2707a70bfb085112cb02c82c738f752a4e789825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861936, "uuid": "662701fc-0d3d-43db-92df-ac673a601ca1", "comment": "Malware payload", "value": "e66e2d8a6d8afa79d4d1b7ce49650f14244e5a85f39fae935bb1d5b09cac7911c5063b18867e910e765adebf803dfbf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861936, "uuid": "c96ae5ef-b8ac-4c12-9f9f-bbd49297a792", "value": "T1C905087753927872FBE6A2374CA00D8EFEE2EA6501822E31761DDECC4C6115DE845FA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861936, "uuid": "38c28081-47ea-4b36-b9b5-ef490df6d070", "value": "30842d08d359ae86aeffadb1722122da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861936, "uuid": "d8141ea8-8d57-4a8c-b6e9-5c809239e7a3", "value": "24576:2deM8k31Q2B7oVSRZw/bO/PVggnoGhkOF8rcbfdaMQ8NNr+OZQw6F77GEm+pV0kn:8e831bEOOyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710861936, "uuid": "dd38d025-0385-48fb-8c85-15ffa65b5e8d", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710861936, "uuid": "f867df3a-437d-48d8-af09-67c2a6d295c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861936, "uuid": "632531cc-d33f-4b54-8ff0-4a89cee565ab", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1318539.12125.19370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7a02a3-e615-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1710869043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869043, "uuid": "f9fa3fc1-b4a3-4a19-b766-b6895ac88fe5", "comment": "Malware payload (LummaStealer)", "value": "6899ab16dcb32614ea1d604641f08cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869043, "uuid": "f79f00bc-7669-4bcb-bf23-ad498c30736e", "comment": "Malware payload (LummaStealer)", "value": "04a34696c2cf0da7237f395b0eef934880482607d408eb92e6906cce6df1323b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869043, "uuid": "cea26bed-abb0-4944-88b4-40c3495cdc6d", "comment": "Malware payload (LummaStealer)", "value": "09126448ddad2e0e2ca0a87e7634dcc6b0eb54d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869043, "uuid": "e8a4b4e6-783c-469e-b69e-8c4ab372dfc2", "comment": "Malware payload (LummaStealer)", "value": "1fc5bba7663484778dacc821fd1931de3dd8601c426fa4585f8d0737fc95e3196aa14522005e74570b074dce82b649d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869043, "uuid": "e9c1d433-3718-4770-8012-dee0128accde", "value": "T1BB965A47ECA185E9C0EDC17089269216BB72BC445B3167C72B60F6382F76BD0AF7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869043, "uuid": "d635b8c0-01bd-4917-ac27-2c1ceb65fe33", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869043, "uuid": "516dce47-9d93-4139-8ee9-0d3283547fae", "value": "49152:Kt3b/w5K96t+DK0bTLWxpwaqab/rttRGNMfHEPtbcNtl7FyPnMBdXH3Yrwj/35EA:w3b3Mt+Drbf4zHOicfM3XjE6qDt1mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710869043, "uuid": "9c0026a0-efd0-4534-a029-2d8afb765e73", "value": 9234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710869043, "uuid": "1aa7926a-c32b-4d01-aa21-dcd808bfea25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869043, "uuid": "ad398928-82ea-4fd8-a5d9-d51276e0822e", "value": "6899ab16dcb32614ea1d604641f08cc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbc444c-e62f-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1710880133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710880133, "uuid": "77197702-6dec-4950-9ad1-2628368eed81", "comment": "Malware payload (zgRAT)", "value": "6c59d52f669960beec9deadc26b906ab", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710880133, "uuid": "ec084e9c-f0d0-47f9-a595-d208378b8b13", "comment": "Malware payload (zgRAT)", "value": "071666b27e1596afe46e049c7f9c890e7ab573c2bc6ef0aa6a08199188cae761", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710880133, "uuid": "8297b1a3-708b-4c83-898b-dfc44a474a43", "comment": "Malware payload (zgRAT)", "value": "41bed61fc2a2231ad50e5b0c838f9baf72202ac9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710880133, "uuid": "cf3a75e1-4a89-44b8-a5f8-871775a6ae7a", "comment": "Malware payload (zgRAT)", "value": "45354580aa4c3a6df151940c7d8d8a8f4c2abda7fe928b4594b717736ff015cb47d69d3edc868eae3a98e48b6da67291", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710880133, "uuid": "dd155bfc-507e-4374-a6b2-e14483cecf34", "value": "T1D6B65C22B9628961D20877B6C596E13143A2ED413323D20E71EE3F2B3D773EE1E4556E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710880133, "uuid": "7263a05f-ec51-472d-94c7-2f05c35fdc63", "value": "98304:v8/Hw+t8y9qe3EJ8mc7+zGPKXTuhG+zchAGulNXuoVU7RJA3oXy0:v8/B8UrUdcxcTuhG+zc6GaVmdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710880133, "uuid": "25846e55-644f-42ff-9818-ca19f6aba8de", "value": 10712064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710880133, "uuid": "7dd81713-f1af-4d16-82ff-21ca6b418c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710880133, "uuid": "c6e907ab-c4af-4918-8722-7e7faed26ef0", "value": "6c59d52f669960beec9deadc26b906ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d154c8-e5b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710826023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826023, "uuid": "e14249f6-1366-4774-8425-4007fdc28fc0", "comment": "Malware payload (Mirai)", "value": "81ed9c8820d7c031be3b9c02925bfcdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826023, "uuid": "536dfbf1-eb26-4a0c-84aa-507f64b92419", "comment": "Malware payload (Mirai)", "value": "082e212e6ca74b61923a0d0fa039d462458aca7c6427b59d972e82b7d9cdee80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826023, "uuid": "f874d8aa-d754-4798-9d01-c3cbf70bbd91", "comment": "Malware payload (Mirai)", "value": "f5b77e3af0fe866748777894811be10945230256", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826023, "uuid": "ad5596a7-674f-43c7-83f2-d89e8781be36", "comment": "Malware payload (Mirai)", "value": "cd9a08c975d9765c0683236b770b248032d1e7b4ec3dbd3544e76aa6ddae373c97a1b585d840170290a6110733d0a99c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826023, "uuid": "90c377c5-bc12-4a56-9789-a6910010240f", "value": "T1D0D32A06B30C0A47D2632EB03A3F67D093EFDAC121E4F641356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826023, "uuid": "bc54afe9-9fe8-414c-8e74-488ee4a5b8c5", "value": "1536:cP0nwryWv+n/qZI3cST98z+xpnvTnNIkH5Afg57PMfgvAtI20jDWB/qHs0kBB/zR:ccWv+BcG8z+x57np0gVPM9t9BBbRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710826023, "uuid": "eb489fe1-f322-441f-b41f-ae81c12d5a3f", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710826023, "uuid": "914152c1-f5c0-4ada-8c78-e4df3b6cc20c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826023, "uuid": "788f3496-0804-40ca-a2d2-42194f4d19b3", "value": "81ed9c8820d7c031be3b9c02925bfcdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346a21cb-e5e2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710847019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847019, "uuid": "cf2f4a13-d568-4f62-8de9-4fc316dea2de", "comment": "Malware payload", "value": "37b5e2f4baf4013e49ba80df6f482970", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847019, "uuid": "59f2aa48-e713-47e3-8b59-d40bf724e365", "comment": "Malware payload", "value": "0952854bc8f64245f86430953d975f260326456aaf260fd767676846e825da3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847019, "uuid": "872e6dd3-0d65-4d96-b648-edd14004e622", "comment": "Malware payload", "value": "5aa644fd69f1c9e13d5fe387e0704d2cb6cf4893", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847019, "uuid": "b94f4384-e7a4-4b22-8f97-4d867100e57f", "comment": "Malware payload", "value": "2c9170add514e1090b120e2dbad6d72452cdea19c224f6e41ee0f816c5c09cfb675d3e175f2a2165814fbee54c854e23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847019, "uuid": "a23f7a15-576e-4825-ad99-0f962d27d5fd", "value": "T1E50695AB2FAC17861304739F5B9FED440617CCAC0BC66FC892C39D995409BAB2950E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847019, "uuid": "af02b21d-e3e7-43d5-8e70-338c15d892c5", "value": "49152:SPpmq12RxHW9ub71aMZQweyrLLX+5Z4yPLyiTvCuP8s7JaqD:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710847019, "uuid": "f6c5e776-8cb7-49b3-b86c-5191ba63413a", "value": 3761661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710847019, "uuid": "4eaf25b8-09aa-4003-94ff-dd86f22ee2b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847019, "uuid": "77c1093d-8778-4e54-a117-e2137f0684b5", "value": "Veevsruheahbmd.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a594a785-e5e9-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710850216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710850216, "uuid": "40f9abdc-18be-4142-936e-25a1786ab222", "comment": "Malware payload (AsyncRAT)", "value": "3b16215931a5f2a192f7046211d90237", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710850216, "uuid": "31c7a1f1-a12a-4ce5-9719-5da90094d676", "comment": "Malware payload (AsyncRAT)", "value": "09a61eb9b8ab25ce71b2fa7fec53bc4e243beeea6e7aa04382f114510c45713d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710850216, "uuid": "575aa954-6304-485c-8e53-2f4599e63303", "comment": "Malware payload (AsyncRAT)", "value": "78f823fea0453f1a1ac55ac58e9e5a0efb9c0551", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710850216, "uuid": "cef2b3c1-3c5c-494a-9016-0af5761a728a", "comment": "Malware payload (AsyncRAT)", "value": "0fbc592be43376054c556f02b4d419f642fe501739eb043fd65f2ab4c71aa82a8b8152f042d62bfc527e8b69a4723b5c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710850216, "uuid": "41e0e0bc-ebc3-40f1-98fd-da841ca26dae", "value": "T1CF232B003BE8822BF2BD5F78A8F26245457AF2A73603D6491CC451DB5B13FC69A426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710850216, "uuid": "dab6c730-9ec0-4846-9159-fdd7fb6bf3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710850216, "uuid": "c0abf353-eae2-403b-98fa-2f1ee60cf7e7", "value": "768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3iSKJTAD1T3/+BDZSx:vuwCfTgp/2OKYDy3bCXSfJTAJodSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710850216, "uuid": "6bdb294e-2c56-42a2-9e96-b58de0506d68", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710850216, "uuid": "fa761741-4e83-4ab0-96f7-0a0eab940b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710850216, "uuid": "de8a55e4-21b3-4c20-9844-35f650b12043", "value": "3B16215931A5F2A192F7046211D90237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70725c09-e5db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710844114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710844114, "uuid": "18580076-8398-48ea-bc63-0b7aefba94d0", "comment": "Malware payload", "value": "39898007146d7b436d013924db58ebc6", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "PAK", "colour": "#855C15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710844114, "uuid": "09eebec3-26be-4361-9af9-52ae85e2dc21", "comment": "Malware payload", "value": "09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "PAK", "colour": "#855C15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710844114, "uuid": "fda8e256-dbd8-4c75-872f-3cbe1c036339", "comment": "Malware payload", "value": "dd8b8c4de92d9b6d1d04f0e995f4cc7e746d0a64", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "PAK", "colour": "#855C15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710844114, "uuid": "ebfbcc7c-5df5-44cd-aa40-7f0fd6e9be41", "comment": "Malware payload", "value": "d2668104a505c183007e6806efc8241d50ae9eb6f2d2d392fd7ede7843749e7416e8dd481b67de03e9cc5d958c659aac", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "PAK", "colour": "#855C15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710844114, "uuid": "5047ff2b-7bae-443e-a6eb-881450d88800", "value": "T132B47C0661E41E6AE4B38272C1E64945E931F1420F53889FB79846DFAF77284A237F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710844114, "uuid": "1ff843a2-fbdf-4627-8a62-144d2572197a", "value": "3b21eea11c8393dc357eb2ad9fc4b106", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710844114, "uuid": "1d6b51dd-fc3f-48d6-8c89-7635314a4f4a", "value": "12288:qlvYd7I3sUQneNlE/vvyzhKV71vCuw/xIp09:qRLNS/nN7GpIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710844114, "uuid": "457d976e-eaff-4392-8c35-63e64178f36a", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710844114, "uuid": "530347cb-d2d9-43d5-b2e4-818068d0f7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710844114, "uuid": "a5b36f75-9224-401f-a343-56e96f066cc9", "value": "NVUnityPlugin.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8652025-e5d3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710840772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840772, "uuid": "45a66505-1d5d-4f36-b4e7-1cc542f39bf3", "comment": "Malware payload (AgentTesla)", "value": "947ee8f7ed9ead91aa397b83fb4eb5b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840772, "uuid": "8e00937b-8a16-49fc-a8e6-a455a1d945d3", "comment": "Malware payload (AgentTesla)", "value": "0a6c1a3b213126aacb4bdf23a40b18facef7b2fb6efd7bb49f3549d4a0c10eb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840772, "uuid": "1b887287-8f73-49a7-847b-044bc9467126", "comment": "Malware payload (AgentTesla)", "value": "00aafe5d1976def7ad112f9d3e37a91c0d4c5884", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840772, "uuid": "5725d2e5-44cf-495d-b828-9d9a8c0b947a", "comment": "Malware payload (AgentTesla)", "value": "304a9c4d67073a78090b199f5deb1f8793a8d6c5fb75e4661f1bb6f8e16e4163dd08717b81d4a667299d01a4d0bd48a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840772, "uuid": "c7c07de1-4b3e-4033-854e-80544502ff1d", "value": "T181D423A0AD65D7E1FE79C2B714D65C008A72B1B3DCC6DFAE609134E32AB1F46D148A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840772, "uuid": "2d7ac7c5-69e9-4b52-8b3c-c45890924100", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840772, "uuid": "e2c8650e-6133-4bd9-82fd-1470ed830993", "value": "12288:C2fH0TeJ9Lp7M+Hpvg2TWM5vB2GStkCqEUvS3RFVoXYidOcrcU8XcGGrRzr3iH1O:hUO46vg2aSoGSZXFilOKyMGGrRHiH1pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840772, "uuid": "ba2db4d6-ce2d-4096-b2fe-338d6fe94afc", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840772, "uuid": "5a29e3ed-cf2a-4de8-8d79-c45cf32ba13e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840772, "uuid": "43599979-90c3-4f46-aab7-3d6151818559", "value": "SecuriteInfo.com.Win32.PWSX-gen.32226.8116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acbd138-e5c0-11ee-a120-42010a9c002e", "comment": "Malware payload (Stop)", "timestamp": 1710832508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832508, "uuid": "0b664c85-9c6c-4ce0-b4d4-89e7a6d8701b", "comment": "Malware payload (Stop)", "value": "36d66e93b377ab343f73e8f9df0d9655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832508, "uuid": "c1d334e4-621d-46f5-8413-8f9188e0f0d7", "comment": "Malware payload (Stop)", "value": "0aab6f215890584c93d3914606f068adca9679153d271eac2e2ce68ee8842d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832508, "uuid": "6992e6c3-c360-4d96-9e59-64e5e06f1bde", "comment": "Malware payload (Stop)", "value": "c1802427c4bf86380b20c4c936649f568e30b014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832508, "uuid": "af0de57e-a5d8-490e-9661-419ce0554362", "comment": "Malware payload (Stop)", "value": "57d0e4705b4948f26e602fbfda55c4a01bb81d9814ae50d3af6e3a266fde3a66cc4488475bdd2cd2c03ee9801974e681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832508, "uuid": "3e9badd2-9b62-4b16-9621-6d5850305154", "value": "T16425226176F88876E9F78E7110B087621DB77C13A861A58F67901E1E5FE13C24E31B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832508, "uuid": "9d0df61f-96ab-4a89-9208-dc4b82394088", "value": "aba6a204b06fee0be8fb6aeef5a4c030", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832508, "uuid": "7983b5da-bc9c-41cb-8eae-3d9603b4416a", "value": "12288:gnFIJ93Z+ukF/HXpWY9eTuswF3so/zohwnuvvTC29hp9:Ys3ZPUZWY8rwF8WohwT29hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710832508, "uuid": "7d7d8081-7620-4c16-9717-e43400a3c721", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710832508, "uuid": "523ce51f-92da-457a-aa35-e597fd080b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832508, "uuid": "05e1ac72-891e-4c4f-a507-131b7f6f8a85", "value": "36d66e93b377ab343f73e8f9df0d9655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06087ab9-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710834486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834486, "uuid": "6e8076b4-13c8-453b-8b49-e101126acaf3", "comment": "Malware payload", "value": "dbf71ded6ae7701d4bb200e3f7e652e1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834486, "uuid": "ad8d28ab-3fce-43db-8fad-114fc07add74", "comment": "Malware payload", "value": "0c718811ce1081f357da4c159deb0c8252bcc87ac9e0e8f7f1b3603f7d0229fc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834486, "uuid": "a08693cf-19e4-43e8-b1d4-917d9eb38703", "comment": "Malware payload", "value": "250c93968c9c10d169d95ff18dbc0fa6549eded4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834486, "uuid": "3352c1bf-a36c-44ee-8952-866eae0a97ab", "comment": "Malware payload", "value": "a57aeccb68411b6c8d0b9b9e0c50039e6f8ffde1e06fa82588cdec87b317c611305a0e70f8d4150326cf7a98b1882547", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834486, "uuid": "acfb6ddf-5d80-4ca5-9b1e-d320d852cba2", "value": "T1EEC022220888A902077F8C89472E1400EB30B08A88B402A03536061BC194F0CA613A18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834486, "uuid": "fd726d2f-dfa3-415d-801d-a8c961ae357f", "value": "3:LjT5LJJFIGJsyCDAHF+zNZmNLLdIJVOlAQyL0NVfK90oL6DGau5rs7R6RoL6M:rz8GiyaAU5ZcLZIJVOlAZIfKy66Du5g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834486, "uuid": "a8a08aaa-8ab6-42f2-b5bf-72ccc29469d6", "value": 191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834486, "uuid": "3b1cd202-f6e1-4862-9053-04718f6141c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834486, "uuid": "d6513d6c-58fe-40dc-875f-06f274033c85", "value": "6M2LWQCT9fyh.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6a99a4-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837079, "uuid": "94e1986e-18ad-44c9-bdef-d85d3705d08c", "comment": "Malware payload (GuLoader)", "value": "0a5667931e5ba2f39e5cd35b7307d73b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837079, "uuid": "bf2aadcd-e92f-45ba-8fd1-401eab8ad0a9", "comment": "Malware payload (GuLoader)", "value": "13a7b775c7d48ba3e2b2426359bb2ce57ec1a95b8119564b371a988269d6a05a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837079, "uuid": "7bd87d9e-e0c2-43d9-a9d6-71905492a4de", "comment": "Malware payload (GuLoader)", "value": "c2502963c57bb22e054bb9b8e4935160174b9b67", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837079, "uuid": "08ed9b4f-6827-4fc2-9fab-3f1e005ceb3b", "comment": "Malware payload (GuLoader)", "value": "7e06e2d21451cec6ad429bfa1ce3c9668b90bbb870cbf33d55a80294af3fcf2453e49b7aaf9bb754dac116af33d619eb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837079, "uuid": "9ce8d80a-e61b-4e45-82dd-a9642ca2443c", "value": "T16E44E6A3CF0A26190F8A2FC5AC61C95286FB41B531121479EEEDC7DDA183DACD2FC915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837079, "uuid": "e99548f7-2f75-4567-a8aa-e77927cc2f30", "value": "6144:N7KtYtINI5Mk6fqMKYJwMHy0J4iwLwhB2UcJXkcY9CdLzHxYRvbFjtkfhMVOqR7s:9qV3hlv9VLeAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837079, "uuid": "046b9b21-2b25-42f6-a6bc-2338385132f9", "value": 267610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837079, "uuid": "f4951d10-2e46-40c3-8741-45cab16aa549", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837079, "uuid": "6d3d64bd-0268-4f98-8667-242032850db8", "value": "New_order_requirments_7383882736_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e05596-e5d3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710840774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840774, "uuid": "79d11293-229b-4392-a0dc-0f68648f59a4", "comment": "Malware payload", "value": "7ae4368a82b42a197bc9a399abcbd5da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840774, "uuid": "57ce6d5d-660b-445b-99d7-604b4c3f34f3", "comment": "Malware payload", "value": "13b8bc4e6c72cb8b16662d72ba3b7c4ac6c94eced201c10cac29cdc25d4fe48c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840774, "uuid": "1a1de8ad-3bbf-497b-b941-6fb350608621", "comment": "Malware payload", "value": "9caac610685ff03a6a01848b9e34aa0dcc68d8a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840774, "uuid": "fb20014a-9585-43f4-b347-1b1251eebfdf", "comment": "Malware payload", "value": "d4926cb193036389dd60c3cd2d33d402c6c0b42c5987fe6ced82ecbd3abb9ea5db98c05968402fb1ae6f7222705fcf95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840774, "uuid": "62faec8d-8148-4452-9ed2-d2ea722ab418", "value": "T13A838D52B2E2D075F4B3023168B5DE914A3EFE365A71DD477788124E1A702C09E3AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840774, "uuid": "21a9055a-8c6f-4b0d-84cb-06deb4f10a7d", "value": "02107fd6bed7898d83931a2797cecb96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840774, "uuid": "d2f1714e-3bb9-4361-94b8-34adb2cc17ff", "value": "1536:qiz5quLQHse5i7PnMeki4+cYjr0sWjcd3SVsjCh:pfiXw7Posjf3SVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840774, "uuid": "50d486b2-7eee-482a-ad9d-f1d08b7e1778", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840774, "uuid": "a50d4c68-2bbb-4b89-b9e6-ac6b61877b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840774, "uuid": "69fa9119-12b2-43b4-9ff7-40c79976b25e", "value": "SecuriteInfo.com.Variant.Ser.Jaik.3609.5470.32390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec813e0-e60e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866042, "uuid": "3382cb11-4a78-4c73-ad35-91e703d968af", "comment": "Malware payload (Mirai)", "value": "c3ea5620ce3ee54c319e08986431f0d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866042, "uuid": "1e64af73-0e68-4408-8e1f-8ef826f623a9", "comment": "Malware payload (Mirai)", "value": "1546c5c2d78661d66784b1921362860e4e032e701f5db7a25e3473784403f7d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866042, "uuid": "49c948a0-a21d-4615-acfb-6a3b7ce5b060", "comment": "Malware payload (Mirai)", "value": "40081d041bd65e8e4b0cd40e5172ea4bfa99b46a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866042, "uuid": "d39e9085-a5a1-428c-a1c1-963389e4e2b5", "comment": "Malware payload (Mirai)", "value": "25be818921ea6cfa0f7f0b9101c193547d803a694856a09307f57c15adb1952d6bf04e8782247d38005e29cc5475d4a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866042, "uuid": "e4cb67d7-fe15-49b1-a3a3-747f849d7018", "value": "T1BB82BF65C1A65F97FDEBADB32DD1D6D6A3B00B8BFAD29C601041DF017217C2626099C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866042, "uuid": "dcffe579-6e9b-4881-9acb-b0b14e08549e", "value": "384:DBqL52tHM4qifjGQ4ghibk6KNJ8M86qrHwcUM4uVcqgw05VxJVK:Ds2+4IQdhipKNJ81Dwcr4uVcqgw09rK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866042, "uuid": "52c400c9-2367-4b72-b124-95b1e228d1ef", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866042, "uuid": "76f49947-fd5c-4dc6-842d-acb2ccd5d55b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866042, "uuid": "f6c4a5d2-e722-43f3-bf23-70c7cb9b1251", "value": "c3ea5620ce3ee54c319e08986431f0d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f032896-e5e9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710849963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849963, "uuid": "6e218a09-2c16-46fd-b193-39cf4f3d7acf", "comment": "Malware payload (AgentTesla)", "value": "922464e3418f763bfa5195c749c3310a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849963, "uuid": "e27217f5-bd95-4b05-a518-f662edf99f9b", "comment": "Malware payload (AgentTesla)", "value": "175f6a8759859dcbc8c695c408d9304fd6efb2de9fa985566e7653590e6329d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849963, "uuid": "4aacd70f-e776-4a69-9f23-706cb594a052", "comment": "Malware payload (AgentTesla)", "value": "7d12fd40a71d264b34676196d28b6ca30540da2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849963, "uuid": "d3aeecbb-f12a-41be-956b-f497e8a590af", "comment": "Malware payload (AgentTesla)", "value": "000b532c9c5f9578f1d541807e22de78709309273b05d4272e7085e4785adc1c53da84101db8bb56e9dc181d832b8f75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849963, "uuid": "fd34d7a9-df96-4623-9606-5effee1bde44", "value": "T150D42381110CB03EE5B757A8C18613380BEAEB515FBA69A48F4BD1B5D2061C678BDF7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849963, "uuid": "217f217b-f9b9-4fda-bd94-22a1195b66a1", "value": "12288:wHO7Yc3NlVrirtZZjCuiXhNkvU/L6EH6WloSs5ZSQ1WpJAN7Gm:wHOci31irPZ6XhN1/dH6WpYkJmZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710849963, "uuid": "54635be4-6d43-4926-9d5e-5022005e15c1", "value": 621598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710849963, "uuid": "44484d07-ff18-4aa9-8849-5d8ca526d75a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849963, "uuid": "228d8e0e-8473-4ed0-b783-c409cbe6c702", "value": "Order_ OFI-MAR-2024-000019_ Valve pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab84365-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837098, "uuid": "a6158ca2-740f-42fe-b68c-19ebe7054451", "comment": "Malware payload (AgentTesla)", "value": "ebc0c9f9ec8f3a2028e1ac06e1e9cdb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837098, "uuid": "915603ec-2389-4ff3-9120-3f66e91537e6", "comment": "Malware payload (AgentTesla)", "value": "18317c3b7adddbc72c7b47b96e9be9ec765029d9b4735f3cc42989c079ff0f53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837098, "uuid": "f71ca05f-035c-49a6-9a87-46cc6c6dfe88", "comment": "Malware payload (AgentTesla)", "value": "2d3659b668537fc05a99e9d1d0495f6573b9efd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837098, "uuid": "91bd6cf8-caf6-4aff-9bd4-2671346a3c5a", "comment": "Malware payload (AgentTesla)", "value": "9274768d8238cd8f9ea97b2cc9566e5e80b694d031e47000ffe10ef848af339841834b8e4dc4cebc9f01a3428146162f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837098, "uuid": "854246bf-c531-4b75-a81d-dfb6711eb0af", "value": "T11FF33AE3EAC526098A462AB3EC135B738DA8415D37172F349BBCC24D604395C86BFBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837098, "uuid": "62331330-756f-416f-8e3f-521853b098d8", "value": "3072:ss4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNR4KOhZkKLDUQ/DrMg2zwtxYh:ss4yENVOY0NpVXpK68kH3DPbkhZi3eN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837098, "uuid": "9d7b0126-cb98-4152-9f47-8ead9455ad0b", "value": 170274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837098, "uuid": "3a960d14-4e30-4f0a-baee-8f38668395b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837098, "uuid": "6d7e9b83-90ae-4d2a-9fde-7f822c880325", "value": "TRANSFERENCIA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4a5327-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840407, "uuid": "0210956a-ab9c-45aa-9ba1-501419df1d17", "comment": "Malware payload (Mirai)", "value": "97cc8f05f2b01fd7cf17902de22c72a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840407, "uuid": "5cf2c957-e51d-45ab-b27a-d7e2f94a1824", "comment": "Malware payload (Mirai)", "value": "19bc8adf4f0789f7d295e09ba927f4e8af2ec8b4bb36c60d2d4565c27b7d4e3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840407, "uuid": "9afc099c-1e36-460e-8936-5db678078b09", "comment": "Malware payload (Mirai)", "value": "25627e287b4f28576bafdbafca208540bc52b248", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840407, "uuid": "15b4ccce-2fd4-4c8d-9779-68e042be6914", "comment": "Malware payload (Mirai)", "value": "08ae1514348d6794af71a86d04a1213cfa78e3cee8da7b5cd85926d8fb8a774409d0ef9a74c9cdb58446aae1e0a03a26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840407, "uuid": "19c2f209-21ad-44ec-ae7f-df18a8bd47a4", "value": "T110D3F845F8405F23C6C612BBFB5E428D3B2A17E8D3EE72039D256F60379A95B0D36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840407, "uuid": "343edd61-ced1-4a7b-9960-239df880785b", "value": "1536:/DXygojT/0b7RUbJ8cPLFDAOZ/74V7CsV2TCc16gX/iGw99klkRwywAFEY0OO8Vd:/DXBOtDFDLD4wvmc16gRANYELiH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840407, "uuid": "d195c737-34f8-4e50-a122-509564afc7e5", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840407, "uuid": "94980729-c8ab-43f7-bbfb-476b958772a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840407, "uuid": "72203e07-3e92-4a27-9bc1-ff92c2754371", "value": "97cc8f05f2b01fd7cf17902de22c72a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9daa94-e5ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710823892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823892, "uuid": "eb243615-ca45-4920-8ec1-9f10b982a99e", "comment": "Malware payload (Mirai)", "value": "5fac7b4b0dafa219fbc9272b5b9cf149", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823892, "uuid": "ad14d819-8b7a-4443-8c68-521c4a0eee5b", "comment": "Malware payload (Mirai)", "value": "1a3442606575933401653a399b360c250f26e62cd76cccbdd02496397a08c1b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823892, "uuid": "e979d9a4-986c-4876-b4f7-61b0e7e3a873", "comment": "Malware payload (Mirai)", "value": "1774209d3cebd8e3f4e6144bf2d0ce2ce2a821af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823892, "uuid": "09da7f5e-3a54-4a39-8b2c-3ff4a1694466", "comment": "Malware payload (Mirai)", "value": "786514a4b30705f6451c18fc66389364b475fdf6bf281664865f95058a48bbc70c57de279bdc613ec8abd8fb850cf736", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823892, "uuid": "03786886-aecd-41a6-b763-307ce521f261", "value": "T1D004D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823892, "uuid": "509e34be-3ece-48f3-8138-714cf272ceec", "value": "3072:ueEksFM+wX5OUaVR8H3NaMZOTTMJxt9U+7fKb8E:ueEnO+wXwVWdaMATwJHy+uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823892, "uuid": "18c7ff2b-58ed-441f-a641-ec7d650e8afb", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823892, "uuid": "95b6b832-3278-4d6a-966e-cf496b095112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823892, "uuid": "18d7914b-a4ca-4a5a-ab70-db793103d2f1", "value": "bot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab2f63d-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710837044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837044, "uuid": "fcddef82-bd3a-4c1f-b841-145edbbf06cc", "comment": "Malware payload (RemcosRAT)", "value": "903d5012df813abb990f663da1af4c8a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837044, "uuid": "989ee039-3436-4a7a-95ab-b09a17440140", "comment": "Malware payload (RemcosRAT)", "value": "1a49ecab4926721e64c3ef58e9d567bef2d0af4bb8494ee2ef5fd56e713af5cd", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837044, "uuid": "f0af74ac-130a-4eb8-8582-a9745ac3527b", "comment": "Malware payload (RemcosRAT)", "value": "18115c32fca740c959e005493511bf3b6842becb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837044, "uuid": "697e5461-7cb3-49bb-99ce-d59325954892", "comment": "Malware payload (RemcosRAT)", "value": "0c3c3335ea0fd382aad47c8cc34f467d2b59edaf11fc1144f772f5e03158fb25c0039cdfa33b2ee37eee483933c9909d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837044, "uuid": "54ce3e4f-b0eb-4281-8ce9-5de77e4b959c", "value": "T1DB33CF143396E826C053A47E8DCDD2DB9B02BE52AE97D60B71D8730F2D765C0A363726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837044, "uuid": "92f064c2-0460-45a9-8f07-5d393fcda90d", "value": "1536:iX68xwcRZrCO+68f4Rdc4AdoOVOrAjtev:iX68ecfrCO+6pRdc4Ado7Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837044, "uuid": "01f4db63-b93b-4f47-b973-24c4aaffc4f5", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837044, "uuid": "0f3da6a3-443a-489a-aed5-21edd9fd73cc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837044, "uuid": "04372c8b-b8f4-4842-b016-86fc92a2406e", "value": "scanned Draft Copy.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5aaa65-e5d4-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1710840996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840996, "uuid": "3cfa9737-60eb-4838-82a1-0527fa8ccc60", "comment": "Malware payload (DBatLoader)", "value": "1edcf5f787ca137fe762e46ec765e6ef", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840996, "uuid": "d80d858f-5094-4b50-b103-ee17b055816f", "comment": "Malware payload (DBatLoader)", "value": "1b7b82e7a0b9e281efd1e04e989e02b71ffda8b3e347e7da396f317d795f0bcf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840996, "uuid": "6f5a8314-2ca0-4733-8b60-7cacbe0654a6", "comment": "Malware payload (DBatLoader)", "value": "0a10051c51b6eba3f18f055229021920121636e5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840996, "uuid": "df089572-83c7-42a9-92fc-66916cd8956f", "comment": "Malware payload (DBatLoader)", "value": "94ef839f3dc24b90bc96b32aca9851d7b1c067cea5d00ec119c5ccbaa7318da283794b2ddde725fe10937ff499ddadc8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840996, "uuid": "2e053eb5-dabd-4336-bcd9-01977d310e57", "value": "T182525059E38F85F5CB986233023448895AFCF73FB11616C971ACA2713BFE90C59A90B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840996, "uuid": "85be8172-1c03-41d5-834a-899497cf2ed9", "value": "384:TZ17c8JZFweYcPxugxmFEHNHuc8JCqVUrnyUyo8dfkA6PQMug+RZV:V17hJZSeVPxu7FEpN8JCqMy1okkAK7uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840996, "uuid": "59223d9f-dcb5-4b8e-9b57-daa3bdad8a7c", "value": 13398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840996, "uuid": "28368594-155f-44c8-9857-c6842f7cc41d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840996, "uuid": "824e9435-fca5-479b-85f9-8ee52c0b629c", "value": "1840220197_0000223948__F.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9689ff6-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710854571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854571, "uuid": "6d1f145f-c3d8-4374-b585-e1a1406410ef", "comment": "Malware payload (AgentTesla)", "value": "2267981265b6f5cacb3c87a96d7ee895", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854571, "uuid": "15993079-946b-4074-9b5b-7dde1dbbfd55", "comment": "Malware payload (AgentTesla)", "value": "1c28cccf93bd2b76cbe8f847addfbe78205d569b317277cb2fce736290df2a52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854571, "uuid": "cb836e2c-b3fa-41ce-90c1-e8d1ab9af429", "comment": "Malware payload (AgentTesla)", "value": "d02174c82e0748c2a518e28422328f5e428dfc3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854571, "uuid": "638e26b4-c8ec-4d19-9b5c-f154e6c864b8", "comment": "Malware payload (AgentTesla)", "value": "5ecc98d04c123eaeab4af35d83f9afbae9b9cc2300bc1513f5c05d86a0221bc42ba9c30ecdbbd010d52dbdfd10ecef70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854571, "uuid": "b8711340-30ee-4fad-8b51-549669affe28", "value": "T1F8D42377B770277ECE1DABF74D33868A05F302465878DF3D8589684BAC99F46A110E22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854571, "uuid": "192cca04-adde-48db-8910-988509b20be1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854571, "uuid": "b3dc1b84-294e-49f2-a129-9ab88207e746", "value": "12288:7Cb3oNO9EmL5XvABRlY95aQB2b9v93BmNCVM0kJMJVioWmCLwMG9EGqnLdOJRYWq:7CkNgZYYf3IxmNCVM0kMVXsuOGqJOJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854571, "uuid": "bf7a54de-37b0-49c8-8a1a-6003653aca56", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854571, "uuid": "97710c17-d80c-4e13-8343-4ff579fec8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854571, "uuid": "c84641f3-4250-426c-ac59-d97f5740adb6", "value": "Swift 2024_90922882828272210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2b98eb-e5f1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710853587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853587, "uuid": "2f86b5ce-0cf3-4649-992a-bfba37611c41", "comment": "Malware payload (AgentTesla)", "value": "706af86d756ef612993ee323cb6821bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853587, "uuid": "5ba5f539-f417-49ec-9b20-50527613c5aa", "comment": "Malware payload (AgentTesla)", "value": "1c76ab3e803654bd830af90fbe2f96d1b99f41d8644771b0a9b686949688c34c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853587, "uuid": "93890173-dc1c-4906-871f-671ef44eeff9", "comment": "Malware payload (AgentTesla)", "value": "a2ed3afda86cd435348b9b18ae05bc933e598bb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853587, "uuid": "ad846078-f3e0-4c4f-a787-c0eb589127e4", "comment": "Malware payload (AgentTesla)", "value": "a975be53ec9fc61bab60523b32a68233a53361cd7d901ef98b1572d51d07eef045afb56a422f99e0dfca4c2d37d0af72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853587, "uuid": "e5f410b7-ee44-4839-a9fb-ce6a3801c974", "value": "T1DFE4339AE8B4154E984EBFA4E5C8624D62D050FC347AF5183EF97FB2435D8B257329C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853587, "uuid": "678a9ea2-0bdf-4d6e-b143-792dd44f3f84", "value": "12288:4gDE0hI4khp48b1ty7VyIg2rDt9JloK4lhA/w5RLFW941bP90iGjQZ:4gDEoe1BkZVPt4l0w7dP9xG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710853587, "uuid": "c5d06969-ec51-4575-a919-bf92799b6c7e", "value": 715559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710853587, "uuid": "44ec1c43-5f29-40af-b8a5-cd8db71c1741", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853587, "uuid": "fdc90e0b-ab8d-4df8-ae6f-955907e94c76", "value": "nScaned Product Specification.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ed69cd-e616-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710869597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869597, "uuid": "7c1c3a30-40be-46bb-a67f-352ffe07dfee", "comment": "Malware payload", "value": "8f5a8665240dc5245b747ca8936e8325", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869597, "uuid": "f0de0e0f-ac21-4d22-8b19-f9fee539cc8e", "comment": "Malware payload", "value": "1d0d547abad8a76504843cc3350c2705a288a36af56f607fc59b52a5f37ab9bc", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869597, "uuid": "56155270-9593-43d3-a9e7-baf1ebd95ece", "comment": "Malware payload", "value": "0b77d0a573e2ad248a5b2c52d7ab96ade3be9506", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869597, "uuid": "3736248c-5a3e-43d7-8c2a-a54480533ae5", "comment": "Malware payload", "value": "7ccc42c80eb7fd217e26a561506ec0b281ea82a6d065e53b1df6a83a4b0fcaf05953f43a0c78b994f1a9fe3dbdfef1e2", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869597, "uuid": "06f1c90a-d33b-432b-9f4c-eeb4068f17d3", "value": "T120851270D8954441DB913F365CAC6FEDB7BC91869891BF1C0B3EE824DFE687E908814A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869597, "uuid": "c1f8591a-6b1a-4414-b3f3-289a8726fc9f", "value": "24576:0F2ESB7LuS3Rfg4iK/4JwD493FKkFdCEjQLJQOnxl8etz1B9hUXdntD1P:qdM7acb4w2F5FdCGgJQQlxRB6TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710869597, "uuid": "0a567607-71d2-4e40-8eb8-6a3d8199782c", "value": 1842158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710869597, "uuid": "73d69f8f-c98b-485c-8b64-8a76f30aebf6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869597, "uuid": "912bac50-e8a5-44bf-b0a9-21c16f9ba906", "value": "2033FacETPA3297ULLF9465.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9545964-e614-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1710868798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868798, "uuid": "97c44426-8d20-4cc5-90cc-e32ae9227ccb", "comment": "Malware payload (Socks5Systemz)", "value": "f8de8fc08442de00ec8b39735fccb489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868798, "uuid": "5eb11326-c1a2-46ab-b63f-a92ddc192cf1", "comment": "Malware payload (Socks5Systemz)", "value": "1e875f03d2cb485b83af313f5ae7ef91b92611d2ea936365789577d2db5c2c01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868798, "uuid": "13ee2596-4144-4228-81d5-445318e3e2f7", "comment": "Malware payload (Socks5Systemz)", "value": "17607b24ca3ec2b6ee12a9b971685fc38d54e54e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868798, "uuid": "74009022-00a0-426d-b65d-5c03c7a32d0e", "comment": "Malware payload (Socks5Systemz)", "value": "8bbbe4f16907d53e1c780af3488e7ed824b9c0400b964b7bf598dad1a4ed4c989618264da5a255cb9215d2fb5d991bd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868798, "uuid": "b1f25be9-bb59-42d2-9240-a5be0f0e8f00", "value": "T1D4A53303B56CD47ED0A07C3ACE09B139893364351CB9504C729E5E89AF166E4FEA23F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868798, "uuid": "c3301eea-93c5-4723-9d9b-c01bc0a494ca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868798, "uuid": "64c26c9b-8f23-4617-8326-b62405e1d391", "value": "49152:32nanPT6XCoc2/wWr8hphtT3/LeQBxdyRUe3jeuObh/dBKDpY:mnUZrSA/Le6IUeTejX0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710868798, "uuid": "9a478585-1224-4448-8fc1-37a5cc10741f", "value": 2189208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710868798, "uuid": "1e386108-4074-482b-817c-649d603eedd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868798, "uuid": "958748c6-4232-4e1e-9bd7-0f25511e0c8e", "value": "f8de8fc08442de00ec8b39735fccb489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fb3a1f-e5fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710857483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857483, "uuid": "b268d88d-6075-433b-b28d-f65bcd483bc8", "comment": "Malware payload (Mirai)", "value": "11fbe57e72e05f93741d7a1fe740a25f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857483, "uuid": "db79691d-c845-4f85-89e3-5267f21d34ed", "comment": "Malware payload (Mirai)", "value": "1efc997c8766aab395db32ad1f93e1849e1785c1b53e16c8a5123908e35a3d22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857483, "uuid": "8b34e97d-4dc8-41d1-8bc0-121bf5f1ab8d", "comment": "Malware payload (Mirai)", "value": "59437b045fe613663999c795b22c62e850bd3c45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857483, "uuid": "79e66278-b499-4d59-972c-b4152210caab", "comment": "Malware payload (Mirai)", "value": "786373a4b6465752115401b807fb975300dee7a8155e95e557377321807230abcd11c66aee9723e47a9efeab84dca005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857483, "uuid": "dbb7b88b-008d-401c-8071-9cf0cccaaabc", "value": "T19D530286AF74C557CA5CC9F036990E37338429B5963BB33E3821DBEF72ABA66050D150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857483, "uuid": "f60004a2-04cb-4864-9536-7f6656a7de4e", "value": "1536:32ZTV7zxBJmBp+kGK+u83ov3YiEyKi9dQ2gglFAgvDUk:GZTdxnM+kWu83YJEyPs2WgvDUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710857483, "uuid": "6390c2eb-dd2b-445c-a056-7a541b7027ff", "value": 62056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710857483, "uuid": "c8023dda-0a39-4b9a-907b-4cce4f4f4042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857483, "uuid": "fb170ba2-5967-4fa2-b795-f0bcafeb20bb", "value": "11fbe57e72e05f93741d7a1fe740a25f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777c7b15-e5f1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710853574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853574, "uuid": "880b1327-17ee-4f19-90e1-e46de2b34d92", "comment": "Malware payload (AgentTesla)", "value": "957b3d928cd33706fcd3851a29a16789", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853574, "uuid": "fc6a8773-5781-400d-95bf-129cabaa328f", "comment": "Malware payload (AgentTesla)", "value": "200317f0d6795a8f369e3de054f9e170839becacb101a3e686a21fdda9b1fcae", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853574, "uuid": "650e05bb-770b-4574-82a6-deff2517b85e", "comment": "Malware payload (AgentTesla)", "value": "45ab21c994a8a6443464044bad38bb6bac6dc0fe", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853574, "uuid": "e2b7567d-3b2c-46e2-ab9a-2208a51a8984", "comment": "Malware payload (AgentTesla)", "value": "54ac0c5cb629bdf20eef98596cce26533402a293351525ed813538e0979119e9ce08ad507886465d96438464e6dded82", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853574, "uuid": "b8685e93-77c5-4f31-a7ff-83a88894a860", "value": "T1ACC423F2ABC32175525CA59E701916D22AD138B3E3A77DB2B0DB2C3ABDF8E41C641435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853574, "uuid": "2b18ba0b-6795-4afb-8f50-fda0069343e0", "value": "12288:podqGCVWqnziX7gWfrsyfbrlTXoyBYOrja2EcRRUBJr1:CdsReMWfv6CHa2LDAJr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710853574, "uuid": "2bb9ca12-a56d-4ddf-b7a5-5eb91aa605b6", "value": 589644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710853574, "uuid": "56aa3dfd-7e21-48a0-b3fc-3f4227067aa2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853574, "uuid": "ca9b4632-c8e4-4a10-a7a9-bbbb64e73777", "value": "nNEW ORDER QUOTATION REQUEST.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5377013-e594-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710813815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710813815, "uuid": "a613a3bc-e94d-4890-9d03-5b8dcc5bdf2d", "comment": "Malware payload", "value": "3610164d19e92457384cc1af36d19be9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710813815, "uuid": "384d6b4c-be23-4485-9f7f-939be2ead3ac", "comment": "Malware payload", "value": "21bd09751a26551ada2579be19ad3d935897a7496a61d2aa9a3e0d8f746e0bfb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710813815, "uuid": "1cabe311-4aef-498f-a237-e20e837fa5fb", "comment": "Malware payload", "value": "ee8c0ad6a6bc71f2ad2c65447636468d2dbd190d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710813815, "uuid": "5621f7b0-ecff-4a54-ba3f-4bc1d7897569", "comment": "Malware payload", "value": "3c5dc5958580077ca0bb58d19dd8f47ea8ccce5ee0b18799a08da5ceebe6d98514b67faf723bbc3ca13bcdd984f16c1f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710813815, "uuid": "5397156a-6751-4858-9e05-a6e5a9ea17cf", "value": "T154E51203FA539466E8FAD3321A716529617A4C1407CB9315382C3BBF767F5D90F86AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710813815, "uuid": "b3b2d2d0-3433-49d7-b6d2-0ce72ce7b046", "value": "98304:yRB1I3n17gEPyXXITMqEcU0zxzGE1D3Uux+o7yr9:yD8175KXX2r9GU1x+D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710813815, "uuid": "336d448b-759f-4544-8a51-a7ff576ecc53", "value": 3222455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710813815, "uuid": "8dacaf6f-374a-4bdd-b8e0-1f924af37fed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710813815, "uuid": "9ffeaef3-a71c-42b1-a49e-ef4216ef2cf0", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5547ed96-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834619, "uuid": "1e5dae07-9578-4782-959b-1d4546f73d90", "comment": "Malware payload (Mirai)", "value": "56bb7634288a70deed0e3dc87d70872b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834619, "uuid": "ade351b0-b98c-4c56-967b-4e6adb3376e5", "comment": "Malware payload (Mirai)", "value": "2357ca3fb8e7d22ed0cf911a2f99ca64c882b0ead09e7b5104d6457b3a822495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834619, "uuid": "955a9382-1c66-4de8-b136-316b118a8eb1", "comment": "Malware payload (Mirai)", "value": "27087780026ea75a15dcd2f9f230261614c2fca8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834619, "uuid": "27db059c-6e42-41e9-8528-799f17334a90", "comment": "Malware payload (Mirai)", "value": "3e146e233351f7fc97def978a35c32e81bfa27aefd90a872ed1f8a8c5f484f5f460e3562ede2b79935ff3c08c9a0a480", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834619, "uuid": "863cd681-8a61-42e0-91f1-140d87da597b", "value": "T10C235CD06123DCFAED0906702232F732DAB3F47A022DF997CBA5E932D451E5196471AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834619, "uuid": "464496c9-59f6-4c73-b9c4-70d6d038e0eb", "value": "1536:+1e9vQj/rtc6456hizBdp+262l30PJ1rZSAbrYR:+1e5E/ru6+6hibUaF0PJvhXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834619, "uuid": "0c09930c-946d-4639-a98e-b70f3d237c63", "value": 50032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834619, "uuid": "b6102185-fbf1-43bd-9ac0-79bd38da6795", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834619, "uuid": "a9c4a78d-2dfc-4b71-91eb-6599a3e02c05", "value": "56bb7634288a70deed0e3dc87d70872b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2626a667-e613-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710868041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868041, "uuid": "e8756f44-8495-4603-a0f4-db64fe72030f", "comment": "Malware payload (njrat)", "value": "185798f33dbbe25c3fc48b808ce8460c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868041, "uuid": "e0dbe232-7979-4f6b-8af8-205757e2af0e", "comment": "Malware payload (njrat)", "value": "23910908180a95387a88c69fc0c39f677591cbb39e236c69270c16cde6b0e1f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868041, "uuid": "7eda01d3-615e-4170-9445-855a042f750b", "comment": "Malware payload (njrat)", "value": "80034d0bf3444eb14d2a3a1c45e393580c94213c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868041, "uuid": "8f256c7f-b9cf-41a7-be30-8184a30aaf41", "comment": "Malware payload (njrat)", "value": "c9c9bd86e5bbe24d3435ace1200c4a04dc1ce2b39a100cd261d7f4d806303081d45b59408747fedd602916584f2e3e3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868041, "uuid": "a1511db2-0f2c-49ec-8281-41dc4ae202df", "value": "T1C4B22B4E3FA98856C4BC17748AB5961043B491870423EE2FCCC564DBAFB3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868041, "uuid": "637585ed-0f3f-4efc-b579-3870710524e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868041, "uuid": "63988d45-da00-4f6f-8632-dc560a96b7b4", "value": "384:yc6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZ+a:lIU0tw3Rpcnue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710868041, "uuid": "cd7ec918-b572-4c9b-a2c5-1816adb0041d", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710868041, "uuid": "3f10beb7-7bc7-4ced-bdb1-72094a55f27e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868041, "uuid": "d6b93a7b-2d78-41ca-a539-3dfe38fd8a16", "value": "bUmc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f07b66-e607-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710862831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862831, "uuid": "64e0e0e7-c441-421f-94c7-e7053c0ce05d", "comment": "Malware payload (Mirai)", "value": "c9c853b1810c84894f43126b1f5199e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862831, "uuid": "90cb9904-03b1-4957-b16e-13b6cbccb255", "comment": "Malware payload (Mirai)", "value": "24faceea21ea8c2b58d9357b0ecea8def38364831be676cad2e7b7ac58a91087", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862831, "uuid": "be1b9e57-4e5d-4b80-abde-56b4b5a0e4bb", "comment": "Malware payload (Mirai)", "value": "848035d4219d0a4be673785cffe5d858956c70be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862831, "uuid": "3a135079-ed32-4732-a499-9b93aa9ac71c", "comment": "Malware payload (Mirai)", "value": "22b5fa0604bb52378c886997e99a084caa9a1a751b7713658782dd309d6a9b557be597caa690b6780d4b44797e41c2d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862831, "uuid": "97183d65-c922-4348-96ed-fba18cd89dbf", "value": "T150A37CD0FB43D4F5E84705B5217BEF365B72E0B9601ADA52C3B89E32AC51442D60BBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862831, "uuid": "3935307f-4ba1-4a2b-967e-216920c3dd17", "value": "1536:BIQyv/zvY4NKt8ddK6xe3yVPdfgElcw4SYnanbOXSeYZI4RsMu8:2Qyv/zvY4O8XK6xe3YPzlcd/nUaieuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710862831, "uuid": "fc5e159e-d698-44b7-b676-d8a6a2d6bc67", "value": 100808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710862831, "uuid": "0fad2537-d412-41f2-a61c-54cf9183bc5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862831, "uuid": "3ff52740-1d06-42e0-a9f6-9a0d50d41c17", "value": "huhu.x86-20240319-1540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcd4a91-e5f5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710855118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855118, "uuid": "88be8657-eab8-452a-bc46-f49dc16584e9", "comment": "Malware payload", "value": "033cd6d6f8eb929ded98297112fb90ec", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855118, "uuid": "c6afbe41-2d1e-4aeb-a0f7-30895c776ae9", "comment": "Malware payload", "value": "25790c14bd47393b6470247127b92b749bfd356fc04e8d08b0ac730138c665b4", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855118, "uuid": "e99e5aac-21f2-4fac-8513-170816974776", "comment": "Malware payload", "value": "a5241e7e4054f194248611ba4f3a80e671f432fd", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855118, "uuid": "1638b799-a2d3-4771-b2a3-7af4d24efa1d", "comment": "Malware payload", "value": "88513b1fe3a08c1df7b89baac5decd8f0f7feaa6b4dd3cfa9bc34583adf9c636e7c8100f219e2bd8820a5f2e435d8c8f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855118, "uuid": "b23263ac-cb11-478d-b2cb-d1b387efb954", "value": "T1F423FF07A7B89A3EC02C8534004A57F9137DFD4A8A16937BA4D6767C3CBB6B46F00E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855118, "uuid": "5ebf8527-3b5b-4900-b1a2-d661814cf784", "value": "384:fa7niXfnZQCiS6QwMINLos7vvKykkBPV7v97j0+SW2ODPxz99:CufZIQwMIZosLKNkdf01+DPxz99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710855118, "uuid": "563f0f2c-43bd-4028-9d82-76f6ca8afba7", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710855118, "uuid": "f7bbb1d7-4514-4d85-801a-0e436261dc85", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855118, "uuid": "8c8da89b-f0ea-459b-9363-4fb57d706bb1", "value": "033cd6d6f8eb929ded98297112fb90ec.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c819a67-e603-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710861126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861126, "uuid": "bc5edb14-564f-4ddc-b4af-e998a5fcbdfb", "comment": "Malware payload (AgentTesla)", "value": "770c22931039580481b4646ed5bc2c45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861126, "uuid": "a8bf146a-a1c0-474a-8897-2b43a741d56c", "comment": "Malware payload (AgentTesla)", "value": "2581c92f9d54cdec17c02ff7b814ee3f7411c4f7c5e6bd1e4ea95431a1217a37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861126, "uuid": "05aa8d86-83cd-41d1-b890-00953cb14b24", "comment": "Malware payload (AgentTesla)", "value": "f4d7aefa48695c0117b27b336ab40b23c8454f79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861126, "uuid": "2b834116-0982-491e-b836-415144032893", "comment": "Malware payload (AgentTesla)", "value": "282f379252a0a705c716e4d9a44147f0112d940af69e2e7236ffdb14b942b53f60d8e2b0001539d1aa97caa627b62430", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861126, "uuid": "e2ced470-f6cf-4406-a090-cabbf1bf0663", "value": "T18EC4230371B8D5A3EEE265B620742F814B72151554BAEB983CD4239FDACDF438341BA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861126, "uuid": "de25d820-1aab-4fe8-9cdb-325bd43a6584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861126, "uuid": "f32ebc31-8e02-4cdd-890e-18126a3eb7dd", "value": "12288:glPloOJRYWqut6alEAc4XfyWODtwDKkmsEbAJga05J7yIGKXpl:e9oOJb9thl3ZXfFODtSKR9bAJga05zTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710861126, "uuid": "26935696-6528-48c3-8942-623ac908aab7", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710861126, "uuid": "4ccef6c3-dff9-40cb-8669-fa4d8149dce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861126, "uuid": "65d8be9e-ccdd-4bf4-8ce9-0bea3f140d46", "value": "Quote_90002010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb7f816-e5a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710819277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819277, "uuid": "663817d0-8417-465c-b0be-5cdc1946f864", "comment": "Malware payload", "value": "1471850e416861d1476a27061c4e097d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819277, "uuid": "df908d2d-4258-41a4-826e-fad67b32cae6", "comment": "Malware payload", "value": "264c6cabf902b33f501c53461676f6d4966899d40adaa789e82b9a4c5aa227fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819277, "uuid": "a998e122-a2fd-40cf-b906-cd4e78ac2a43", "comment": "Malware payload", "value": "4a23263368133abcf01f8ba855fa7ee425bb634e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819277, "uuid": "4e3dbd1f-899a-48be-ae28-3cfa4e2f0df3", "comment": "Malware payload", "value": "df9c7274794bd49dc5e3382d55b64c3099395a72a415b6e779feb3c5aed3f4108b0c425a0017416ae8524689337c800b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819277, "uuid": "b92cb6f0-61f6-448d-aedf-bdbdeec59d69", "value": "T1F372665AA3D0CE3FCCF86234845F462252B7BC60777183272764607A2DC37945BBAAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819277, "uuid": "f6e2556c-00cc-47ee-a432-d571fdba59eb", "value": "192:RW5Tw9Kkh0avE8UMkc0aAzfHxNe/bcevi/m:0cKkh0avE8UMkc0aYDeom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710819277, "uuid": "a98d9006-44dc-41c1-a737-aac4cc3a60c8", "value": 17120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710819277, "uuid": "a37b6961-e704-453f-aaae-2d26226cc2c2", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819277, "uuid": "a0f6d695-542f-4a92-bdec-ea1aebaf28bc", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24823.28052.18565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9619af-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710836754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836754, "uuid": "b6b8f39e-d89b-4b52-85f5-476f6d633822", "comment": "Malware payload", "value": "20aaac2b81f0489276338456cba67480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836754, "uuid": "5f6ff0be-78c5-46d6-8587-936e7bd3a6ed", "comment": "Malware payload", "value": "269f99b5e172a37074a8ad1c95b76b6066e01a03e507e580949c34633469e37e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836754, "uuid": "b14ad13d-11d1-4e6b-90c4-228491f647b6", "comment": "Malware payload", "value": "e4b03ed9bb8c4a6824d14bbb545783933c898218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836754, "uuid": "53066c8d-3507-4d1d-9e39-f32087d5acd8", "comment": "Malware payload", "value": "bb5b82058f11a1b20af6299e0725bd79e534afe3e4382af5beb350a726c6a6b78350eddfabe47f87a77e3b21ec0588dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836754, "uuid": "96023b1e-d27f-4ccc-8cfd-bc4eac453069", "value": "T1DEA4E102BAC190B2D5321A331679DB21A97D7C101F368BEF53D4693DED252C29B31BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836754, "uuid": "9112f09b-4567-4590-9515-c040f975b42a", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836754, "uuid": "1007f969-d120-4470-9036-6036748285c0", "value": "12288:SBdlwHRn+WlYV+W2X+t4STJWy9fHbZBy3lG:SBkVdlYAW0STJBpHVBy1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836754, "uuid": "b084e9c2-70a5-4227-bec1-03e05b6e0750", "value": 490622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836754, "uuid": "c50dae75-f150-47ba-bfd5-569121123739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836754, "uuid": "14443daa-7381-4d81-84e6-139f49dd96c4", "value": "20aaac2b81f0489276338456cba67480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e23505-e610-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710866935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866935, "uuid": "bf024914-732b-432a-93ec-24b2b2e3f56a", "comment": "Malware payload", "value": "60d07f9e7daf81bb5a9bb4b3bed41bfd", "object_relation": "md5", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866935, "uuid": "0b632445-eb0c-4aee-8fed-9d89a9e5b3ab", "comment": "Malware payload", "value": "2766eeb9422ef9dccc1f208e7cbb807c57decae2b08d82995aaf897a67583c94", "object_relation": "sha256", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866935, "uuid": "2a561cc0-6afa-4c9c-8009-7008d0e4b3ad", "comment": "Malware payload", "value": "2757c793b96639f3bca33bdd07576d3ad95d063b", "object_relation": "sha1", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866935, "uuid": "7451cb40-732f-4c48-9031-f461060b9b54", "comment": "Malware payload", "value": "04d4debe2d8952461ff37e77d0f50a20ca211758b9384b07fdf14a65d19af114ce4418a6c3cf8ebb81d8fec932244481", "object_relation": "sha3-384", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866935, "uuid": "1eecd364-a277-4fb9-92cd-f264bc018d39", "value": "T17443F16F944F085EC6F000BD442F41A74987348B35722E2B6891799CDE86BE7B7E36C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866935, "uuid": "ff806a1b-a231-4a14-855a-a8c54576c035", "value": "1536:Fkws9oLE3Ow6DyPgMUti9xx7bxNfI5ydaRLgIui3pqDyBROnlTE:FSoEOfEgMNdxI5yYhgu5zBRYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866935, "uuid": "3bc29cd1-6b22-4888-844a-85117d43ff2b", "value": 57772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866935, "uuid": "f0dd18a3-adda-459c-8e59-ec118f27b0a6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866935, "uuid": "28b7a087-3c3e-47f3-86e1-70e1bf91ec27", "value": "march19-D3145-2024[1314225].xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1350fd6-e5c4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710834317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834317, "uuid": "9e9b7616-31dd-48cf-bb8d-e4845a8eb09c", "comment": "Malware payload (AgentTesla)", "value": "499075cc74dacec2db7e9bdfacaa4cfd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834317, "uuid": "312d918b-0e6a-454c-b560-e96f873d9b8c", "comment": "Malware payload (AgentTesla)", "value": "2843aae844d0b90a78597dc383828ef6d67ecc6e3d5e689ca4567bc823383b72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834317, "uuid": "aeccf058-4564-4d2e-b61f-8447785b7925", "comment": "Malware payload (AgentTesla)", "value": "2ff4dc2d2ccba3ed864e574c6ca738caef18449e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834317, "uuid": "1ce013e3-a001-4890-b4e6-f4b81cba46a0", "comment": "Malware payload (AgentTesla)", "value": "a627e98443b802763019ad5a7da8dcac7651468a12f22fcc690e02387e09d64c4d060a6e58036f022d4d14bc11b0cacb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834317, "uuid": "262b9bac-0c29-4aa4-b7c6-4976fecdc682", "value": "T136D42320F96DDCE3C7A841FB4E5652404B72CBF6441AF7FC24A47A8EA851FC0A25A947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834317, "uuid": "06d16e0c-3be0-4827-be37-3af380470fb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834317, "uuid": "ce9ccce1-f6d4-4eea-b784-2feebaf39f60", "value": "12288:RgRhtmkdOn7+begUj3aEJSXfmULfQAMM8oGzYKriaQ1iTk/FaEYz1upI:SYka3gUjanfmULfqM8okYKriDABEYz1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834317, "uuid": "301365ff-a77c-4550-8dd8-35501adcd29d", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834317, "uuid": "73112faa-c8ef-4499-ad6d-2ec0f979735d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834317, "uuid": "1313becf-0376-4d11-9805-e44d19495633", "value": "ygLIORmg6imwqt7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c77471a-e5f1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710853583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853583, "uuid": "27a91286-1fb4-44d0-a7a7-a43ece559eb7", "comment": "Malware payload (AgentTesla)", "value": "7dd6a440f7c40467b94d892e21caa7f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853583, "uuid": "a1342fea-1025-4009-95e6-66dae6439782", "comment": "Malware payload (AgentTesla)", "value": "2932ddb810dd9d2f7d25e6aa0784122c9d4750ee7b24bb08de2635c1af859025", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853583, "uuid": "86c34435-ee68-445e-b369-dcf5faf4f0b8", "comment": "Malware payload (AgentTesla)", "value": "acce28dd9264bfe08dc11cf230b55e3b292b7442", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853583, "uuid": "dfc85853-72d7-4cfc-b1ef-fb62d3724ab1", "comment": "Malware payload (AgentTesla)", "value": "ed7d70c2dbd4ef55abbbbfbd9eb79f8f1ac46fe88282749283d62dbf7ed5fc760cdd9fcc3c03574ad240822debaf64a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853583, "uuid": "dfd87bfa-815c-4e1d-87c9-dda46e3272e1", "value": "T176E4339AE8B4154D984EBFA4E5C8624D62D050FC24BAF5183EF97FB2435D8B257329C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853583, "uuid": "108c5b2b-57f4-4e0b-b803-dd20af2f7db0", "value": "12288:qgDE0hI4khp48b1ty7VyIg2rDt9JloK4lhA/w5RLFW941bP90iGjQ9:qgDEoe1BkZVPt4l0w7dP9xGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710853583, "uuid": "4b6128f1-8219-4450-83a3-131681af9339", "value": 715523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710853583, "uuid": "ea900461-87c1-4880-b0c8-d2cc0bae229d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853583, "uuid": "386f8cc9-b395-41d3-98ad-58fa6d206194", "value": "nScaned P.O.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f201ff27-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837030, "uuid": "f1fb49fb-2936-4727-8037-4a0073d0edcc", "comment": "Malware payload (GuLoader)", "value": "7b11622347e8840939b56802932042d7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837030, "uuid": "9626d489-0cb6-436b-8338-524274174756", "comment": "Malware payload (GuLoader)", "value": "2992076fe03184fdd2e2e756ae5fcbc1c7249c4c617a78aca7834860e57185f1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837030, "uuid": "9470d5fc-1e46-4aaa-9c9b-823dda380f40", "comment": "Malware payload (GuLoader)", "value": "9f79b0f12dc115ec3a1b815c64b433dfccbdaa5a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837030, "uuid": "63a33e63-b1f5-489b-b4c4-65740fc84f7a", "comment": "Malware payload (GuLoader)", "value": "b64b8f068185d293e0cad647d0823a40b2b81c8d107db8660e1f4766f28e43e7eb7b5e82a42baf7354fb2be8922ab9ab", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837030, "uuid": "e41d1143-e848-4e64-ac34-d48d73da6a81", "value": "T165B4E16DBC43C804CE4B197251B9E6B9D9E8BD016B9C9206F6C64EDB7B72C0CB10A537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837030, "uuid": "d46f0661-115d-4d3d-a60c-e85284a27454", "value": "93dfc16ed07ebeb5b405221f10d12c0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837030, "uuid": "83a12640-61cf-407d-95c6-19411d01fa1b", "value": "12288:oS2dnErpbwb05qljwsxasX0b6h6wM3Pnc8Vh9fiYnWzBvTjeFl:L2dE1b405qlksxaxbuMH9fimyvTjeFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837030, "uuid": "6a14e85d-b650-41de-a183-37d17d312e36", "value": 535183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837030, "uuid": "e0b81cba-7ab4-45b1-b851-03e3960ecf97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837030, "uuid": "fe785d08-9f5d-47f6-a0cd-47297d2d53b8", "value": "DHL Delivery Note.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3807c6-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710834629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834629, "uuid": "fff1ee44-5344-45f7-8033-e07b883f01c0", "comment": "Malware payload (Gafgyt)", "value": "08a4f824270a413b95b804bfe1252332", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834629, "uuid": "bb0688a7-03fe-4614-b075-7f5a1b5714ae", "comment": "Malware payload (Gafgyt)", "value": "29df8a75a86a74bbd7dbb81555d30a08d1452cb4f22c64c0bb9a46e9d1fd3215", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834629, "uuid": "fb7751d6-e09c-4fce-ba0a-8ec43db7ae67", "comment": "Malware payload (Gafgyt)", "value": "d398ae26f33f52ae1ed460fc4fee96e9153a953c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834629, "uuid": "9d3eb7b8-134f-4362-84ec-a4861c94bad1", "comment": "Malware payload (Gafgyt)", "value": "7629ab1fe9be5693a2128b66f7128c09dd98ea2792e6f0e98b5c29cde317c014db60e0927cb2b0135797428c16e2c2c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834629, "uuid": "540107c3-c83c-4127-8fb6-9fac3edfaad3", "value": "T13424833E7A12AB7DE2A8837107F6AFB19B5511E323A19341E27CC7185E7124D2C8FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834629, "uuid": "a0e605eb-b1ed-44a3-8df2-5b66655d9ff0", "value": "3072:3XC9j6w2ZQgoYJlQeRmhDvy2uSNbtmWu+R9ask0QcYbT5hRBg1cmrpy6n9Nn:3SDCzcYbT5hR5mrpy6n9Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834629, "uuid": "f6c7e490-ccad-42bb-a9ee-8caef7cf939b", "value": 214648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834629, "uuid": "7849d6ed-adfb-416b-a3af-1c675674af97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834629, "uuid": "42ebd6b5-f308-4c8c-9336-6337afff33da", "value": "08a4f824270a413b95b804bfe1252332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afedc733-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710837348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837348, "uuid": "e993dacb-262b-4e25-8e67-3465a27f956a", "comment": "Malware payload (Formbook)", "value": "e5558cef08db7d938729881f2af73706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837348, "uuid": "18a48186-7e71-43f4-9936-bef6afb3c353", "comment": "Malware payload (Formbook)", "value": "2c24f2a38003524a1e35b9eda13cb6ab305cdae7d604534ec5fb7ecd2e31fed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837348, "uuid": "cb9a2a02-d2fd-4fba-b347-d6130fa216a2", "comment": "Malware payload (Formbook)", "value": "6a0e1142a813464bd18787b308a39da6397a60ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837348, "uuid": "aa1a03ce-f482-4010-9193-b67958f021f4", "comment": "Malware payload (Formbook)", "value": "39f8ac390c2e6436f065d5d43edacd02ac8fffd5f1654bc6066f6b29d7349791cad9f43802b628923458955fd4c064d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837348, "uuid": "31731575-8153-40b5-b32d-581189ff8b25", "value": "T13FE423417B78F243DF7641B3409A6E6397716A9608E6DBCDACE470EE26C2F52060473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837348, "uuid": "9e7ae35a-ae4e-4884-a5f6-22bf9ff6b4a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837348, "uuid": "a0d10a58-fc38-4413-b8cf-31f4f0c77380", "value": "12288:elPloOJRYWqN2IEaI1T89pgrmMCsKzHlS9WQuPWtUJLNgb7O3kcpV1AmqdulbkR:Y9oOJbXbaJpXlmWQuPXy2UAfAmf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837348, "uuid": "3793bbc1-c3b5-479b-b619-156f6c22bdaa", "value": 670216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837348, "uuid": "0a4652f5-f7a6-44a5-be1d-a284f846d691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837348, "uuid": "bf9c7d86-2724-48af-8c46-a180c690eade", "value": "Calcium Chloride_Hitachi Astemo FIE Pvt Ltd.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f31147c-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1710837105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837105, "uuid": "fa8f8ee2-7912-4115-b1b3-91942d0759b5", "comment": "Malware payload (STRRAT)", "value": "6931358f3fc8605f88a913672cd3bb2f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837105, "uuid": "dbd3452d-b299-4e2d-8632-a6d0df504a0a", "comment": "Malware payload (STRRAT)", "value": "2c3c7bb834448fb264ee307b45877b28eacfb51c97c1733fb0f5f12e172a2d66", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837105, "uuid": "939d0a46-6de9-49f3-9952-d31df2b42ace", "comment": "Malware payload (STRRAT)", "value": "05058b97361814763d3921808b3058cb7347f1aa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837105, "uuid": "ed09c587-8cf1-48ea-8936-92ddb6660e0a", "comment": "Malware payload (STRRAT)", "value": "577f3193b90e6919e4f9e94e0c9e768a2c59eb5784325c6500a81730ffaff6b3f43658104e9592614655dbb27b2ccfe7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837105, "uuid": "107475d4-0e69-4f59-95e3-2a69aeb7ca6c", "value": "T1D404F1AEBC6EC0E4D443D4322045D172BB0A9158D6C8ED2BEDFC65896C74C6E1E926CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837105, "uuid": "32347171-9021-4bbd-a918-780fd823c31d", "value": "3072:WLiKdwQJ6IIGhKxO9SNr36eE6HaZZhWS26j5I1pemu4Gnxs5z7Up:8lwZPOKxO9wsM69z3Pnxyfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837105, "uuid": "da6a21c7-ddf8-485e-b41a-f8817b469537", "value": 187294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837105, "uuid": "0336be47-fdd0-4238-9e10-0a4facae7881", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837105, "uuid": "f60d49b0-4683-45bd-bc6e-84c992db1689", "value": "New order PI 24E8015.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6525b5-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710837074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837074, "uuid": "a6f7640e-24f3-4c4b-92cb-e31dcba19e0f", "comment": "Malware payload (RemcosRAT)", "value": "a32d581b0e933298fdad8007f0bc4f48", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837074, "uuid": "de9b3ab1-bca7-4265-97a3-195d3224f991", "comment": "Malware payload (RemcosRAT)", "value": "2d7ed09200c40b2f12d11415ea4f46e4b35b03d7e34b11e0e3339dc4e8ed687e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837074, "uuid": "1d0a31c2-8a7b-413d-9859-dd7bc99ac2b3", "comment": "Malware payload (RemcosRAT)", "value": "9ee67035856075573f66028e4694a999e647d744", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837074, "uuid": "9bc886b1-11fd-427e-9168-15178482e33d", "comment": "Malware payload (RemcosRAT)", "value": "bdfacf17f8c1fa90bb73dc8bec846de587f93fa1b0a5c81d19f8dd05c37dd555f0d797ba8ccd511135fcb4e71b0a309f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837074, "uuid": "a9f7af76-87e5-41c5-94c2-8304ef573873", "value": "T162B4237090A3BDEE13BA9F04B3A05C646F105E17535855CFF9EA3AE00BFAD48CA17855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837074, "uuid": "c31d8fc7-d3e1-4250-965d-83ff71f82d06", "value": "12288:/2q1MBozZxA1VEWdNIb/1UYe0kagh//3PBLXgIe:TCBaQOWd81Uakzx/PBLXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837074, "uuid": "3b9627fb-7779-47f0-904f-8c27e4043ea7", "value": 532956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837074, "uuid": "ab510aee-b79e-4a75-82ad-072b4571149e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837074, "uuid": "5145d2fc-1b29-49ae-9672-1adfda1fade5", "value": "RFQ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8850a88-e628-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710877413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710877413, "uuid": "090b822a-31eb-4a97-876f-95a03be4c99c", "comment": "Malware payload", "value": "8ae4a2d24f53985e238309b0fa081449", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710877413, "uuid": "b143db5f-ce87-441c-b5c8-890cea592de8", "comment": "Malware payload", "value": "2de3942e7690adafe16c6ae5692d9793466d50a4a41ccc66acdaf51573584357", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710877413, "uuid": "6d2598f2-004e-418d-8c9a-fd287695b273", "comment": "Malware payload", "value": "42bde0530c733c8a5d162249c18388a404c7e6df", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710877413, "uuid": "fab3517b-79ee-495e-a9cd-edf91ef1ceaf", "comment": "Malware payload", "value": "63daa4b5d434706d757e064b472705f33020e3baad876ee07eb2c7434c8f1dcf41d37a683aa66746f8a12f6efb1f5415", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710877413, "uuid": "b702ba2f-83a6-4f7f-9b72-88cfe074d406", "value": "T1DD5533AECE183F51DDC53A3E1F5D4D0642DA674A720A9F27645E62AB63E4DB0FBE4000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710877413, "uuid": "3015b37b-7727-47a1-a4d4-818f3c46a47f", "value": "efd1995c46e45a4846a5ccd232691582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710877413, "uuid": "8314f5b7-cfb4-4a0a-992b-3995ae07230f", "value": "24576:xBLTFwqT5d+40XAgxrM8hEwNDfUANISCd9bRmIIaIWIE7KB+52x:xzH+40QorM8EYvErMCKC2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710877413, "uuid": "4a5c2f85-ac70-49e4-8111-3d429f80733b", "value": 1381248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710877413, "uuid": "817a46b4-ccf3-4dd1-b671-1cabbb8ce932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710877413, "uuid": "77b8c5bf-496c-4e94-8eb5-b2f4f1452503", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be5d482-e607-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710862843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862843, "uuid": "e2e25329-bbc6-450e-b7f1-ed13a78e5f14", "comment": "Malware payload (Mirai)", "value": "8711deae675f9981b49dcd62008a0849", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862843, "uuid": "204e6d3e-88b7-474c-b770-cb2cd0f4a71a", "comment": "Malware payload (Mirai)", "value": "2de87f84a7cacb37e9fb2a32576dd030a5da4e0f348f5d6b2b869d073bb39bf7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862843, "uuid": "cf573a08-97ee-4376-b49d-5bd535ca26f8", "comment": "Malware payload (Mirai)", "value": "6e953e17f809654482ea2a3e32b06cfd9203ba10", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862843, "uuid": "c72d142c-e0fe-4bcd-a34c-39b655f53eb6", "comment": "Malware payload (Mirai)", "value": "7cb75008476d0ac26972a2c01c235faf7bf77236b701c725e769ad129a6e90505659f1e47549d173341f999dfde0e8db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862843, "uuid": "f3d06148-58bf-449d-abdf-ef56d018faea", "value": "T171141A46EA404B13C4D627B9FADF42453333AB5493EB73069528AFB43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862843, "uuid": "3c843d52-ac67-4f2d-9f2c-7c22fa4419b9", "value": "3072:U8nebkiQBsoU4mIWagbQu05NzPAst9l+e30NrcogM/RG/o:FnrFso1lWagbQu051T9Qe3urhgM/RG/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710862843, "uuid": "71d66b1d-e6b8-4c31-8dec-ddaab18bd454", "value": 192706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710862843, "uuid": "1250c9ea-375b-412c-9462-8540a941972d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862843, "uuid": "01cd7de5-ceee-4524-8542-ad5bafc88d3c", "value": "huhu.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2039e1ba-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1710837107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837107, "uuid": "736d789c-883d-4132-b287-1864631f78b3", "comment": "Malware payload (STRRAT)", "value": "6c4517de2d20c07218aacd670022ad00", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837107, "uuid": "231ca60a-dde7-4eb0-959a-93f7cce972c0", "comment": "Malware payload (STRRAT)", "value": "2e2dea44f85ff4988ed8ddfcee37cc0e4ec9eadb941222eb8afae8a8358b892c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837107, "uuid": "f25e4be6-5e0c-44c2-b775-829581d985cb", "comment": "Malware payload (STRRAT)", "value": "78d0f64fc0f4c5d6902762bbe514a7e1af8708d1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837107, "uuid": "a1ba8a44-4df9-4b49-8591-e0836df7948c", "comment": "Malware payload (STRRAT)", "value": "5a5c1478115029cb325b351b0ca3a14137f5d04a76e5bd7009b92b8387235da31b39fe4d04535829b197a50b6713f954", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837107, "uuid": "590c6825-c133-418a-949d-9b78f748bc4a", "value": "T15A04019B2D9DC8F8D843547318408A7BB6AC02E8D64DD21FA5FC9C595D32D8D4B42ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837107, "uuid": "47c7e58e-b0fd-4a9f-82fe-18517e88a96a", "value": "3072:iM9ZDCAIY6kppdX3UivK8V4Elu1n4M1vnYivy3LdCi0oUGGKp2iEYLpNj7bFDm:iMDLIk/dnU1x4M1PYivxATFLPbFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837107, "uuid": "6abf2d3f-40f2-411a-9667-be305b4b060b", "value": 182714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837107, "uuid": "b6511640-b234-46ff-bf45-bab7ab1a6260", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837107, "uuid": "a9a16ba6-4412-4903-ad41-e0ae5a6b9416", "value": "PO#0015871.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca8c09d-e5d0-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710839329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839329, "uuid": "ebcc128f-0529-4f1c-9d85-47295ae6e94e", "comment": "Malware payload (RemcosRAT)", "value": "5136515764852b9e3c8ea843b3adea90", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839329, "uuid": "f1c75539-bb49-422e-bd11-c6f3b135fa23", "comment": "Malware payload (RemcosRAT)", "value": "2f21bec84cb26e79001fd427929bbccaa76cb6aadce203557bc9693ad7f81d90", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839329, "uuid": "45fa5662-f417-40f9-8ed6-60e94c74ab10", "comment": "Malware payload (RemcosRAT)", "value": "facb800d5c4c24b3d8601c91b37241fa0a770e33", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839329, "uuid": "0ea40dd4-b0f0-459d-b84a-250a42f550b4", "comment": "Malware payload (RemcosRAT)", "value": "cfb8ab4b5e8057f603f51ab26b7233d8384f94a109202dbcdb8b7dd95681a5755cf6bce32e178f00ef796570b1b4299b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839329, "uuid": "0bf993fc-a50d-4703-b896-14fc57143ff1", "value": "T1DD525059E38F85F5CB986233023448895AFCF73FB11616C971ACA2713BFE90C59A90B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839329, "uuid": "f7015bf6-1646-4dd4-9ef4-5934c13f6ed3", "value": "384:TZ17c8JZFweYcPxugxmFEHNHuc8JCqVUrnyUyo8dfkA6PQMug+RZy:V17hJZSeVPxu7FEpN8JCqMy1okkAK7uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710839329, "uuid": "6dadd689-56b8-4ea4-b4e9-7a7a13ec176d", "value": 13399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710839329, "uuid": "d12883ca-97aa-48e3-92a0-4717937bc7cc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839329, "uuid": "0aff8689-6aa8-47b0-975a-f9d6a70803b4", "value": "5136515764852b9e3c8ea843b3adea90.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b04553f-e5e9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710849957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849957, "uuid": "fdb53e75-e392-499b-8cb1-999a5fc63b8e", "comment": "Malware payload (AgentTesla)", "value": "3f7c37acabf627bec3852972021a00db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849957, "uuid": "7a403594-6401-4682-a657-a7754185db80", "comment": "Malware payload (AgentTesla)", "value": "2f34b538be532d42d6bf9c9f2f54442355991ed12b15ea11a3cf0c7382df6f7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849957, "uuid": "68401c6f-2887-4a6b-82a1-fbc08c071600", "comment": "Malware payload (AgentTesla)", "value": "cd2e26c173abecae88fb2cd3bd2bd163785e1f20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849957, "uuid": "f29621f8-2af8-469d-8f82-220892ec370b", "comment": "Malware payload (AgentTesla)", "value": "3884bca805f986d0f900f0e69a2e4af7229d1b72bdbf0729572fd66827f8ffc8605a28e612d9c9c92d36523b9ecbbd67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849957, "uuid": "21fe19a1-6242-42bf-a02a-545eb13865ac", "value": "T1B3D423C6033C6318D723977521A712360BF1FB722EB1D8686C87A0E9B6857D23591B7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849957, "uuid": "8b781388-e810-4c2e-9b04-0d773440b66b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849957, "uuid": "c22ab57a-6bda-49e6-904f-5b1e342aa5b4", "value": "12288:pNHehc3NlZr8rtxCYSnN5kvUtx62v68toS+LdOJRYWqEkR:pNH2i3p8rQnN51t5v68BidOJbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710849957, "uuid": "355929e9-63e2-4c23-bd90-f6a01687ef4e", "value": 641032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710849957, "uuid": "7dfc1b56-624a-48a4-90d1-b0a05dfb1445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849957, "uuid": "b5c22999-43bb-4329-ab89-55aafe6e5303", "value": "Order_ OFI-MAR-2024-000019_ Valve pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ce948a-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1710834919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834919, "uuid": "9c6f1566-2b91-4598-b957-ac5cbc7fc3ad", "comment": "Malware payload (ArkeiStealer)", "value": "538cc587125f738ae81e2e4fe28c0084", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834919, "uuid": "ab11f894-8f2a-4a79-8631-2b12e07b7424", "comment": "Malware payload (ArkeiStealer)", "value": "319b8b4f833b7a319dae6c6ff148d0ec75f83ac6f031678a54ab31a5ab360c39", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834919, "uuid": "7f3035b9-9b00-46fa-a3c6-60d2e35e55d4", "comment": "Malware payload (ArkeiStealer)", "value": "7aa3c65496b968c3641b7d7db1849ad4715053d6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834919, "uuid": "d9347c5f-a064-4668-b918-55b2da07a23e", "comment": "Malware payload (ArkeiStealer)", "value": "80ee5cb08f354cd3e665718759554fa9a0609556015a823e5ac647e0aa1574f18b12ebac250d45c738184513ca30587d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834919, "uuid": "874a9ccf-26ef-415c-b25e-49449b2d5e30", "value": "T15BF3CFB599B29AA4C8F892FE5F01BE31C97E342C34724603D1A45D89047F9BBA78351F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834919, "uuid": "fb29ee23-aac6-4e3c-a50a-eb4aa3b851ae", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834919, "uuid": "53a15cad-3bb9-4be5-8065-8fc778f674d1", "value": "3072:UP2iydi+7Jtzet46rSIskyH39vIe3EZ8CbsZEE6tLJSp8Bb8EG:edIfzetJFyXRlCbeV6tH8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834919, "uuid": "9224ff2e-f46b-47a5-a967-c24af6b6d030", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834919, "uuid": "f6c771fd-23a7-4c80-a94c-b3fb713b3ae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834919, "uuid": "fccc7776-54a3-4549-872e-19183ab9d778", "value": "538cc587125f738ae81e2e4fe28c0084.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd4fa52-e5c2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710833422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833422, "uuid": "b4d7aeb2-9fd4-491d-833d-f52f0a41f836", "comment": "Malware payload (AgentTesla)", "value": "345830556ac7704d8ba8bb4a378df217", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833422, "uuid": "1d9a2039-e4e1-4ded-9625-be931da35ac8", "comment": "Malware payload (AgentTesla)", "value": "33ee6e3da72d9525bf52588ce45c2d95707066f89936b402d1e1d1e33d96ee99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833422, "uuid": "390782f9-0845-40a7-96b3-59fa78f53e23", "comment": "Malware payload (AgentTesla)", "value": "0c0a9bc709cdf151f4b5b782b419b5652840b40f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833422, "uuid": "6fb37068-0d2e-4051-bcac-10a74d581c53", "comment": "Malware payload (AgentTesla)", "value": "1c9f6869d74ac9120c8c7745ad89402d5f670ecf9373f7dfaeb77bca9e0c7b801f7d03f6b35d68e729964ffb7b5f66ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833422, "uuid": "ddd4d07b-3899-46f0-be21-ac6ec77cb774", "value": "T10345193C19FC1227D175D2A1DBD48023F764A4AB3125EE2989C603D64B6FB426D87E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833422, "uuid": "75745adc-4586-4216-89dd-f74be902fcec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833422, "uuid": "10dc58f0-c18b-4ce8-b06c-9afe195b1ce5", "value": "24576:wqM0sEMgtARQa91iTyooCFlxbGZ+87wY+if9fYGlG:wqlsEMgGQa91iTyiFx+z9fYYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710833422, "uuid": "510ed1fb-a8f6-438d-917e-86ae7275008e", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710833422, "uuid": "d48cf712-d00d-40a6-8d10-787c34cc69c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833422, "uuid": "9603de88-3d0f-4d8e-8cf3-bb372f0abc2f", "value": "Scan_Document_docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7106719-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710854513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854513, "uuid": "f2f1d600-7f9d-44cc-83d5-a23b11a79809", "comment": "Malware payload", "value": "5945cfcd43c1e5ad2584256fcf3df2ee", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854513, "uuid": "6fd21c83-8d6e-48c5-8b13-fe796452a6e7", "comment": "Malware payload", "value": "343665542b93d75bd0baa4cfb354211d938dd6df30be590451ef8534d17cebdd", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854513, "uuid": "aa16e547-02aa-4fa5-99ad-f91c28082dab", "comment": "Malware payload", "value": "f17e2352b5b6b38ca6521b2ac94ff5bfda499b5c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854513, "uuid": "bb485d63-d5e7-4178-9e01-c557a621b819", "comment": "Malware payload", "value": "c94b5dea25a7fa4eaa47781a87ab08e3804b936f75bc09ed533c265f2ab5dd9ec906f0b6647782fd1021524b2d0c6461", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854513, "uuid": "ff4f92f3-0873-4091-b915-f972d290a642", "value": "T12A0695AB2FAC1B862304739F5B9FED540617CCAC07C65F8892C39DD95409BAB2950D8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854513, "uuid": "4b450f5f-75a6-4179-a896-83f4f2c7216c", "value": "49152:wPpmq12RxHW9ub71aMBQweyrLLX+5Z4yPLyiTvCuP8s7JaqD:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854513, "uuid": "6c982328-ab96-4a24-94a5-c580b6955a35", "value": 3761661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854513, "uuid": "f22b6266-c42a-4dc7-81b6-9bae89946f2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854513, "uuid": "a37e270f-46b5-4eb1-824c-0631b6138f94", "value": "Returned Swift Copy of Payment #475479.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e929e2-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710854290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854290, "uuid": "10a63910-f095-412d-bf83-f8bcec82ce0c", "comment": "Malware payload (AgentTesla)", "value": "93096f7eb21ebab69dbfff307c5e7f76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854290, "uuid": "81489d69-4bd1-4474-b09c-44366ef31256", "comment": "Malware payload (AgentTesla)", "value": "347cd01ca6795fb55f94e8198074df3ec9e61bbed474f73b8e89f320339a795e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854290, "uuid": "cebcca06-43cf-4531-85cb-cc0a1728a293", "comment": "Malware payload (AgentTesla)", "value": "9427655b51462d4aa3408a1fbdbb6fe1037b52bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854290, "uuid": "8630a21b-e3bc-4ed3-848f-96ab09edc247", "comment": "Malware payload (AgentTesla)", "value": "dc11a0ca04ee0ad0a8391ccb53dce5fce6711d9929f7328defb7637f377066ff60138205fc69a42dc012382cdc1a9758", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854290, "uuid": "aaeac7f4-6bc7-4dc1-b617-3f4744dc0c6a", "value": "T186D4230876F8C383DDB79AF8585A1E1B27BE562778A3D6D04CC030DF52EAF228216557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854290, "uuid": "befdb1f8-3f7d-4a2e-8f88-882d487c9cfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854290, "uuid": "e524f253-095f-4f99-9095-68f4568d63ba", "value": "12288:WlPloOJRYWq25Q93vEIdu+6RytEEbU+pOS7O51pny5/sH0Z0YXdqipb0b92wj7zl:g9oOJbX8fztPbZoxXpny5/NZ0mqpb8Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854290, "uuid": "394f90bb-dbc3-4cd8-bde7-48075be00069", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854290, "uuid": "6cbe21cb-1c00-4fcd-afe8-f691528e07d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854290, "uuid": "39c11b01-231a-4f30-9acc-f9a8c1c77b67", "value": "r2024000000025s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0d7a40-e5cf-11ee-a120-42010a9c002e", "comment": "Malware payload (MassLogger)", "timestamp": 1710839058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839058, "uuid": "d9f1ed87-28af-46fa-991f-37aa06ff544e", "comment": "Malware payload (MassLogger)", "value": "088479e118878292fb048c6f04fd7299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839058, "uuid": "a03184b3-3d0d-4e1b-9e6f-86dbf96f0d72", "comment": "Malware payload (MassLogger)", "value": "3733681e2feca96af88e83cbcf75ea02e8300c2fe0cc9edb022b160466b41ecb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839058, "uuid": "6d2d9a6f-fff0-4f8b-889f-05c40420de1a", "comment": "Malware payload (MassLogger)", "value": "c7c18ef4a16ee9e3d77ce56aba802b57f2d33a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839058, "uuid": "c80fed45-b6f1-43df-8a09-1a40f38daad3", "comment": "Malware payload (MassLogger)", "value": "3e8b65feb6197dc7e1a3e77aa18034c19f9b320ec72056e60efab6e42a63258ef3f0e7ee4d6c883cd36630e0b860a9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839058, "uuid": "84031672-5836-4904-a2af-191d1b49d4be", "value": "T159E40158138CB843ED3E07BD44669D92437610F3B5329B0E29CA56EE9B23358BE472D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839058, "uuid": "4275b576-13a6-4403-b322-048b7d7ef3e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839058, "uuid": "c7e790d7-3ece-4639-aff9-d943765fa86e", "value": "12288:0QznJE9JOwL0CXbAX5gVOqUg2ZTEu2ZJW9LTtNScGN4ZnTbQ:jVE9JOwLpXSeP2tB2ZJW1+N4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710839058, "uuid": "e43455b4-c700-4dfa-bb65-2757861bffb9", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710839058, "uuid": "0a2816dc-4d95-4c88-89bf-a4c478393354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839058, "uuid": "09fcd53d-c09c-4358-acfc-f34bd3b953d2", "value": "faktura-marzec-2024.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e689fab-e5cf-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710838849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838849, "uuid": "a0b8e723-e3fb-448b-8dd6-7ccf5202ea26", "comment": "Malware payload (Formbook)", "value": "31aeff0b92d96eb73d4aaf624eec07a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838849, "uuid": "cfd7e173-da5c-4aa6-8f5c-1ea534ab89b2", "comment": "Malware payload (Formbook)", "value": "37c4f4f899e08371042e4b4cc03b87297989ad424c62228a7a50293f2ea7de22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838849, "uuid": "9442eb5e-64fb-48ca-9d71-4153baf2c267", "comment": "Malware payload (Formbook)", "value": "ca2e787144dcd2b969fe7bf78de63ce63084bc61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838849, "uuid": "f93fffb8-a12b-4422-a8e0-2cd65e672ed7", "comment": "Malware payload (Formbook)", "value": "cea8ac0aa12318e0c37d4f1292d9f40a735de40a2410c2046141ae1b0f41d4d21b7dae5d82f9e3968f9ec4c1ec69e38c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838849, "uuid": "5eb1dfed-0d73-4a9a-95e3-37de7b1de703", "value": "T1F7E423A07975C1D3CFBB86F819789B810BB2588E7D64D2D88CA511CF85E1F412211FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838849, "uuid": "10c317e7-2cf3-4954-9994-4cc7af770432", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838849, "uuid": "782c1f62-7247-4b48-b70e-593c3b7aace2", "value": "12288:/lPloOJRYWqI9eJwqI570fxuP8oIrXrwbTLkQB2rJ0szg8fOMsSAol:N9oOJbHa3ICJEAkTLvAJHwSAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710838849, "uuid": "b31787c4-4538-4205-8d7e-7356e6e077a3", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710838849, "uuid": "36b84a2c-e009-466c-8a2e-05c4a0328260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838849, "uuid": "67a985cc-8eef-411c-be58-60001665a12f", "value": "FEB PAYROLL 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de602b90-e60b-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710864914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864914, "uuid": "3044fc85-9c7f-4a1c-b811-0946a2689aa5", "comment": "Malware payload (njrat)", "value": "3f1d6c61123a1f80a91dd758236f0d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864914, "uuid": "4d173f6d-127f-49c5-8954-a5083b2667f6", "comment": "Malware payload (njrat)", "value": "37fa44c49d2cb418eb330410cd381d4cff666ac719a52e5d5274a026581a994e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864914, "uuid": "13866eb2-31d0-45a8-96e4-ad2658d3cf49", "comment": "Malware payload (njrat)", "value": "804a0525b277a898f6e4ddfdfc5a2f8812413650", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864914, "uuid": "1eec782f-bd34-4cdd-bb09-41fe8d2385a7", "comment": "Malware payload (njrat)", "value": "13d529282df9bccf6c73b92b88f76f041091ff083e6f1b9b7bb6a08e7fd8897df66d52885f2cc654596e234250a7a3e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864914, "uuid": "00a463cd-5955-483f-8f8d-9d661b1e2aaf", "value": "T16AE208067BE94215C6BC5AF88CB313214772E3838532EB6F9CDC88CA4B676D04655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864914, "uuid": "69fb6728-c5e0-4650-a761-33741ece2ab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864914, "uuid": "9d4f6aaa-874b-4496-96d5-0b90e1ce7340", "value": "384:C0bUe5XB4e0XtgONvw0Q0mS03AWTxtTUFQqzFmBObbJ:bT9BuRC55dWbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710864914, "uuid": "2f984615-0086-4324-80b6-d36efb7ec3e4", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710864914, "uuid": "b578f1e2-ca82-4de7-84d9-7f1fbb4a7c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864914, "uuid": "c9d79983-b6a9-42e0-b7d8-21a5675848d4", "value": "3f1d6c61123a1f80a91dd758236f0d36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860c6a05-e5c0-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710832554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832554, "uuid": "a94dda91-c6f6-43cb-a6f3-1dcae2eb9127", "comment": "Malware payload (RiseProStealer)", "value": "30ae20a0b49d4f3ac0946ae9b7e5c505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832554, "uuid": "99e66355-68b9-4d33-8edf-9a16325ee29b", "comment": "Malware payload (RiseProStealer)", "value": "38628bcd70fb5bebb6dcfc1b91b7f573c54382822a77ec36d955dce2b6493195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832554, "uuid": "2b400f51-2176-4ed0-9f54-5001aa599b31", "comment": "Malware payload (RiseProStealer)", "value": "9d60e694a718b7e0ad46fb604e931449ec017bfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832554, "uuid": "3b702630-ef79-47c2-b1f1-d8793fef6bc9", "comment": "Malware payload (RiseProStealer)", "value": "7e712f28fa65855490494e780fc4477214835128e680edf93ad1afe805427138eb9686a54bbde21222866ded07ba836b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832554, "uuid": "be5d54bd-3f91-45cf-b4a3-733ff410cc6c", "value": "T14DC5120BB6458D10C0586B76C497922143E06A83BB67F64E75C9239B4D433FEE94EBCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832554, "uuid": "96a9a9f2-404a-42e5-8101-9727519f2a87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832554, "uuid": "73fc67c1-e843-4f3a-9d4b-ed02235af654", "value": "49152:+X3FQ5aRMR+4CzoYys5pHeZ3teWdjLxtGbd9hvXbaRSYnSHZAn+5HILieb:+X3FQ58z4PZ2peakC/ZOnSH+ngHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710832554, "uuid": "722b5b0e-fa0b-4953-ba57-3b504c38e488", "value": 2600448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710832554, "uuid": "67c0d82a-f734-49c2-8a65-8476a0960dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832554, "uuid": "5da57c03-ab75-44ff-b606-c18b7fab4280", "value": "30ae20a0b49d4f3ac0946ae9b7e5c505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940b56a7-e5c9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710836443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836443, "uuid": "28948538-32aa-45fb-b1e9-ae0a82502fe1", "comment": "Malware payload (AgentTesla)", "value": "9da1c1003343966cb14acd150070a54f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836443, "uuid": "4aa05e9b-36e6-43be-9d10-9c4bbabe5844", "comment": "Malware payload (AgentTesla)", "value": "3a93ebec868141d7e6d804c825c79934f5db6b72825c74635b9f6c0f98217b76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836443, "uuid": "897014e0-7c64-48a0-9397-14f5e9c79ed6", "comment": "Malware payload (AgentTesla)", "value": "6bdb294279f50e4e6ad270664c9733acd4d586de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836443, "uuid": "b3f32f8d-315f-471b-b0eb-d2aff248b617", "comment": "Malware payload (AgentTesla)", "value": "6278e2271f303b4262017a9ecebe6eb468f4f060ebd5f6b2b2022c513e084d8b61026ac569404826ce0b9835e075eaef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836443, "uuid": "5c6fde9b-de2c-4573-bc03-1a5d5e37c7a0", "value": "T1C0D423366A88D678EB7B4FB730122056F3965DFB8D45E2BE4E0899CE78E0BC70441D49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836443, "uuid": "af5bfde1-7949-42d5-96ea-4dc549f0fecc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836443, "uuid": "216687db-551a-4d2a-a734-4ca941170ace", "value": "12288:JjWm+U8a9nFn6D+hbpZZMxInHoLnJK1dQPLeKS8VtMpOJRYWq:YmFnQ2b3uxInuJKrQzet83mOJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836443, "uuid": "ef8ad4c1-0a09-4b26-a3a0-e978180b83b2", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836443, "uuid": "1e67f88a-ee98-4a83-bcc5-a6f57e768690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836443, "uuid": "c4d97e12-2ba1-42a7-a8b5-74470afe9879", "value": "Invptapayment19032024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ab2703-e5d1-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710839720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839720, "uuid": "d4d6f72a-48a0-425f-8b6a-487963ba04a2", "comment": "Malware payload (RiseProStealer)", "value": "bb7d21e6717a1af5830577bdf8da50dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839720, "uuid": "cc6f3f54-68e4-49fa-aa37-2938c888af2f", "comment": "Malware payload (RiseProStealer)", "value": "3ad0819db0c2ba840fff7812ff303d60354ee2d834eb96728b1cfe18475918b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839720, "uuid": "27c44236-dc4b-4641-96ad-b32792f268f1", "comment": "Malware payload (RiseProStealer)", "value": "67c26b4797b87a445764ab09da68c1c2957967f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839720, "uuid": "add60765-41a8-4d9c-8c7a-500a072e63fc", "comment": "Malware payload (RiseProStealer)", "value": "f74bb93cc708ed96ab4f77810f884bad771a261023062fd1e1e70c5c0ae49738997ab07ee012d39e89867770608fd082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839720, "uuid": "ab4cac12-d65f-46b8-8642-20be49291067", "value": "T1846623937A019EC0CD5C04309A6AECBE35753DB684904EA3B1F93F9E9DF2520B53794A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839720, "uuid": "f83066b6-00fc-483f-8787-3f39db800a3e", "value": "b279e2f2b98cf3638cb7de1d8ce825da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839720, "uuid": "1aaeefdb-869f-4ad6-bd75-94d10077247f", "value": "98304:sJ1N3U4XCVUX8YKVB8ClyRURcDJ8i8Gf2zfaf7MpBXU9Ktk/qtW80cnj6EMMRHGa:sXMB8oyOcZwgMpBU96tWKGMGV7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710839720, "uuid": "40955d3c-b287-4e5b-8177-9de8c9e8c021", "value": 6632960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710839720, "uuid": "758601d5-9623-4bf8-9172-e684e2067f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839720, "uuid": "f68d0f24-d49b-4400-92b6-476d6f97b61b", "value": "bb7d21e6717a1af5830577bdf8da50dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25bff03-e591-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710812415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812415, "uuid": "d4f1d6e7-fd53-4818-8876-006a6703f9a0", "comment": "Malware payload (njrat)", "value": "3262dfff4eebff9f1852f31e5d9855a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812415, "uuid": "f2eb8653-5fa9-43b6-a4e4-7c9b2efd0c92", "comment": "Malware payload (njrat)", "value": "3b0bcecead0fd4283eef36125258460faf86eebc2977d40805c780bc57469b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812415, "uuid": "0c918794-b974-4de1-87a2-186c3aa49dfb", "comment": "Malware payload (njrat)", "value": "3f84b636a2cc0920f3466af9e1ade80ad1ebcca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812415, "uuid": "b6c25563-7623-4203-90d5-eed660dbd888", "comment": "Malware payload (njrat)", "value": "8ccf0961c88b5bf60f988708278f58bec8dc7141a719b9294f24006a23651f5f478ff92f8d228e35b4f0a81cd50d54e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812415, "uuid": "1615e992-e92a-4653-bdba-cfee2332b71f", "value": "T1EF03294D7BE18168C5FD0A7B05B2D41207BAE04F6923DD1E8EE5649A3B636C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812415, "uuid": "efeacd84-405a-4092-bc2a-fcee8f6c8833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812415, "uuid": "fd65b73d-26dc-4363-bf3e-bb91c50e5f0d", "value": "768:SXdKl1lU76yAF6sIvrM+rMRa8Nu5fZut:SXol1qDAF+w+gRJN6fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710812415, "uuid": "7a24bae7-c66e-4655-8ca5-c1916ee57219", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710812415, "uuid": "95abca30-06fe-4f9d-bcee-0a173473887a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812415, "uuid": "c8833ada-f211-435f-b3e4-27658f596d19", "value": "3262dfff4eebff9f1852f31e5d9855a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584fc7c8-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710834624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834624, "uuid": "6e332463-2d82-4d2c-91d6-04e5c78a54fa", "comment": "Malware payload (Gafgyt)", "value": "6ade200cd704e29b8d94cb2ab1c2e65e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834624, "uuid": "6729ded8-7bc6-4a33-b43e-ef43035f7a18", "comment": "Malware payload (Gafgyt)", "value": "3d7665a09dee80849c12cb8f9b91e77c233393e359c37a8902608ede6103fb81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834624, "uuid": "b73bebb6-daba-4cbc-9b09-df6b95cb8b48", "comment": "Malware payload (Gafgyt)", "value": "98fc43e3ed9803cd627267972df759fb112846bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834624, "uuid": "62f42e6c-38e4-4c05-b9bd-dd4262db6aed", "comment": "Malware payload (Gafgyt)", "value": "43b04d96c81870d26977b81ad0c099db03f4341cac536e44fc74b960be613fd2e138e3feb3dacbfb0b7b3dca8f064a2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834624, "uuid": "9a1aafb3-0316-4d07-9646-aaf517a85f5e", "value": "T183F30976F811CEB3F04B96B208DB8E216E70A7E31B532122636736A7DD361C53857E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834624, "uuid": "0731ac43-d46e-4177-b12a-0253e5e31176", "value": "3072:6upHLzPDDsUOrq5fQeqacWucW0JcWcBFzxDDYhuM45DR8DSvZJ3DtcaQ1iwmmu1L:l3fQeqacWucW0JcWcB/D8UHRR8DWZJ3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834624, "uuid": "1459d24e-57e2-4197-883d-9fa686755100", "value": 159434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834624, "uuid": "d3cf58c0-1aa5-4fc2-8128-925596ed34b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834624, "uuid": "4134592e-7b01-41fa-8950-e3b535a982d6", "value": "6ade200cd704e29b8d94cb2ab1c2e65e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00080447-e5f9-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710856810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856810, "uuid": "4d2fe1b4-3762-4d34-aa6f-05898d3f3a9e", "comment": "Malware payload (RiseProStealer)", "value": "23de3722fb8e20f66cc9259cbb20cd47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856810, "uuid": "cd66093d-da42-4220-accb-af3bba26d2f4", "comment": "Malware payload (RiseProStealer)", "value": "3e97398ad10149d1aa5ff965d5d195173cec2414178796c83758a8ebb8c36c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856810, "uuid": "f7aeb2a6-4e59-4d27-978d-f23777f163d8", "comment": "Malware payload (RiseProStealer)", "value": "3872d38cc7335fa69a0d76c5d0a7face5a738dac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856810, "uuid": "b7597db2-5550-440e-8223-514e2c5e5eef", "comment": "Malware payload (RiseProStealer)", "value": "5db0b6c9dc7c761900068569ccb84a4aa07082ba07b40a32340f577095dfd5369c5bdda3df58910861c08138d80b8581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856810, "uuid": "4b90f111-843b-4cd0-bbcb-57d733bf7161", "value": "T14BA533148F72ECC7DBA040F649E9E728AA25DE59B19140D6308E3BC51FBCDAD52C939C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856810, "uuid": "16c58536-499d-4956-b85f-a245d2e91fa8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856810, "uuid": "7c13a6bc-ef0b-4b2c-8fa9-f58b05d3b90d", "value": "49152:X7x9bpL0XqXYZuDNgRonqVHu4Dj62WffJXbpzh65SGULb:LzbpL0ITDBnLKjvW1tA58b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710856810, "uuid": "e1695932-614b-46ed-af6a-cc36ab6f8f0e", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710856810, "uuid": "ad157946-532b-405f-a3f4-7c51a71e17bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856810, "uuid": "ee2a3d70-b005-4c70-82c3-e6c3018c9f79", "value": "23de3722fb8e20f66cc9259cbb20cd47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83178a26-e5c7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710835555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835555, "uuid": "2bcfa38c-13bf-4a4a-998b-47f4db234d34", "comment": "Malware payload (AgentTesla)", "value": "8bff9db73f282a3111396980f47f299f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835555, "uuid": "06fce0c4-c43c-414a-abe4-a0e2fa9f3cb6", "comment": "Malware payload (AgentTesla)", "value": "3eea942e74619bb0b7d8a07df37e53886685018278672a6f7db07db54fa2d172", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835555, "uuid": "b2675300-27c5-4623-8e81-d35858a887fc", "comment": "Malware payload (AgentTesla)", "value": "2e9270b03f6aede4608511c3b8a5eca93ece52a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835555, "uuid": "e837ce3d-c3e5-4c4a-8b0f-c24dcd883d11", "comment": "Malware payload (AgentTesla)", "value": "8e8c233e777cac3af2e4ec88da53b732c4919b436ecf0660972dd81f358167378a94037e1804743c8bdf9be7c279630d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835555, "uuid": "b716d603-3e99-48c0-a970-0ad3b7168e9a", "value": "T163D423D877ACD663C5991EB592E3C2938F38A3877C54E327B09BB08E39C5350D1A941B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835555, "uuid": "9e3e29c7-c1c5-4437-936e-3fb6b4f66d8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835555, "uuid": "8576711d-a35a-444e-8e21-305fe7e4c316", "value": "12288:vgRhYubASzUdTxixVwejpL92uw6jdHnR7Zhucb/Hpp4a2kR:Y3y8VRjt92uwszZh1bhKat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835555, "uuid": "6b44ac72-9ce5-4fe4-a194-6237fb086705", "value": 648712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835555, "uuid": "d0139635-45e3-4029-b088-410a01c97969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835555, "uuid": "f3752e8a-5ed4-4c66-bdee-d25b84bb446a", "value": "Shipping Doc.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7383b250-e60e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866023, "uuid": "306e944c-4717-483d-b9d7-99d28a5eac54", "comment": "Malware payload (Mirai)", "value": "9a107cb8e14188138604b7cffbe2437e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866023, "uuid": "8ec53a28-3f60-456a-8d53-c82a0131a473", "comment": "Malware payload (Mirai)", "value": "3f9131cb13339481b617a80ba9c31f05504f22bc0ea726ca8562d01234e40313", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866023, "uuid": "e95ec835-f4af-4108-b0b9-ff41e617a5f9", "comment": "Malware payload (Mirai)", "value": "be0777976aeb471070d6b672b7bddffa96d79564", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866023, "uuid": "6b3e4f29-b704-4f78-9492-c2f4644ab0a6", "comment": "Malware payload (Mirai)", "value": "67fe541b88e7796980f251d0b58deb08e22f0744dd37c694efaee180995c04dfb06a974d4610657ca494369af97290bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866023, "uuid": "2c04ee3c-4b51-45a6-806d-bf0ee9c8ae78", "value": "T13562BF30708B9C70C2A10972AD2CC58252EA4BFCD4EAB9B316D4943997C76D233F9655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866023, "uuid": "d55c329d-1562-47ee-95f7-f9ea5df07332", "value": "384:3AZ+B3rnqffpzlxw3TGymfEjwpg0GhymdGUop5hXG:3AZi3rq3pzA3qypOIs3UozJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866023, "uuid": "6fbd9a06-3a55-4253-8be5-8da96d61912e", "value": 15836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866023, "uuid": "d59f04ab-27a8-4752-b4b8-59e820ac12c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866023, "uuid": "b71b3b8b-6c1c-4c66-9c13-1a4b72894901", "value": "9a107cb8e14188138604b7cffbe2437e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5604346d-e649-11ee-a120-42010a9c002e", "comment": "Malware payload (Adwind)", "timestamp": 1710891314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891314, "uuid": "b2bbe08b-35cc-4411-be7d-ba10f3cf5759", "comment": "Malware payload (Adwind)", "value": "b045ca0f5a3654f97af8876b34908ccd", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891314, "uuid": "de910b1e-990c-4590-a77b-970a56d9979d", "comment": "Malware payload (Adwind)", "value": "433abd80395cbde4705a59190218b98b229a91ecaace5af49f1c416394f13945", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891314, "uuid": "c6b3cf5a-9701-46aa-a61e-fd660c5b4051", "comment": "Malware payload (Adwind)", "value": "69c389f1b84c3f367988daa9f46a15d0b2094562", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891314, "uuid": "6cec524f-bebe-47da-a15c-16390187243c", "comment": "Malware payload (Adwind)", "value": "db312a9be475e3711529bacb8ab4f6b64b7e7a264e7d6fa437db8595f2c04ad8672cd1602f5d0349309467996ec6d616", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891314, "uuid": "7c7d394e-7c81-4e99-8cf1-a856ce2eee82", "value": "T17615334CA8975CBAC47D3969A588BE27BF5042949990730C280D4C3FB55FDAB38CC7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891314, "uuid": "80561e7c-093f-4e12-8e3a-76e2e208d95d", "value": "24576:T4PW0DRD1ip9MJ4J3Kg13aC8v0R/F5erCYYJNerQvC4:T4PVl0LEw6yx881FIrLYXerGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710891314, "uuid": "8f1ff3e2-5c27-4554-9182-9dde02a61b9e", "value": 928309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710891314, "uuid": "2f5084ea-a28c-4606-813c-320d318020ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891314, "uuid": "c43033fe-34ff-41c3-8316-82437387b1a6", "value": "Purchase Orders-Reg.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8268b94f-e60e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866048, "uuid": "ea9364c4-84f4-4f81-8c47-f36c0de24060", "comment": "Malware payload (Mirai)", "value": "dbd0faf38baa6c3a91dc82ad339898cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866048, "uuid": "7dc9486b-b3a7-42d2-bdc0-2eb3761f113c", "comment": "Malware payload (Mirai)", "value": "43921038a45458331f4f96c0a6577806c3b38a81c98de2784c3712cb3dacc7ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866048, "uuid": "b30564c7-2561-4629-85cb-97d0b9c66582", "comment": "Malware payload (Mirai)", "value": "8c49d4ff8862db88d9aa11bf2b3d1e4142e6d6b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866048, "uuid": "3dffc636-acae-42ec-a5e5-75a1c04db8a5", "comment": "Malware payload (Mirai)", "value": "fbbadb6bb63a08df8c1e262b65a1232ae3f3e77f2459998320410233b5a0e44f89031188ab866bc47ac156e02fd35baa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866048, "uuid": "53155216-dfd3-4ed6-90f7-54327d63a4cb", "value": "T15082DF899BE564C5D18982336ABD74EB483AB18844CF47CCB7C00E92CBDB0A87CE5995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866048, "uuid": "260ea11d-b9f0-4453-b048-b8d19aeba789", "value": "384:M4KVxU4MeN9aTc6nCxX2Ab+ENxVfjr92vMx9v1R9:IVmCmcmCTXt9H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866048, "uuid": "10878200-735c-4e30-b2de-2afe53d11c1a", "value": 18892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866048, "uuid": "411fcb3f-d20f-4c40-be6f-d77f5c338f20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866048, "uuid": "af6ac7ef-6f4f-4fba-96ff-33a3f26e9747", "value": "dbd0faf38baa6c3a91dc82ad339898cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ed4c2a-e5f8-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710856625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856625, "uuid": "0a1fe474-4f2a-477d-9389-13bfbf1fb94c", "comment": "Malware payload (GuLoader)", "value": "897aa89228a8b3cf96cbb26dbf19e32b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856625, "uuid": "9bba1dfd-7e8e-4ebc-acaf-018f16aeecaf", "comment": "Malware payload (GuLoader)", "value": "45ea9049272ff4044fc415f6aff8b903902d01ad4f87fbb1d6569ed237c623e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856625, "uuid": "c3e942b8-48b4-4079-9f6c-26cde37f79dc", "comment": "Malware payload (GuLoader)", "value": "fb299a9621d76f5e0efbfdf9166f363a723e8bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856625, "uuid": "d34d0e52-238d-410c-8dfa-d1b42a3dce0a", "comment": "Malware payload (GuLoader)", "value": "4a295b9bbaa2cd3aa78dbd9bf7c3a0369eeab2824039be145fbceb635f07deffd6f5f6ddf107503c0eab6f2249b390bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856625, "uuid": "e02839a9-6dd2-4d8a-b7d0-6e7ae868413d", "value": "T1452523903580CFAACD7A3D7331E0AD396B72AE728D261A435BC677EF7F321848A54115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856625, "uuid": "46c16ecc-85d5-4a69-86d7-e8decefd60f2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856625, "uuid": "21e61c66-275c-4909-9404-147edbf4b26c", "value": "24576:BGofsZHgBv8CMHTEOQBmW6EN1pZVQ5uzUp3z6FO2+Tr:2dgsHTwmWt3pZ6QUpiOPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710856625, "uuid": "c3eca5da-092b-49cd-b74b-e27f4874699e", "value": 1057390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710856625, "uuid": "db413ce3-9d03-4c06-974b-cebd06e9db84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856625, "uuid": "17d8b69e-be47-4a67-8d26-82d66e587234", "value": "2301_20230101_REGIA_BUILDING_KFT__443512415141300_NYUGTA#U00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689ce5c1-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710834652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834652, "uuid": "2c60c4dd-9151-44c6-8221-4353a72aaf30", "comment": "Malware payload (Gafgyt)", "value": "6f6c5064c482989505ac92818fa11714", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834652, "uuid": "36980636-93e1-4d34-a75b-291d851de0db", "comment": "Malware payload (Gafgyt)", "value": "4777289b41736111b0dc9ec273422e7da8ef385c4976b980bebaef33ac01b8af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834652, "uuid": "887dcd66-b6bb-42e0-8f6d-e3a159f51d19", "comment": "Malware payload (Gafgyt)", "value": "7f2f9abd54620541bb74d1f888cfeecc2f587df8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834652, "uuid": "22319b2d-1857-43b4-8ff7-0a46ffd504eb", "comment": "Malware payload (Gafgyt)", "value": "c0d1d3a31fce54ac33cb635d4f05d7f8aa89087766b8427fd9c6eadccfe5a84d84ca5296f7a479553d255308d0827264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834652, "uuid": "62cf4f35-091e-4057-b8c2-5d8ff092d4c1", "value": "T14F244C24E5404B57C2E323F9AA8E428E3B3347E563D773154A389BB03FC2B9A1D75925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834652, "uuid": "4bb370de-460f-4605-9491-e3fd40bb54d3", "value": "6144:FZzyacCwXJ4DbpW0vI5hbL6K2axVOcgym0wfB5RyAn:FZzyacCwXJ4gP5hbMylgym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834652, "uuid": "2a7f5476-c07a-435b-8439-8f944cba54b4", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834652, "uuid": "d007934b-108b-460c-9959-a238d60e58d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834652, "uuid": "ea9ff739-8e4b-4b75-b9be-a9cd0b07d622", "value": "6f6c5064c482989505ac92818fa11714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d1bbdb-e5e0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710846223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710846223, "uuid": "8576a459-492c-4fc7-93ae-5008c287eb6d", "comment": "Malware payload", "value": "cac04f1bf364c848616d0a88bae3514a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710846223, "uuid": "59c79871-8085-4043-aac3-62847c23e5eb", "comment": "Malware payload", "value": "47ca5a29f8d7afade313c3185a1b3787726b64c8240e47eeee7bc97a0315b24e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710846223, "uuid": "74f8626d-21a1-4c67-b9a8-5b492495bf87", "comment": "Malware payload", "value": "b9eb31d71de8cf74a9df8f527f1a155ab9a4d659", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710846223, "uuid": "ae511fd9-3a60-4d25-b0f6-e3bf3e065380", "comment": "Malware payload", "value": "97c2784da96f353b46f47564a0abbc6bdd8a7dec9f76e8989533787303639b5f586d0c6fa9372d6b62862d98e2b7e7b7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710846223, "uuid": "d3a3f6ce-6b7a-4564-9c18-4e76ce06e37a", "value": "T118712AF5489968F1C1AB85C7C8A47D2983A7B77AEFDF60C005A6F6D11807211952EA84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710846223, "uuid": "55e7a161-8be2-4294-9592-cbcee5dc9c0e", "value": "96:2P18POUGqQuGg0FDcbtwXYXaGZzwOTSaXS:q18OqbGgz5wXYKOST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710846223, "uuid": "66325ffd-a593-4d43-875a-f8385cdd6034", "value": 3736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710846223, "uuid": "4fc01e21-5db7-4606-9450-edc1eb9f8ea3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710846223, "uuid": "b00ab684-cc2d-42c1-b4a0-4da46e11038a", "value": "New Order 3118.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffdf556-e60b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710864648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864648, "uuid": "c61c5d8b-1f7a-4961-b5ec-94a0eb09781e", "comment": "Malware payload", "value": "452c2f7d33a030d604ba9e563807f933", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864648, "uuid": "70e99b86-d4bc-45fb-9c76-4bd25bc3797d", "comment": "Malware payload", "value": "47d0a526c184447c029b57a6d110eac7f5a2ca1372e73060616a5e873ff8c42b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864648, "uuid": "ef812b1c-7c03-4f43-aae5-36d961f8d140", "comment": "Malware payload", "value": "9296e078acb11d71772e5828329ff05c3aed43e5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864648, "uuid": "1d0fdf0d-9b48-4777-8af6-545ce67954ca", "comment": "Malware payload", "value": "1385b7b229cb97213f54d7a04f5e5c3c4221ddc8f15ae1cba979ff81ade91a2adb3da91baf59c65aa86762309a651ef5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864648, "uuid": "8039d643-4cf5-4dca-a750-793e721755e6", "value": "T1E70633E24CFFC5CD0A362AE2A480296676DC63D80257930F56B790C72F37842D79DE65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864648, "uuid": "a61b0770-d135-432e-8671-76d8b5330d70", "value": "98304:J9qCGxuaEBRPOx0gLXxqgkVOjernFGDsgYWGAvR:Y07Pe0Uqgn2z53e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710864648, "uuid": "9e3e28de-9b84-46cb-ad0c-adbd380d33d8", "value": 3684548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710864648, "uuid": "89c6a5f1-a2e3-4123-bb44-ab60a1271271", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864648, "uuid": "88c8517a-9ce7-49bb-b755-275928abb73d", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec55a045-e615-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710869232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869232, "uuid": "aa9f5873-0736-4600-82b9-9a38434e355f", "comment": "Malware payload", "value": "59589e3fee80ba6013ae8d736651618a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869232, "uuid": "84322550-0c1d-4fe7-87bc-e5673d8f7a30", "comment": "Malware payload", "value": "48dfadb9f24f2d696c761c0f06682e34ac4459dfb632609fedf9aaba0b383788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869232, "uuid": "64eb44d9-ae2b-4fc0-b017-6e7513cf9556", "comment": "Malware payload", "value": "b6e16ff09423a9dfc885fe0c7ad6973c16a4affe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869232, "uuid": "d2d2d41e-5807-4063-a277-9143e892d373", "comment": "Malware payload", "value": "2448ce3b583bba6ce8e85efd2d1688af30a2269ffef9150e44abffc3da250f4f17cbc9afca8eae2c926302b611770da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869232, "uuid": "c35c9d1b-9027-43cc-baf8-b88acedb1748", "value": "T18C53D028ABFC8377D27F2BB101B225151737FD9A88E6EB5E20D608992A317448952F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869232, "uuid": "4481b424-6d55-4b83-ab89-c25e88804727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869232, "uuid": "9c6ebff7-08e5-4eb3-8d05-42c691bbb22c", "value": "1536:93tIYG0mB/EXUj8mm1fhMrjEakcD066cqCeGWPUs:92Ydw1R2GA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710869232, "uuid": "622969c2-ec37-4bb4-ba5d-012298e978f0", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710869232, "uuid": "99030f53-bbf2-4728-92e9-30abc79ce377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869232, "uuid": "4bbeeba8-598b-4577-a31e-1b3ee45197eb", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1362951.19038.28707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbdea0c-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837101, "uuid": "44606637-31ca-45cf-a524-86d8867a8342", "comment": "Malware payload (AgentTesla)", "value": "dffa098f23c6d2ec479dd88116015ba7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837101, "uuid": "0fef2687-1cc3-4704-b202-2936b197c218", "comment": "Malware payload (AgentTesla)", "value": "49fbaac29e350f9ec56bef2f2618f5ee4b6900562e64586e1d41ce8aaf319c00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837101, "uuid": "d82de9de-aa1f-438e-b54b-76c7d1213be9", "comment": "Malware payload (AgentTesla)", "value": "573f7878c96b76b8beeb833cf0b7bf4aa8ed83d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837101, "uuid": "4c4761d6-36ec-47d2-8a5b-67bd58dfb487", "comment": "Malware payload (AgentTesla)", "value": "b563ec9ce702d3e58f5d94ca00ad3d6b595ae18091da5e410fd5768c90c8898f24037878f4174c5dc43d5732c4bd8844", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837101, "uuid": "c27070f3-721f-442c-9e72-561b501e9f32", "value": "T13AF3F7E3CAC52A588A461AB7DC134B734EB4419E37231F349BBCC69D604795886BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837101, "uuid": "d3f9d1da-d28b-47f2-aa51-c36b1588bc3b", "value": "3072:s84yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRV2OIrkb4/KmcgyK5leZygB:s84yENVOY0NpVXpK68kH3DPbkhZi3eNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837101, "uuid": "2117d74d-0d7b-4f97-848d-ba8054ed3fe4", "value": 169819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837101, "uuid": "f615e4a6-52cb-4b00-800e-28820cec597b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837101, "uuid": "7634cf3d-f806-4424-a99e-a6c0e2f5549c", "value": "CDE_967320550118032400.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e225e0-e5d9-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1710843074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843074, "uuid": "c3da8ff6-af6e-4cc4-aff3-3ae53c5100d8", "comment": "Malware payload (XWorm)", "value": "5f98b113432846548068bfde934cc2f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843074, "uuid": "85462bbd-396f-4738-a678-4a37d4ef9200", "comment": "Malware payload (XWorm)", "value": "4a79ea105c344a1916a423bd62d7d591e3ca4dec7df2dca8f1fd7d27bc905fd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843074, "uuid": "d4ca90a2-19e9-4fae-bc43-95f2972b0946", "comment": "Malware payload (XWorm)", "value": "9e6c4df73c0fef5889cfd695028f55d05a5a9dd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843074, "uuid": "96b93710-be74-485e-a804-b9ae5e69d8a2", "comment": "Malware payload (XWorm)", "value": "8ac7cfb9275b9541aecf6bb4d23c8a4bad762df468e008fe5816fa1fe82275f473360655f08bfa1d6ac950742a158139", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843074, "uuid": "a0544802-3df0-4b20-873e-8f5cea124d8a", "value": "T1701309C927D45221D6BE6AF15CA386A9C2F0D73B1A27D74E5CC825D72B9BAC00441DF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843074, "uuid": "6e6b41f1-e657-4d97-be66-be2149f3a8aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843074, "uuid": "9a7e7437-7af9-49a9-b5fc-ac8394a9ae6c", "value": "768:3TLF84z51Q5P7gLTkbbtRNFqjvQBb5Nc1:3T6gPcbt/CYvS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710843074, "uuid": "d784ff41-17fb-4397-8355-ee7da68baf51", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710843074, "uuid": "94218641-17f0-4212-8228-6f3c8f2c183b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843074, "uuid": "f2237635-bc2a-4c60-b1d5-14b0cff471e9", "value": "5f98b113432846548068bfde934cc2f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf67e24-e5db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710844239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710844239, "uuid": "27dc97ce-97c9-444e-a253-a7e1ea208bce", "comment": "Malware payload", "value": "fdb249e9f54dc03c7ac1a4513d6ee233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710844239, "uuid": "59be32a0-962e-44bb-810f-120900b0e6ee", "comment": "Malware payload", "value": "4be5926e05095a40f520ee2b7cf9c1eb8c608570869a3ffbc01feddcf9e6a1d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710844239, "uuid": "4a419ca1-440f-4fb6-8a0b-6931d9a75f5d", "comment": "Malware payload", "value": "f6579422ef9da63a652ec8a7a029e152aa000915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710844239, "uuid": "269a6189-d38c-4157-8c8b-90cb469d2c10", "comment": "Malware payload", "value": "356e361a0d5f21516f0ed8b714ed49934a29bf3fd5d0892f087e361281241b5750cab9c27911c65de72727debc727cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710844239, "uuid": "80c4a353-4d91-4d4b-8992-7a9a36d3828b", "value": "T133034B096BBD427BEB4D8F7D74E245220AB3E752BA77F74A8C4C99591A033810B4136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710844239, "uuid": "d14f03b7-1315-4f87-acd4-8f91a27d63c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710844239, "uuid": "a354bab3-b4b9-4c87-9a0a-108c5ae2dfca", "value": "768:M4aqgcRPCOZuQISosPyehgl4TdTLs1PBbAcLr2BXxjV1VaXLkjO:KaIP4TdTLs1PBbAc/+BjP0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710844239, "uuid": "faca3ee0-6c03-4892-9357-74711a49e33c", "value": 41360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710844239, "uuid": "9fc9634f-32d3-4fdc-a898-438cfeaf0a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710844239, "uuid": "82ef3a9d-4852-4e9e-bc58-c5e3a0c6223d", "value": "SecuriteInfo.com.Trojan.MSIL.Agent.13157.13509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee016d9-e5b3-11ee-a120-42010a9c002e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1710827012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710827012, "uuid": "13221fb5-343d-4275-9b72-bc292e68c850", "comment": "Malware payload (CobaltStrike)", "value": "bc67a3d548db497abf18c6aca4ce03d9", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710827012, "uuid": "b6a62ea4-f459-4b17-bbce-ca23c77ed063", "comment": "Malware payload (CobaltStrike)", "value": "4ce210ed888ef0799aade75a3764c2c4186efc4923be5e9860ccdb3d346a4114", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710827012, "uuid": "4052f242-255f-44bd-98c4-748d44970fe9", "comment": "Malware payload (CobaltStrike)", "value": "8ac17755f15a423082200acb8961f5ce9454e90f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710827012, "uuid": "6e6e7224-d97d-4ed0-b9fd-310ae764b7f9", "comment": "Malware payload (CobaltStrike)", "value": "65c020c732f627401ebb38cc9771828f80bad38ed1f2679c9627d36502d0feb05e2caaaf09b68a23c3d9de538089d735", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710827012, "uuid": "d8ac9753-5596-4f97-8030-066dc3f14245", "value": "T1B8646BC3FF819DD5C91A4B3199BB03681320FEB66AA5546B2A1D73281FB30E19D1F907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710827012, "uuid": "fe5ac4fb-43d8-4bae-b1db-fd6e3f9bdfb6", "value": "c69215b9884f09dcbd592b687e0a6525", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710827012, "uuid": "137b0a09-be6e-4db2-85e0-c40f002010b8", "value": "3072:1zg7+az9h5ajKOOq5ffffxffgREeffffs9ffZ8fff1iefffffzAYay6RPTudffZb:+7+az9SvVtYaRm8tpP0mnZDNP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710827012, "uuid": "a568590b-06bc-41fb-a09a-818a9dfe4ba3", "value": 330344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710827012, "uuid": "255a6477-4e8c-4c44-b806-c437d77f005d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710827012, "uuid": "dfdc2e5b-0105-4c5a-9289-d6a5e7c07175", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6b6a2b-e5f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710855009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855009, "uuid": "09125e8d-72da-485e-8da0-08153b51895c", "comment": "Malware payload (AgentTesla)", "value": "3340ea2cd69633036775283008ac2e53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855009, "uuid": "00f15720-da2e-4a0d-889c-e79bcb1cb78a", "comment": "Malware payload (AgentTesla)", "value": "4df8ed5e7b1c5dfe367b89b30645ea500581291013faaf500a4de47c329ab8fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855009, "uuid": "b0bf7244-101a-4eba-9e50-fee33b1a165c", "comment": "Malware payload (AgentTesla)", "value": "0f9774ce040bc1b4165384641b4a2c6e9cb66fe8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855009, "uuid": "c9f34ff8-4bc3-461a-8576-e72e76e9653f", "comment": "Malware payload (AgentTesla)", "value": "0c9d4a38c1b5ea7619a8ce5b037e2af83cf068d9f8b8931bef5d109dff861b06e01299ee374c96e589fdfdd74a8a2184", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855009, "uuid": "50d8aa5a-a803-4106-9931-95d3116091d0", "value": "T19B25AD0273D1C036FFABA2739B6AF60556BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855009, "uuid": "40565c02-8a75-4ce3-821f-ca50f6935209", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855009, "uuid": "e4001eaa-d8ee-4bad-8646-8a863674df12", "value": "24576:mAHnh+eWsN3skA4RV1Hom2KXMmHafjqdo0RRcY5:Bh+ZkldoPK8Yafjqmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710855009, "uuid": "e534ed77-7cd6-47fe-ad19-cd9de689d693", "value": 1043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710855009, "uuid": "2dadd04c-ba54-45c8-8afd-5c2a6f209e60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855009, "uuid": "01bf5a94-0073-4b12-836b-cdad929871da", "value": "z48Ordendecompra0001-00255454_.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0735427f-e619-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710870566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870566, "uuid": "7a612aa0-0b87-4f4f-b870-843b505eb68f", "comment": "Malware payload (njrat)", "value": "4ae6913ada39467d865105b00161ee7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870566, "uuid": "5888b2a9-a4ed-4335-9713-e097f78602b8", "comment": "Malware payload (njrat)", "value": "4f359069c151d1dd983fb3a1c0bc68d95f29d32277026d5e229b2ca3e7d554b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870566, "uuid": "9bc5a3db-c4b5-4cd6-b1d4-228adda6d42e", "comment": "Malware payload (njrat)", "value": "d9fffc5013ed2f9ebd701ae9772b406d46127595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870566, "uuid": "c099772c-095f-4555-a1a1-c8472a3b3ac9", "comment": "Malware payload (njrat)", "value": "3f172e4c273fb39c7b4d3d17f8015c44b4a8bd5c5a9e257252ffa26e9d1474beaca11f08fbb90fe4f8c40483959dd9c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870566, "uuid": "142571a1-2e85-421e-9d14-1ea09678f024", "value": "T1E4E2090A77E58215D6BC1AF88DB313210772E3478432EB6F5CDC88CA4B676D44245EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870566, "uuid": "d48a7ea9-d038-48a3-b946-9f6719e76786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870566, "uuid": "d8b1f712-1d83-4574-ad3f-ee5a28a2e6fc", "value": "384:F0bUe5XB4e0XGOlluggUBZIGCWTitTUFQqzFmObbQ:GT9BuVl4ggUBZITYbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710870566, "uuid": "c008c42f-cf14-47bd-8855-2df48245ec19", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710870566, "uuid": "643e2365-ea2e-4e3f-a3cd-53eba119fe25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870566, "uuid": "a458ce52-44a1-493f-8a08-c8347cb43d50", "value": "xd2fvfOPEIEJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad242d4-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710836749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836749, "uuid": "45c49ff4-2d8c-4a32-9e72-5498f9cd595c", "comment": "Malware payload (RemcosRAT)", "value": "f8d7fbac2a957c3cf4054b690551510f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836749, "uuid": "d4d61127-2882-49c8-b891-b7ec5b30ab95", "comment": "Malware payload (RemcosRAT)", "value": "4fca30510ffdf9d9ba2d4bc4475154c11eb9ca9c07e5c2b694d9fec4ff0c34d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836749, "uuid": "e32dc0d4-7372-4cd5-beeb-e17b4387da6f", "comment": "Malware payload (RemcosRAT)", "value": "24fbe3054e2435dad82bc67e2de62eb4d4e35391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836749, "uuid": "fd30d073-6f98-432a-b876-425920e31fd1", "comment": "Malware payload (RemcosRAT)", "value": "f36d5e50a283fdff5b4b26daf0b559184204d34be208ee98997e58619b1157638fb857924f4f38ccb5c50d3764fa662a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836749, "uuid": "b97496cb-1135-4cd0-afb3-8c2f67eb5278", "value": "T11015231972BCD723C6A827F7B67081140FB115DB60A2D6886DC9D0DE4E62F44C9E2B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836749, "uuid": "5f43636e-05f9-4b38-8752-c028d05fc71e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836749, "uuid": "173d2f7f-d4e0-44ed-8779-4d19aad920a3", "value": "24576:grx/bOXgok4spu8FSgENCd2nciErAChovOad:grx6QF7bFSL5tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836749, "uuid": "fce1c5a8-4051-4c3b-86ab-29caaf42c4dd", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836749, "uuid": "61d41ac7-ecc3-4a01-a4c6-970d15ab7f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836749, "uuid": "d3cfef13-ad35-437c-a40a-48cb4c676f2b", "value": "REF#22790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b1c89f-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710835029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835029, "uuid": "e41a6e70-8288-4a6f-ac54-a81c0d631bec", "comment": "Malware payload (Gafgyt)", "value": "7bab71e74448abade1f34d71fd22f454", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835029, "uuid": "c95fd82c-2adc-4d41-be66-9517a37d95be", "comment": "Malware payload (Gafgyt)", "value": "4ff75d7239d8164182a0feb8f9855832fea224d48caad242b59524cafca2c24d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835029, "uuid": "d8b53391-a1ea-4c6f-9aa2-c964344417d1", "comment": "Malware payload (Gafgyt)", "value": "bdb2175d5bc66c226c4108e7c93e69ad9e98ea49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835029, "uuid": "f09355cc-2385-422a-be1b-782850e41a21", "comment": "Malware payload (Gafgyt)", "value": "9cc68de179581c7e6855f319133b27c22eacf8e291908e211f42950d3d212ec4e9bd4133c8db78d3f3879cbb8ba6ee0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835029, "uuid": "c4062e2d-c2bf-41d4-953d-7375772aaeea", "value": "T1A104E53B67260B23C0E5407011E76633BDB5C7CA30B862D76BE06D9C6F2A9D43592BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835029, "uuid": "ef752090-a293-455a-b72a-36c31db3fbbd", "value": "3072:rztMPFGnxxxlqjNM7CQMfKogDphapfzPtJPMPvZy1lfpDm4wABHo9n:rznxwmmtBgDpha5z1JIvZyFDm4wABHoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835029, "uuid": "3f8991dc-3ea9-4215-8c4e-c1e7c1fe7088", "value": 186316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835029, "uuid": "7efe2b8f-54c0-4fff-b65c-b8e769605a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835029, "uuid": "fa8ef4bb-b0e7-4aef-b307-bc48c2c30463", "value": "7bab71e74448abade1f34d71fd22f454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5e7909-e5a3-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1710820221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820221, "uuid": "1f6e5446-a0fd-406d-acbe-2e6f0ff250dd", "comment": "Malware payload (QuasarRAT)", "value": "7b9d9f41d274ddd8fac0544e188ade4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820221, "uuid": "ea59bcde-094c-4caa-bac7-aa1c0f166752", "comment": "Malware payload (QuasarRAT)", "value": "50684cb3400e3cd4959c2ccd2dd900a157ef3163179adcf8da15ed5b7b41694b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820221, "uuid": "83b0204c-b20f-4712-9840-a0f458d730a7", "comment": "Malware payload (QuasarRAT)", "value": "20050de536fbf27cdbfbdd0671af913e04106363", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820221, "uuid": "86e4dfc6-f219-4dd5-a88b-78317a723b7f", "comment": "Malware payload (QuasarRAT)", "value": "625d82de2119757a584a9cc8a8f3595ad95b3366ec7d5def42159c5b4ff3ab65f550869809bade316a977ed92d4a62a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820221, "uuid": "e1f61cb6-7969-4511-999a-ac8d9c55ce28", "value": "T170E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820221, "uuid": "2691b51c-ac8f-4028-9b58-5ee1d365765d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820221, "uuid": "fcaf98be-dfd1-4d0f-bfb0-2ba1dc61b2cf", "value": "49152:zv2I22SsaNYfdPBldt698dBcjHXaRJ6qbR3LoGd1THHB72eh2NT:zvb22SsaNYfdPBldt6+dBcjHXaRJ6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710820221, "uuid": "7a05e14b-30d1-4335-8b05-a8266d70f672", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710820221, "uuid": "229b211c-26bd-424c-85fd-9a9191c80cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820221, "uuid": "64bf7dbe-664b-47ee-9c98-48853be8ec1d", "value": "7b9d9f41d274ddd8fac0544e188ade4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52a24a5-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710854510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854510, "uuid": "7dea3463-aec9-46b6-8f0f-514a5160b5f6", "comment": "Malware payload (PureLogStealer)", "value": "68d3227e977490c4a3807927367146c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854510, "uuid": "dcf4420e-5b25-4847-a460-7e13cb021aa9", "comment": "Malware payload (PureLogStealer)", "value": "51cf93c6450ef2983c672efa72dcaebef2838bc1d0470ef5c61ecc7dd37044c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854510, "uuid": "2bd889f0-a588-45b0-90e9-73c138902c4f", "comment": "Malware payload (PureLogStealer)", "value": "165f8ab3c77979d5a88cda63aab139c56849739e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854510, "uuid": "e041475d-6f73-4533-83ed-c1951c0ce44c", "comment": "Malware payload (PureLogStealer)", "value": "d364e42c7831323b943716f728804df3ab37484b129b633b378f2e4760ca5bcd8c4da1f72c018dbf5d7376e734b675b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854510, "uuid": "73865873-ae14-4c63-a539-b47aa740b23f", "value": "T14FC523F0667BC96AD7CD0BB860295A01A37C46D9C792F30C685D68FA9C16383C1169FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854510, "uuid": "c39df0c8-ea92-4708-a84a-bcc592466058", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854510, "uuid": "2a70c854-aadc-4620-8085-48c76c94d7d5", "value": "49152:JqVc3/gt+vRNOwmAJL8pliYeT++iW8c6VS3umM+4gfehsV/:Jq6vgs+cL8LP+ziW8c1Mjgmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854510, "uuid": "e799fb4e-c615-4d30-af78-9ad9fd41b2d7", "value": 2569728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854510, "uuid": "cafa597d-803b-474b-8e2f-752f8e841332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854510, "uuid": "912b769c-44b4-4be7-92e7-9472b8cc7fcf", "value": "68d3227e977490c4a3807927367146c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4de7d8-e5fd-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1710858817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710858817, "uuid": "4c2d3d5c-90ce-4515-a367-489fa96ddf21", "comment": "Malware payload (DBatLoader)", "value": "ab9749be3d34952bb6d922c64bd66c9a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710858817, "uuid": "02125162-29ae-4f0d-b14c-1cd4359bed99", "comment": "Malware payload (DBatLoader)", "value": "5274fbd389322cb0eab66423c80b3a41c582180f69f41eeff1bd5dc4108ff67a", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710858817, "uuid": "a93d3e11-8793-4505-9f68-2d79c1929346", "comment": "Malware payload (DBatLoader)", "value": "b24811275f8487d153be38a7842d28849542c36c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710858817, "uuid": "d057bf4f-4e84-485b-978b-e9f467e34328", "comment": "Malware payload (DBatLoader)", "value": "a9559dd706d0be9fb8ce98a04258ffb990491f045a4edd7ad0ef17674ef40a4a7c4b3f5daeba584f3cace87be1bcda2d", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710858817, "uuid": "38ccaffe-5f41-42d4-9d2c-2f885253f365", "value": "T11755AE36AA000131D4251E30CE2687E9941CBDA17F1498EF2FF47EAC6A39F97FC52566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710858817, "uuid": "b7925f47-6170-4daa-8ace-87b8c52438b6", "value": "e67c859a7da4b267a97b9cf609e1ba03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710858817, "uuid": "56648c00-2352-4f8e-9a2b-27ca1814f1ce", "value": "24576:EJWUid5kZHYX+fEHxniHBvag2ZCMVAgfM:EJ05aYt4dcsMVAgfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710858817, "uuid": "5b90dd7f-4f81-4b37-bddd-6ece8d5f8036", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710858817, "uuid": "5c2efc2f-1a5e-4998-95a1-07c9e7edb0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710858817, "uuid": "c26a53da-b658-4c43-8445-9c140c2455d3", "value": "lewxa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d2a195-e5a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710819284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819284, "uuid": "a2e67dcf-05f0-427e-90a3-73c1afa2af68", "comment": "Malware payload", "value": "db9ec9d1a81135423db41512c3dfc24a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819284, "uuid": "3211566b-6712-4f14-8047-249337016c82", "comment": "Malware payload", "value": "52ab073e4cbde4421d6d041dd0c7656b14e9c8155250c14a220f8bc0cb6eff6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819284, "uuid": "f30575f6-8893-4e88-9899-1462a9988d26", "comment": "Malware payload", "value": "266979ad1aba976cd05100d66f2a0ba6faa4eeed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819284, "uuid": "85f71914-b2e0-440b-ab69-d1dcae146afc", "comment": "Malware payload", "value": "da30932c6868216d83b62b0ec1e221dd9916214d805f759237b8e04a6dc31216d8e5806ec2c23e2a3ef00c424f176ae9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819284, "uuid": "9854c5dc-06a0-44de-ace9-86673e5d5199", "value": "T1C3E63983F99151E8C5EDD130C6268223BB707C895B3463D72B60F6B82B77BD45A7A360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819284, "uuid": "1b3d0164-2f80-4bff-92fc-8d309e788eec", "value": "98304:eNYBGL3GOh/TFmj+nRIdf+OZn8OhTRWfjEHHPVKwAKK8UVga6u5i4O5W2s9FkSb8:eSm/TIjrruYHvVVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710819284, "uuid": "70a9d1c1-4e09-4d62-9638-a25eccbc8fa0", "value": 15106048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710819284, "uuid": "d78639ae-2643-4d5f-a7ba-22421a43f333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819284, "uuid": "0b509ddb-0743-4705-a51a-a91f4bb366d6", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24809.12136.12583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9afc28-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837051, "uuid": "5282ec53-7886-4eb4-9dec-dc6ca6f07ac4", "comment": "Malware payload (AgentTesla)", "value": "d7f2b71a34e9620e3ab0a36d60842e20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837051, "uuid": "fc7eee06-a398-4bd1-bad3-08b4dd469eb7", "comment": "Malware payload (AgentTesla)", "value": "5392d95f34fe031e8148580afad2f258396499b855c2c1c6d202c1b05afb7ab2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837051, "uuid": "8ec8abb7-dc9a-4a2d-ae7f-a046a6dedd6b", "comment": "Malware payload (AgentTesla)", "value": "a6ae48b711938d20582bbcda8c6d9404f02128e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837051, "uuid": "885c0719-c87e-429c-b01c-fa44c727d035", "comment": "Malware payload (AgentTesla)", "value": "f1e5eface4ee19ff014ffafd69a043cef10b892269166ab6c20dd15b0eb576beb5b736981e4259368c964499c11ae983", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837051, "uuid": "dc257f20-0e59-464a-964a-61122afb63df", "value": "T1AFE42327275CE1B3C27917BCA49316CA97F24F163253EB197EA2304D8C77B07A758286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837051, "uuid": "a4db1fe5-57e4-4eb4-8255-9a7d14bab3f2", "value": "12288:2bdo2DdqUd9TJRxWNgIWLUZnRORzAdaNKmg98ewc2VqV:2bdo2Dd9dnWNFuUZneKtmewc2V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837051, "uuid": "8037696b-33bb-461b-a618-3648fe3e7782", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837051, "uuid": "34e86fd9-7305-474d-b400-f34c06fa1b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837051, "uuid": "fec6a310-a363-458f-a332-f5ddf31a7407", "value": "Esit_TEKL\u0130F \u0130STE\u011e\u0130 e356542396543.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f181b8f-e5ba-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710829804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710829804, "uuid": "d358453c-7985-4ff1-88e4-8c49544d2d52", "comment": "Malware payload", "value": "9716040eaf59b41e1c47906d0341399a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710829804, "uuid": "5fb998e7-b388-40e6-835a-b02b4147fc4b", "comment": "Malware payload", "value": "53c19eef504e5567e8f1a7adec25bc4d9cabbd560fe46de9b0117a0086a00a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710829804, "uuid": "a6d3b0f8-ac40-4281-9968-bd2b5e890368", "comment": "Malware payload", "value": "9a2cc172c7ab0f8f240522ef13c4e61ed35a2021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710829804, "uuid": "4bdb9049-20fd-450d-87a3-7644da0b8dbd", "comment": "Malware payload", "value": "bbf42365cf8d9db52057d25dfefca8e7cbb26d082da30899b420d1ed0881f82f18c9f7f4f27f6f87b7a8aea0b9d68f9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710829804, "uuid": "6b6045d2-d060-4e4e-a3ce-4a770fcee20b", "value": "T19386337B46D5BC93EA7207F43C5564069EB8B5334F024A38F62F9B92C96851DDFB020A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710829804, "uuid": "119bd7f8-2c1a-404a-a217-99568823da3a", "value": "6446cca0763d424e7d8c06f614705b7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710829804, "uuid": "3ea5d289-e2ca-4093-8f77-fbe8210b0506", "value": "196608:XAAhIncXbZSUjjSujKZxr3XpINTCMrFr5VDv1NuthgMlYv:UcXbZ3hmZxr3XpINrRPu7ZYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710829804, "uuid": "c59b26c4-01ca-49ec-b10e-b7b98f104a1e", "value": 7950352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710829804, "uuid": "3a234988-05d5-401e-8bde-0bb67faeffc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710829804, "uuid": "0156afdf-02f8-49af-b360-277d71e875da", "value": "SecuriteInfo.com.Win64.MalwareX-gen.11041.23283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a0538c-e60f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866424, "uuid": "0bee8b26-b337-44ea-917c-ea69c6bd96b5", "comment": "Malware payload (Mirai)", "value": "6a90311ef4f7e29214a738f47668153e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866424, "uuid": "df55a3e6-4efd-4af8-affc-7332762f7f8d", "comment": "Malware payload (Mirai)", "value": "547d24468aa629803d5012bc1456e0ad82e977936fd403c0c6d59dc4967880bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866424, "uuid": "ecfe0364-4a51-4c08-932c-d4e5acb13cda", "comment": "Malware payload (Mirai)", "value": "12490f1243b2a97405426b09b1a06af4a8637fbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866424, "uuid": "8933ad66-0592-4f8a-9e29-a85d14f97153", "comment": "Malware payload (Mirai)", "value": "4dde1acdd2c1f4f370674a675174b2c2831583048a11b7decba0ec947c6d1a9cd5f9802675f8ad13884f4ed6ad574536", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866424, "uuid": "dedbe4bb-9833-46e0-acba-945a2cdc962f", "value": "T1BCF25CA5C8A95E89C7148178B214D9392B33901DB6DB6EF75607CB92D01BFDCF60A3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866424, "uuid": "c22a8410-d6d3-45ad-bd0d-58f2a8c56ba6", "value": "768:XsaqVTeBxbzMSWLS7L8CyaoBoyVCf6onr:Xsa4WlRWLSf8Z+yVCf6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866424, "uuid": "564e6cdc-aee1-43e7-a9d1-66f6924dda5d", "value": 34248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866424, "uuid": "948f02d8-d87a-4fe9-aa3a-ab655d60dd6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866424, "uuid": "fe992115-cbf3-446b-ae63-19899d51692a", "value": "6a90311ef4f7e29214a738f47668153e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfa7b28-e5be-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710831681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831681, "uuid": "da4b71ef-a1dc-40b8-bdbc-267fc1712bd8", "comment": "Malware payload (Formbook)", "value": "f16a453a7db95634f924bed9463d6b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831681, "uuid": "0572f9f8-06a4-4125-9a90-a760df9d3aa1", "comment": "Malware payload (Formbook)", "value": "54a4891d6753b4acaa07bb6c01aebcb44a0140ffc05ccdc53785a74365969585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831681, "uuid": "3923084e-2e92-4c75-9711-d2dac07db024", "comment": "Malware payload (Formbook)", "value": "b02be42a5d1d67c891cc30577a159f4fdd5fbf6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831681, "uuid": "9bc9f011-c6e5-48a5-9c4f-ba590100fb10", "comment": "Malware payload (Formbook)", "value": "db7dcc2077716b51a41a68ade2c8490a0a5681150e4a704373c2693f6c3745b116d10f4ef9ca8c730d061756c712cbc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831681, "uuid": "345d383a-484d-4df9-8bc8-1284e1fabc8b", "value": "T18A156DD1F15088DAED6B09F1BD2BA53024D3BE9D94A4410C56AEBB1776F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831681, "uuid": "55e237b7-2f06-4dd4-a3e6-0b032e20daa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831681, "uuid": "f16795f6-318c-4d8f-9b05-227335f1b49b", "value": "24576:XKCcwQs06lgDAd6LpSqaDuaWJfy9JOJb:XKqQsJwAdaY45yu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710831681, "uuid": "59fb3fbd-e50b-4b9a-bc45-ea726d0fb759", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710831681, "uuid": "374340d7-c9cb-41e3-b3f1-ed5f0254905d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831681, "uuid": "87c25fdc-588c-4fbf-bfc8-686b1059f212", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b125caca-e5a1-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710819311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819311, "uuid": "c489770d-a5f5-4960-8784-2d4ebbc52f64", "comment": "Malware payload (RiseProStealer)", "value": "702c48022fb8f4f15745fc3ae1482608", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819311, "uuid": "ceab34ac-0e0f-42c5-bb4c-f14d5f3bf50d", "comment": "Malware payload (RiseProStealer)", "value": "556dd03a027878d11a4bab58577785baa9ddeae1f18e0c23d0bdfbdcfbc71aee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819311, "uuid": "aa4e59aa-ce1a-4e94-80ce-6fd6c6ae7502", "comment": "Malware payload (RiseProStealer)", "value": "79846ea15b2e52d11d7caad74f3553e9c069a3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819311, "uuid": "573a25fa-b4ad-4d5b-9597-f6d5c99d72dd", "comment": "Malware payload (RiseProStealer)", "value": "3bd321f2630d8e63f470796f3468bfdbb2ae06b7b7f9bb59fc78ecd0f1e0504c5797ddbf972d74eff3e0e7609fe4bb11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819311, "uuid": "c56497e9-a233-41fb-b15b-8645aa296749", "value": "T1BA9533D39EA3D01AD57551F35EDD77822D2BA9F104C0CCE2329E2BD12A33C58B2B9958", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819311, "uuid": "39aac558-24b9-414f-9f8c-61e2eeb4d307", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819311, "uuid": "82b59bfe-7ccd-44da-88f0-037f1606f4cf", "value": "24576:dWqG7809+QZf3RtTdIoITUzWbhj6KXoAJz6RAYkROwN4F/kYbGYe5Tfye6hstCqK:E7x9bpL0dbNYAJGqLYelfy9hcCh4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710819311, "uuid": "33bd5fc1-ff1f-4d0a-b795-2cdf2c082206", "value": 2060800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710819311, "uuid": "8589030c-c64c-4869-9722-0433e531c15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819311, "uuid": "24fa2955-0fed-41be-96d4-5fb49ad173fe", "value": "702c48022fb8f4f15745fc3ae1482608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae388d2-e60e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866036, "uuid": "6164396f-c9f9-49a9-8d39-0b69f23a9d14", "comment": "Malware payload (Mirai)", "value": "9ec3f101e2f997c4a2c95693031dc1f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866036, "uuid": "af82db14-e636-471a-8cad-a8ed41423d29", "comment": "Malware payload (Mirai)", "value": "558b799959370d87fb6fc5ecbed9e648c2e036e2bfb6cd9c97300377b1c1df61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866036, "uuid": "ae343a35-dd6d-4af4-8f80-4310d5a2f156", "comment": "Malware payload (Mirai)", "value": "89dd456a104e9e36c0a5fdea6f9101f024bc2178", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866036, "uuid": "1fbade2e-3c37-4042-bb0b-84d85d9cb9fa", "comment": "Malware payload (Mirai)", "value": "b1771b2891ba6d162beb3fa664b7a2a95eaf1a6ebc30b9adf783ed1eaafa364b5154ae87abb822a5c8ccc336849bd915", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866036, "uuid": "62ca215a-e1db-41c6-917b-62f1ee071ac6", "value": "T18B0319C7B800ED7CF52FE7BA8523480DB9216352515317277BA3FDA79C321A84E26E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866036, "uuid": "7e71c665-7597-4d51-bdba-7327ad8939ca", "value": "768:R2PGQzRHw7XFjSj8yGu80guAK83PKkGi1LkHhb0JR1qVlY:scVhr0pd83Pui1LkBb0JD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866036, "uuid": "ac5af012-38ca-49af-8f11-f09402b79ffe", "value": 39820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866036, "uuid": "52dee46e-76f7-4593-848b-4d66b2553ec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866036, "uuid": "369c5a6d-b880-4e2c-b76e-f7f6d8c25bd8", "value": "9ec3f101e2f997c4a2c95693031dc1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0753b23b-e5eb-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710850809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710850809, "uuid": "1e1a297d-cbcb-41e9-af8a-dd7c74b4ae12", "comment": "Malware payload (RiseProStealer)", "value": "34da75f65dff818cd37c52f3297f8294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710850809, "uuid": "e6906187-983d-472b-ace6-3fd8fa3b73ed", "comment": "Malware payload (RiseProStealer)", "value": "5628c8670baa68adc4ddff618a8c30b8532b429227a8e94433342a504c521aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710850809, "uuid": "1c12c2fd-d6e8-48b2-8c78-32692e2ba5f3", "comment": "Malware payload (RiseProStealer)", "value": "7293cbbacb43bf862678c8d3c29e2ca5d3734cc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710850809, "uuid": "60e3b9a8-6746-4af5-ab72-2ab57eee9744", "comment": "Malware payload (RiseProStealer)", "value": "657c2cd2bdd06be245cb39ff9ff103ec8f1b645deeab49ebd90f2866ae3ce94aa0e6dfc69df8d9044c65c73445cf9ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710850809, "uuid": "9e991bb6-d848-410a-8407-bebec81bac75", "value": "T1A5953381D982CCACEB7010755AE2EE461EA1E0D3F0E1CE66B15A62985FF4B2C77D0DD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710850809, "uuid": "f31114cd-61dd-48cf-97c8-057681833e45", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710850809, "uuid": "f788ed7f-4887-4a8c-a2fa-a5a6095ba6d4", "value": "49152:17x9bpL08zJ54cKm/NAhvWG5ztD2GFzJ9pmzfaMa1:FzbpLjFnKmVyPpEa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710850809, "uuid": "5eef603b-0fce-4957-96d4-85509e6e3b00", "value": 2060800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710850809, "uuid": "586188be-bfff-4caf-b5e8-aed71a806a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710850809, "uuid": "3087b5c5-a6d1-43e0-9cc5-49688d18d1e1", "value": "34da75f65dff818cd37c52f3297f8294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef0617a-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710835011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835011, "uuid": "1bb7af60-c396-43b9-8019-262a0fea3a75", "comment": "Malware payload (Gafgyt)", "value": "bdaca0de2ea78febcad4cb2dee810077", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835011, "uuid": "64d33c2e-3efd-4ac9-8be8-94a3765d2579", "comment": "Malware payload (Gafgyt)", "value": "5697efb84a027b3f92e0c71c11b94bcfa98bd6289d9c2876ad96b119335158e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835011, "uuid": "ba6c7601-1950-4916-97a0-d0be32280cb8", "comment": "Malware payload (Gafgyt)", "value": "5c3075318b84fd025a32dac0458f3ce5427db229", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835011, "uuid": "700ba17c-a610-4863-984d-4c06004a2edf", "comment": "Malware payload (Gafgyt)", "value": "478d9e1a194e474697160f813da65f456d60e0a41d561c67bf442dd1dfee541060005e91d1947ee467e372dcf685fe87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835011, "uuid": "b74a6502-5d24-46ad-b59e-08e4938a21ee", "value": "T1EA244C24E5404B57C2E323F9AA8E428E3B3247E573D773154A389BB03FC2B9A1D75925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835011, "uuid": "587f1f9a-afc1-4b19-86fb-c1ee9fc8f993", "value": "6144:FZzyacCwXJ4DbpW0vI5hbL6nWgV7Ocgym0wfB5RyAn:FZzyacCwXJ4gP5hbLi3gym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835011, "uuid": "b6647cd1-56dc-44f6-a422-a074063b58ca", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835011, "uuid": "cd941eec-018b-4444-80fe-528234d24a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835011, "uuid": "2c3993bd-bdb1-4110-92cd-6e3fa6f64834", "value": "bdaca0de2ea78febcad4cb2dee810077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7548f3-e5f7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710855995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855995, "uuid": "985b9257-22f9-457f-b424-71880ba97acb", "comment": "Malware payload", "value": "01cedb5b4bd60848ea1c7075c59c412c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855995, "uuid": "17d41bf7-604e-4bf1-8757-18d7fe3ce121", "comment": "Malware payload", "value": "57cd23966336cf1e69557f61f2c9eab3577aa18d4f86346649dd580772b20122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855995, "uuid": "49303bab-e5ec-4e09-a1d5-a9a47ea7154f", "comment": "Malware payload", "value": "8379adf1cad9dc472f0ddbaebeaaa160bc5bab01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855995, "uuid": "30235216-fb86-4e64-9a0e-f14d98d70107", "comment": "Malware payload", "value": "62f300740ca7b7ed000a0794b82d2cb3b22a1f43269e0b00729e74bed76c2aea369f3daf995c752f71cce924e4030e10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855995, "uuid": "bc1a7380-f8a2-48bf-834b-c57d1a409a49", "value": "T13564AF13A6CC7CE2C031027167BB97E5D72EED214BA1C58FA6C42A99997C0C376327D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855995, "uuid": "77a38965-5c35-42f1-846e-92b3f0387f92", "value": "99ffa1fe3b8cdde3dbe015b777fc147a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855995, "uuid": "e71793d0-cc60-49e9-af19-dcec5394c19c", "value": "3072:6RNOixl3I2PpJPltc1//73h7OfBssFT+XVmAmzZm0adDhfzliCKVz:67OWO2jeF4edXKwdDVp8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710855995, "uuid": "b24a481e-9956-41dc-8697-76cb96b8a11e", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710855995, "uuid": "f5cf50d4-e92f-4b51-9c82-b2fc9e28d7f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855995, "uuid": "8ffc9afe-7790-4696-b86b-225fa685bbe2", "value": "57cd23966336cf1e69557f61f2c9eab3577aa18d4f86346649dd580772b20122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a8c325-e615-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1710869035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869035, "uuid": "5e772864-c747-4ec5-b92c-904cddd5bce2", "comment": "Malware payload (LummaStealer)", "value": "be38db257ff81d4b21062a0b8fd59e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869035, "uuid": "7ff641fd-d2aa-4ae8-bac7-2a68cb7af93d", "comment": "Malware payload (LummaStealer)", "value": "581095ec74eca53f7ac02ce62cae0b77e068b78f7e0c58482a462075cede1ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869035, "uuid": "6ee9bf09-8e88-4f57-8e40-99293bea6ed8", "comment": "Malware payload (LummaStealer)", "value": "8520a5591094c5c0daa954bb8230fdb8f7e628a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869035, "uuid": "d5904750-9874-4689-94c4-300127c99061", "comment": "Malware payload (LummaStealer)", "value": "0b3b61702aeed343a29b946ca46ce5e952cc8c8eb7a00ce3ce5527236efe257087086a87b37a14bd8a9ab4097ddcf7a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869035, "uuid": "8add0d1e-93eb-4054-9935-165e8d452476", "value": "T1A975E830B984309AEDD647B786ECA87CC4EC6DE0CBCDA1D311C55AD6A23D5D7A336086", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869035, "uuid": "1a43aa57-d04c-4e83-8af3-d96da4bfcb9f", "value": "51c393c3f08a9d6f94366d358312205a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869035, "uuid": "65d06048-7272-4862-8063-8a21bc4e8d2d", "value": "24576:ABp91HjOU+K+At1D74ofhNthExSpiSXFReq0OtqI:A70K+At1D74oRhEQiQgqBtqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710869035, "uuid": "12e4fbcb-dd64-4153-a69c-272656e81336", "value": 1624064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710869035, "uuid": "7e5009bc-f24d-4954-b1a3-aff99969c4e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869035, "uuid": "71888412-bfae-42db-9363-4c97370d30e3", "value": "be38db257ff81d4b21062a0b8fd59e39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f2acdf1-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710854285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854285, "uuid": "997da24e-b9f9-4611-8f1c-f4af922529aa", "comment": "Malware payload (GuLoader)", "value": "d42f73f698fb3919de5c52afdcdd2c96", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854285, "uuid": "697e502a-859c-4821-9bae-c89c780963ba", "comment": "Malware payload (GuLoader)", "value": "589ff5fe38affd1583e9d10185a72c7ecfcbe6a7f31e7bdb3d4fd421fa6fc028", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854285, "uuid": "102c6e65-611b-4b5b-b3c6-ef5d746f3d08", "comment": "Malware payload (GuLoader)", "value": "58b5d63b042bc7279ff1f93b96c1aa225638aac6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854285, "uuid": "1f01f3f3-14fd-47aa-9827-cf9d96939cdb", "comment": "Malware payload (GuLoader)", "value": "be84ad8c37fd63ef766a583ce9164efe3d33adc46245aead40aeacff99b0b48e41ca5c3c19ad1727c01739595c6df49c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854285, "uuid": "fdae17aa-840f-49d5-a079-08895f9865e3", "value": "T12F34F9E3CAC52A04CA462AB3DD134B734DA5416D73236F34ABBCC64D624395886BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854285, "uuid": "6d12814c-a07c-4ceb-a7af-34b388cb88d7", "value": "6144:7c4yENVOY0NpVXpK68kH3DPbkhZi3eNRQxkjW4RBt:EPZTOVRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854285, "uuid": "6fc8b18b-3a6a-46e4-97f4-f1877e170d84", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854285, "uuid": "9c2cacf9-265d-479a-b132-e00eb658c4a8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854285, "uuid": "160d41fc-a3c1-42d3-a994-b5c063836226", "value": "nRFQ3530904_3000030453_19.03.2024.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca54c6f4-e5f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710855002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855002, "uuid": "e73f1d00-9e2a-4b34-ac72-e440a9131e18", "comment": "Malware payload (AgentTesla)", "value": "a679bef30ec85c76410da363baf6b367", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855002, "uuid": "bda1084b-af5a-42bc-94e8-5e89fe0f2554", "comment": "Malware payload (AgentTesla)", "value": "58c468eb6c6c1c30e136a4c6eb71d894188609b6eb176fb13e72848735790530", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855002, "uuid": "137662bb-d3c7-4ae0-8a12-8dd7d56ca38d", "comment": "Malware payload (AgentTesla)", "value": "1f06f372b712fbd74d4f5ccd6753de95f759dcdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855002, "uuid": "686915b7-c998-4de9-86d7-cb46f1327439", "comment": "Malware payload (AgentTesla)", "value": "7178b42b4b9cdc18c87115ef1410fe6a4e3104710f493b7d9bebc24ce45b5858774df8c39a6f8114220724e836d519c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855002, "uuid": "2bcbcd2f-38c3-426b-bcef-a737ccaa8a4d", "value": "T107D4234EB7978EF7E81453B4312AE5D20331EAF29030E7A8BD1C6D691D653448968F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855002, "uuid": "1082a989-13f5-429d-99cf-94b1555a14a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855002, "uuid": "d7c8ee19-451a-4a21-a115-aae0f9aeeaee", "value": "12288:MYZWPU5XjkRgU2Ej/xE7v9ksWXRisRmUNEG2HFtChdTZcigRh:1HXjkzHjC6tXRisRmg2lt49cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710855002, "uuid": "4ce2e9c6-73e3-49ae-9cc3-d66b5816215c", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710855002, "uuid": "aa972806-ded7-4b5e-bd61-854a8453b33f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855002, "uuid": "f5e70a01-dfe1-445b-8452-730a9fdb5a7e", "value": "r24\u015eUBATFATURALARI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0419001c-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710837060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837060, "uuid": "6bc47182-437f-4b26-88c2-24a57afb321c", "comment": "Malware payload", "value": "61bcfc653e4a74b06abbad10bb40d7b1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837060, "uuid": "1f746c5b-3117-44d4-9346-28d5750fe43c", "comment": "Malware payload", "value": "5a325a435bfb4b3baa5d6ccf938d5fef9c06421e86cb9c337c647850899a6d10", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837060, "uuid": "6b5b764d-b2ed-447a-9c4c-da4b3dfcd162", "comment": "Malware payload", "value": "34a4ac2e42147993eb21759158fe7e4a59ebdfa4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837060, "uuid": "ef0636de-8926-4dc5-93d1-a1f41d26a562", "comment": "Malware payload", "value": "4d452b680d24796f951b6207a82c7b86d04062ce6a398ffb0d00e1a1e122a750da70ee4d6433c08a0044774b07948391", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837060, "uuid": "9f9924ef-5510-4f31-bb24-61cb34b16796", "value": "T103F3F7E3CAC526588A861AB7EC234B738DA8415D37131F35ABBCC65D604395C86BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837060, "uuid": "e7a8ff81-830d-40f2-b31a-3587d2755ef7", "value": "3072:sD4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRzBOAs1MvBVhJOgcUSgE/f:sD4yENVOY0NpVXpK68kH3DPbkhZi3eNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837060, "uuid": "65b6e4ba-9d0a-48ab-8373-707a3e40db2d", "value": 168593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837060, "uuid": "f89708f5-3c0f-43f4-9b8f-c8131435b6fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837060, "uuid": "86f2edc7-96ed-4805-bd77-8c74793e0254", "value": "RFQ3530904_3000030452_19.03.2024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931c40a7-e5aa-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710823127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823127, "uuid": "37206ad9-3273-4be8-b56c-d61da45c9102", "comment": "Malware payload (AsyncRAT)", "value": "b3c53eb5851703358e2bfacec3b19aa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823127, "uuid": "f0cf4165-1635-4f11-b1a9-e7c8c331d1f7", "comment": "Malware payload (AsyncRAT)", "value": "5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823127, "uuid": "d243ad93-31d7-4b65-904e-ab01cec0f00a", "comment": "Malware payload (AsyncRAT)", "value": "8cf5d03b5522e2f24187f04c0d3ab556fe3d1686", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823127, "uuid": "52928280-7526-4135-aa39-00a564022763", "comment": "Malware payload (AsyncRAT)", "value": "8f1cc76aaf4e6040721bcf146c9ff3892fb742a7eed3ab58d02e2b00519541b391f85e6f4afa9d1a0c093bd4708eec51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823127, "uuid": "ad21e0e5-70f8-4e46-9873-c8722186e721", "value": "T1BB72F9101BF95E21FB7B8F706BF49A221F32BB469D21C65F095082490D31BD599F1F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823127, "uuid": "eed1265b-8c58-4856-a4b3-e45394e23d86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823127, "uuid": "fd17219c-f7e3-4543-92bf-85586a77ad16", "value": "384:26kyHLpL3LxYLTLc8VcpOjAM+o/8E9VF0NyFbm:26XHFz1YnwscpOjAMxkEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823127, "uuid": "0c8ec189-d8b6-4611-bc4e-f9a472f29436", "value": 16648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823127, "uuid": "0140be26-a67b-499b-8b74-95819e42af39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823127, "uuid": "f259d6d2-96a5-4983-a633-8d7bec48d9bb", "value": "b3c53eb5851703358e2bfacec3b19aa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73a54db-e5da-11ee-a120-42010a9c002e", "comment": "Malware payload (PlanetStealer)", "timestamp": 1710843884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843884, "uuid": "a30a9185-e7a7-4fed-8f69-9617dc176c55", "comment": "Malware payload (PlanetStealer)", "value": "64faf1e1758a9bf23768e62556bbaeed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetStealer", "colour": "#C45C5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843884, "uuid": "a1c514dc-854a-462b-babe-dc17a8615832", "comment": "Malware payload (PlanetStealer)", "value": "5ac13182343463cf136067ac6a5a4057f8a96a3bd13cd37b1eb9355f617753ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetStealer", "colour": "#C45C5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843884, "uuid": "11527c06-2a6b-499d-ad5d-4bce5b1fef1b", "comment": "Malware payload (PlanetStealer)", "value": "2c3b9b40045fb115b25621e00a60b83c00d5fe34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetStealer", "colour": "#C45C5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843884, "uuid": "584f5ca5-a065-458c-82d5-bd7fd145ad5c", "comment": "Malware payload (PlanetStealer)", "value": "1e05a29f240809eccbee499a90d183e661f02ee02ac62694dae78c5f0a32f7f48a589183678b145680a11d5c9605a8b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PlanetStealer", "colour": "#C45C5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843884, "uuid": "38a8cecd-db28-455d-8f7b-0d8006d6aa14", "value": "T1143633F5810B2BF5B2B25B3766DCE10FBBA90F42D1E8BB1138CC86F6E6312915575620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843884, "uuid": "9834470f-9b8d-471e-b9bf-b235f8fb1411", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843884, "uuid": "030c6815-7e92-429c-9838-c092e2dd917c", "value": "98304:sqeJTj8EZklpKP6aIuTzX5WJTNOiAY/DfV5OtQOH2Xshid5pPY/Zzqy2HaPx8bc:heJskopKSaIASTNTAiDfvOtVevdcZeyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710843884, "uuid": "5cee39fa-20ef-4a82-be8c-fc31dfb7d412", "value": 5014016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710843884, "uuid": "62ef5c24-5b62-4b46-8fd0-00df041db7cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843884, "uuid": "85f7cd45-3d75-4df6-a0d6-46f0843389fe", "value": "Conferma_Pdf_Editor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe30023b-e60a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710864538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864538, "uuid": "da32937d-6f2a-48b8-9a9e-5dedd8c9d301", "comment": "Malware payload", "value": "32884cc945713372648342ae225748b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864538, "uuid": "a43411db-08e1-4476-8865-73bf19352bd4", "comment": "Malware payload", "value": "5b30c309cd996a6ab8c1e2aad4e0d47a566f1cb8859677ac90f1253336451dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864538, "uuid": "d7f15519-ac1e-475e-bd18-937d8e331566", "comment": "Malware payload", "value": "896df3f93f86c869469d9f57748e7bfdb2e50279", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864538, "uuid": "4c4f4f83-06e9-45d0-800a-b4f95eae4a35", "comment": "Malware payload", "value": "60002d13cc5f47deed464ebff223ce2c146de4ff166810f6521570a00fc3f37c03b59fb8813ef28e229c18c61628d44f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864538, "uuid": "2369dd74-3a4a-4c93-95e6-0d74661238b3", "value": "T1FEF429333692C139C273257E8EAA96B9526EBC200B65D5C7E3C42DF90F785D27D3610A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864538, "uuid": "6213e0f7-5d84-4496-bb3b-844d612d762a", "value": "a0701968874db905ad2f19b441b018da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864538, "uuid": "dbf04b8f-51f4-4d8c-aa39-2a83503c4067", "value": "12288:M9o2HYYuxp9Mc8QTmWWcGLh3OJMxFdYlBaCuYO4fN77wihUwG:fYuSWU+JMxKaC7f186Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710864538, "uuid": "469e405e-b806-48c6-ad3d-798da5520073", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710864538, "uuid": "3d1cec48-8b83-4689-81bd-f150af6ba979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864538, "uuid": "2e545742-0c79-4cce-9fbb-922c059bca6d", "value": "33066.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b88602-e587-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710808213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710808213, "uuid": "388f1b5a-eb79-4070-a729-fc09df1c7f2b", "comment": "Malware payload (RiseProStealer)", "value": "2f3788b5888df3041c98bc1640800b5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710808213, "uuid": "44e336ec-c347-4f7b-8c2c-d11dc4a91ba4", "comment": "Malware payload (RiseProStealer)", "value": "5be32d6d85e5216b2f6812e517052360c740651f221d18ef7c5fc5d368082426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710808213, "uuid": "26b2df31-54fd-4429-81db-ed08bc4f7c99", "comment": "Malware payload (RiseProStealer)", "value": "4131b4de2c4f9b67ec869e67d1327aecf1558966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710808213, "uuid": "e0bdf3b1-0103-4699-90c9-e50014fa165b", "comment": "Malware payload (RiseProStealer)", "value": "3d9825b6b5e4e1db1f8557b3dda937738b1128b6d4b247ec8be264a5e884461332209ba23df844b838bb67b4c0ccb5b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710808213, "uuid": "2466855b-08f9-4472-985e-85255bd92289", "value": "T195A53345915388D6C8A2067C8BD9F70A977AC8D12AFC4051739F7BAB1FBE42E37D1880", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710808213, "uuid": "37872bb0-ad71-4a27-afe0-18c8a3acbfe9", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710808213, "uuid": "e30d2457-04fa-476f-9513-9c3050a3a320", "value": "49152:y7x9bpL0w/6BN0c2cHe+uV4iQnD6PWu6aWmHzOJBYrO:uzbpLP/gNRR+n4iwZuqHYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710808213, "uuid": "fef85236-94dc-4060-9745-b5f8dd693ea8", "value": 2070528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710808213, "uuid": "36d5f1eb-8188-4fa9-98fa-d67c62684d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710808213, "uuid": "65baab7f-01b5-4eeb-ab4c-9f6b1003a1ad", "value": "2f3788b5888df3041c98bc1640800b5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4c0093-e591-11ee-a120-42010a9c002e", "comment": "Malware payload (Blackmoon)", "timestamp": 1710812356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812356, "uuid": "cb1d8da9-e291-47ca-a9cd-152f9e648b5f", "comment": "Malware payload (Blackmoon)", "value": "16c2b2255bf7e1a687b6ddc4f99fca81", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812356, "uuid": "7e4af4d0-f5dc-478d-99d2-86b851c0667c", "comment": "Malware payload (Blackmoon)", "value": "5d5d24574f56e090d0bc8a753fdb8e56c2e0232d368d696459e0333b4e34626c", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812356, "uuid": "111bd087-4a07-4714-966b-e9283e8872df", "comment": "Malware payload (Blackmoon)", "value": "a78332c7802b8eeb59439e4d1de3f9eba955c355", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812356, "uuid": "87b744e2-fe01-4d24-8d71-2f17414f809b", "comment": "Malware payload (Blackmoon)", "value": "b3f3c7635a6f183f5a1e52caba3053c8fcb8d0e16975091584fa1a61c84fb719c8634403360bf1223c2f71c42bf788c9", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812356, "uuid": "7e8802f8-1cb1-4dfe-a4f1-25623e4383d4", "value": "T104E312109B2FCA42E46BA137CBD50218F6A5713174DA7338EBD056D97538EC09EE4C9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812356, "uuid": "cd030fdc-ca34-4073-bf3f-0b5e42ebc89b", "value": "274c2770e4fd564cd1cf7b4b178cbbda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812356, "uuid": "a429a94a-c275-442c-b2a9-cdff0aa4f46f", "value": "3072:WWWX0E6LJjGF+dtoj84/9rOnt/cA6QIjeyuuI+4:WmJ4+Tj4/QSA6QI07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710812356, "uuid": "bf85040d-5b06-41c5-bf8d-92246c0697db", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710812356, "uuid": "00c37891-9c92-47ef-aeeb-23aa87c316d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812356, "uuid": "785891e1-07db-4270-a0a0-81320478c064", "value": "SecuriteInfo.com.Trojan.DownLoader46.54101.5903.2472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eb8db0-e649-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710891253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891253, "uuid": "74ff88bc-e60d-4048-87d4-ad0f0a63e259", "comment": "Malware payload", "value": "b8de7c98fe348d04ca8609d7376c7955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891253, "uuid": "32d3e149-5044-48cd-bcaa-c501de28ee29", "comment": "Malware payload", "value": "5de000c94215943f6ddbb15376ca07f67f9965ab58cbd3335279ae66baf56bb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891253, "uuid": "45c01f23-4291-48fd-8653-a986957e1a36", "comment": "Malware payload", "value": "95775af4c46091ea5873f2293d04e2669cbfdc98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891253, "uuid": "89696a10-f357-4f98-b34c-06898500ca61", "comment": "Malware payload", "value": "0e0b83fc404a4c049dab8478c6022f32316f9fe906b66d86dd52ad8dfe8cdf8dcb2d35d28ba35fb587e536b575d21845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891253, "uuid": "2cf6c7e2-bcbe-4055-9f84-0fc43565809f", "value": "T107169D02F7E405E4E467C634C93A9732D7B2BC9A5731D28B0914F35A1E73AE18F6B621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891253, "uuid": "2fbd2da6-7dfb-4998-94cd-d6a5902173e4", "value": "fe51a7746c23b2c743a8567317181013", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891253, "uuid": "73172ab0-2d7a-4938-aaa1-ecf3bb7e3f17", "value": "49152:VlyzgGORs6XChYeMOMs8EOruQnWCmxynuU1gFeGokmNyDJqJWv:V+NBYnnm4nubSVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710891253, "uuid": "0f6c4851-b9e9-45e1-b030-ecb5200840f3", "value": 4246016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710891253, "uuid": "1b71909d-5ae5-491d-9015-73efc81cb930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891253, "uuid": "28bd4b0c-a567-4d47-a73b-2d1da0977018", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17321a99-e61c-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1710871881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871881, "uuid": "fab0559f-430c-4828-b6c9-b907a1e50a08", "comment": "Malware payload (Glupteba)", "value": "6e499f72e52c0ea79ac438503ab5330b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871881, "uuid": "a6e9ae69-e072-4acf-b502-614da9a006e8", "comment": "Malware payload (Glupteba)", "value": "5e1ce6d369344dbf6fd85919665660489c2ba7190b90140d05ff082951b96595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871881, "uuid": "5b6011a4-fc47-48ff-ae66-08d810ed1204", "comment": "Malware payload (Glupteba)", "value": "8b04c8d3942d053e51825ccc20b828cd45659ba2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871881, "uuid": "1fcf45c8-0026-4e1d-a3f9-6d0b9c664718", "comment": "Malware payload (Glupteba)", "value": "64c3254d02ba5cb60e7958fa9c830c3d976ff4083d87e92a1395b60816a54c5786b5666f2528f3c834daf22de29b60f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871881, "uuid": "86adedc5-12ce-42ec-a091-c75e319f88ad", "value": "T1B716330098D79078DAF75AB9A9B0D7648DB7F4B32A70964E3510E63B3CF41C1CA69327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871881, "uuid": "0ff2c224-8400-4be6-8f55-b5f9f2502b03", "value": "b15b414076b0d8dd5fe0c12cfe7bf2ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871881, "uuid": "8dfc6920-80fe-4c34-b3d7-57984501cd41", "value": "98304:XKXyE8In0O6SJhzK5n/PpvlNSCo+wC1w3rVx3yg+nu:Db2UnF6Co+wC1Mx+nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710871881, "uuid": "e7f522df-afb4-40ff-9812-cec709b2cb61", "value": 4341648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710871881, "uuid": "90faab33-f904-4cd6-ab4c-90d876c33fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871881, "uuid": "e4c03b52-cdc6-4c66-81e2-e07490bd0e6e", "value": "6e499f72e52c0ea79ac438503ab5330b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd31a53-e609-11ee-a120-42010a9c002e", "comment": "Malware payload (PureCrypter)", "timestamp": 1710864024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864024, "uuid": "7fbee1e8-9f2f-4754-b5e6-723b959d23c4", "comment": "Malware payload (PureCrypter)", "value": "8d7d770b43856e2c4271edadbf377aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864024, "uuid": "582ada54-9fd7-4cbb-b04d-2d7a7b71585e", "comment": "Malware payload (PureCrypter)", "value": "5f8603a6cb67a35e012e5ed12e8b5c54a2a673f7918588c520c001651471cdb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864024, "uuid": "7357f7c6-b6e3-4405-8a9f-f31e77820087", "comment": "Malware payload (PureCrypter)", "value": "293eb3321f82b44015f3703ba8692bb7c356d402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864024, "uuid": "5f7e09f2-71ef-4275-9e7a-def3b7bf4bef", "comment": "Malware payload (PureCrypter)", "value": "ddef2e1dc9713da3767464240f44cc41d6f1edef505e56194dba7f1096c557766739e43f8e6e9abb6ac7fd700f045d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864024, "uuid": "7a38a072-d73b-4e89-8ac8-6e30bdc1beb2", "value": "T1F4C1C50163D89737D6B90F78AEB293811274F7A28D17CF3F3888260B5D463948A62B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864024, "uuid": "1281463e-a987-4011-b656-4d374e7d9aa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864024, "uuid": "5d93776d-183c-40a8-bd81-5dc47690b08f", "value": "96:WXy/CoDTM46384crGZgOOBo4NnBHFITAIl0tuKlqlzNtR:v/ConM5s4crG6nW4z+uqfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710864024, "uuid": "3518489f-00bb-4647-800b-a2999df4c95a", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710864024, "uuid": "65d6a42b-5087-4835-9618-63b9070db518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864024, "uuid": "01685cc9-5247-4719-9103-71c52799f982", "value": "pago 78890943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b70f953-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710840320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840320, "uuid": "5423095f-c521-4a31-9738-6fa74c86737b", "comment": "Malware payload (njrat)", "value": "38644135c5520def2ac7647d58ae8c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840320, "uuid": "0b8c85c1-7776-40f8-9e04-c79b4fc88861", "comment": "Malware payload (njrat)", "value": "601964b1a055e2081cb031f60317e34a701d962baf8a4bee6306c2be64a2305d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840320, "uuid": "b3790d88-22c6-4dd9-832e-c6cab66b5c17", "comment": "Malware payload (njrat)", "value": "ef47d7b432d6df81836c05c4562d1aa9fb58bf90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840320, "uuid": "e54f6963-1f2e-45f8-860a-abe2319032d3", "comment": "Malware payload (njrat)", "value": "e5fec975a21bf8f161bb7d602aade6accf5389fd0f397a153ea58a23caf0b1d37faf49dc9e6f27df048e679718df665c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840320, "uuid": "4206483f-afb8-4a4a-9860-93b85f81e687", "value": "T1975462979A4F7441D4A6CAF5577789CB20FB8D352E79B024C4D8B4FA1BBAAD31203C84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840320, "uuid": "9ab8c243-213d-4502-95d8-a50c2cc08e4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840320, "uuid": "8415f84e-8cfb-4a19-a7d4-837569cab2ef", "value": "768:FQv32bk/Q0oEst+XrM+rMRa8NuyKtQAFhAfPqyE1+HKiUi1N+F81qiY/ku:FQv32AY0oE1I+gRJNFarAXqo71cGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840320, "uuid": "2e532806-b836-4b51-ad2b-2fe7a9543abf", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840320, "uuid": "1272c6ee-2b73-4133-b2c6-9db3f876c103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840320, "uuid": "d9272d6e-18ee-4dc0-86f8-d2331a027050", "value": "38644135c5520def2ac7647d58ae8c22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584d2fd9-e5bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710832047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832047, "uuid": "13928bd2-7677-41a6-ad86-3ea7b876edf9", "comment": "Malware payload (AgentTesla)", "value": "8eff5abf02fe2f65d16f3f230844c520", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832047, "uuid": "d62e550b-4157-4137-9081-83aa705b084b", "comment": "Malware payload (AgentTesla)", "value": "624698f7e331e05b6111be58e067127dc5ce81112564fbc99e1f7189c3583e01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832047, "uuid": "e35975bd-cdf6-441f-b6f1-9de8493aa4be", "comment": "Malware payload (AgentTesla)", "value": "57abe87b87eea6a2c8798a6a30af80c531681199", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832047, "uuid": "245b26a3-4064-4f01-9007-eb4aac98e94e", "comment": "Malware payload (AgentTesla)", "value": "7d245091677a13faac241cb75fae4da94078fa5e895803f97a3dd512ce413e6d672bdc6709b8cb8aa443213c5fa9cf67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832047, "uuid": "f809e714-bee7-4cbf-b234-d78f927376bd", "value": "T182E4230073B496E3EF2642F510EE2F278BF1B2461997C6D8DDE050CE98D2FA0965395B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832047, "uuid": "e21e8daf-43ab-4280-809d-d6d01dfa5201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832047, "uuid": "63e89c26-8e07-4bd8-9fb7-36e7f714667c", "value": "12288:alPloOJRYWq2C2gedriyjCfc2+mvVbP4YwJQGbyVtWDkKIJeklekR:M9oOJbDPgmrxAfr4VJQjykKIJe6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710832047, "uuid": "ceed4a1b-b950-48b0-b66b-d6436c147d0f", "value": 664072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710832047, "uuid": "b8b84199-789b-46e9-9d0b-c55712ad1214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832047, "uuid": "215d7f76-5b76-4767-8319-c02a83a42ba2", "value": "New Order..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfae4a08-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710836999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836999, "uuid": "fcff9cbc-1c21-4645-ad66-40b52f5781b6", "comment": "Malware payload (AgentTesla)", "value": "edc4b6975195eeb4c7c1f86e6d60670b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836999, "uuid": "11eb6709-91fa-4c3a-a017-f418f1cc7606", "comment": "Malware payload (AgentTesla)", "value": "625cca7c3fb4e9528da051a098016617056fa18f34d28877a20ca917ea232348", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836999, "uuid": "5bfa289d-3d11-40fd-bb1a-b6ddca5fa387", "comment": "Malware payload (AgentTesla)", "value": "bdafea5e18f3d531e7ee3392e4c3b64122b53d4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836999, "uuid": "9c0ffc6d-339a-41d5-9835-a058ed671a2d", "comment": "Malware payload (AgentTesla)", "value": "9699d387422b13589e9839aec08f94fb16c90522d6cb7bb0f3e5f40dc39a81baef9d5cbe1413feb9c960e01a284f0377", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836999, "uuid": "5cc9b2c2-e911-48d0-ba31-510f25c6374b", "value": "T1D5E4225477749283DB731A7124DD5B120AF3B80329E1C69C9CE0B5DE9ACAFA2DB0116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836999, "uuid": "ad192e1b-de53-4af1-b939-c35ab080de7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836999, "uuid": "3acb9908-ccea-4719-8d01-fb7d1f091776", "value": "12288:lclPloOJRYWq/8JH2tMZx8RAHyJtN0+myTYAHxB3HhPlLCZ/CNALl9kR:lC9oOJba8l208mHyJgd2YA7DLYC6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836999, "uuid": "a97ff22d-262c-45e4-9795-7ad83d14e7be", "value": 667144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836999, "uuid": "d90c382b-b0ab-4d73-9033-2f425e1b4183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836999, "uuid": "a9d730ff-3919-4761-a2cb-2a7b5e5e2113", "value": "HSBC TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfa7847-e5ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710823868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823868, "uuid": "e572f97a-e752-49b9-8c0b-dcf480dec03c", "comment": "Malware payload (Mirai)", "value": "39630602324c431226c89b1e7e8faa0d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823868, "uuid": "c7b70617-e2b5-40ea-916d-9fdb861cdd55", "comment": "Malware payload (Mirai)", "value": "631917d0423fd25c159d8ee541d5ed942e7bde5eb19919a7d96db437a8d115f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823868, "uuid": "b1a4adc0-4993-4801-942f-5a2de0d2efaa", "comment": "Malware payload (Mirai)", "value": "c3679f592e437ef1e81674c9be8ae49cb36329b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823868, "uuid": "63c7fb7b-f0fe-4742-b903-e78490212132", "comment": "Malware payload (Mirai)", "value": "4be579714313f289acb022fa71c9b0e7466e5a2957d95a681029c2e6ac4e263e72a685040a1b3891cf47ae3038eb21b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823868, "uuid": "b14aef68-a67a-4d1f-84ac-35e5f195f834", "value": "T13CD3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823868, "uuid": "d87420a7-f35b-4a45-ad0f-97f95e5f59e5", "value": "3072:AHZ+XPAopxFOV48wlPJHQRTaPuU8RSON9LSoibD:AHZIA2AV48MPJHOJ92oi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823868, "uuid": "338b63b7-9b32-4f75-b40b-b9a1f460035c", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823868, "uuid": "6be08be9-1eab-4338-a4fd-e091edc947b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823868, "uuid": "090b4eee-dc6a-4eab-acb9-5b5e483f9532", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d846d1c-e607-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710862846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862846, "uuid": "c855b551-d7ea-4f58-8378-dbb9950cddfa", "comment": "Malware payload (Mirai)", "value": "7c862020bf4d2dd65749814d7749765f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862846, "uuid": "9bc76456-4aed-49e5-99e2-a0c13d49463b", "comment": "Malware payload (Mirai)", "value": "633fd790b2c8687ed05268fd6c7294a1874d12a51a86de5aca957439d170f45b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862846, "uuid": "c6f51bf2-a098-4e98-b794-00a4a593165f", "comment": "Malware payload (Mirai)", "value": "d898eb0becc3c1f7be760271b311f20aea581759", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862846, "uuid": "ae04c7c7-1e1c-4382-8523-3a71e1ae8e35", "comment": "Malware payload (Mirai)", "value": "515e3d0eb25e81f54485d2402105b42285be407c6855f93a584e203980ab31ffde6e3a56cf27d0bfabacfa57f7291f61", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862846, "uuid": "5cf556ea-7199-4f31-aaa1-5a171473da19", "value": "T1FFD31945FC809F23C6C612BBFB5E428D372A17A8D2EE72039D256F60378695B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862846, "uuid": "59c1ddcd-a202-4164-81a9-d4e97f4149f6", "value": "3072:cpQ06fb4w53PQz14qHxeATu24uymazJXL1u/6zXpawlx:cpEp5wdR4uYJXLXzZaw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710862846, "uuid": "efc3bccf-2eb7-426a-a4d0-61f2579b7416", "value": 142176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710862846, "uuid": "7395c189-2022-4560-a86d-a267d3583d9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862846, "uuid": "6d7b1cd7-e21b-4f8b-8e77-826d4a0a13a5", "value": "huhu.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c058620-e5e9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710849985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849985, "uuid": "c436c981-9f6e-4ea0-8b6b-94597f983229", "comment": "Malware payload (AgentTesla)", "value": "ba46197ad05fbe453a47918685e7d407", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849985, "uuid": "760cd128-c78c-4ab3-85a8-7418c2faee58", "comment": "Malware payload (AgentTesla)", "value": "65425223dfa8ae8334cf347355822d3fe7589ccd6b35733db1e473a335c0e49e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849985, "uuid": "ec24e47a-49b5-4ebb-b8e8-4f029fb78453", "comment": "Malware payload (AgentTesla)", "value": "68e70bb4bf6a09716df64ad9cf04567ecf415056", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849985, "uuid": "a9eef134-759e-4b69-ae4b-0c82e8ea82f4", "comment": "Malware payload (AgentTesla)", "value": "9d6ab0f6fc72fb6376aca96b4fc463e00d7a140cbd0391766cc2bc787744cf31c3ab2ee8290b5ff11662cb966d4a85cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849985, "uuid": "4e069378-6f18-4e87-8d2e-256edaf3437d", "value": "T1C2D423160A198BEAFB9763FB48AA01712BD14E5B1845D4BE6C91388FF999B73401C0DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849985, "uuid": "f4df6c73-4d6c-4565-9072-536bdb5d2ab4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849985, "uuid": "2d5e343f-a016-40e1-8e31-3448ace67643", "value": "12288:KkxWTQifLth8ze5qFtiEWPXM9OgoAoNCJ48jXeOJRYWq:KkxgZfLtCaGiEWvtw48zeOJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710849985, "uuid": "4f822647-e800-4c86-b488-ce2514a5196a", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710849985, "uuid": "1f31da6b-e4f6-4d2e-a938-08c734177be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849985, "uuid": "0aaa289b-3cc3-46cd-88f3-ed89aa961adc", "value": "RFQ-4320018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c61e236-e5c2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710833423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833423, "uuid": "f891dfc3-460d-42b9-b24c-d2f164a573c4", "comment": "Malware payload (AgentTesla)", "value": "e8cedc119dbfa336ddeda9a24974b1a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833423, "uuid": "65cfb3bb-85fa-4e79-8f5f-f794f730ef2a", "comment": "Malware payload (AgentTesla)", "value": "660f2be2087d54741e99ef96df97b3d942b1a28e98bf9cc75109930111f7da87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833423, "uuid": "1e4c55dd-9599-4329-980f-0fca0b828efb", "comment": "Malware payload (AgentTesla)", "value": "7054ed710ff2f1a1e7f82be54f5fff25a9d41bc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833423, "uuid": "2eb226e4-d230-4de6-9046-c8932df5782d", "comment": "Malware payload (AgentTesla)", "value": "6fc9d195e882740eb0e298b0f2d16dff0edb66a70a85a802b2a87c44de70cef968ed1f2c06bced9fb4ef118132e9e943", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833423, "uuid": "5b699833-2a11-4417-93bf-7fdf4f33d4c0", "value": "T15D74C6E0317D83D3E1B18EB11FCA86B079F135AC98D0560DA0F99B2E93D2355149DAEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833423, "uuid": "45a17e3f-d1f9-4d8f-b3b0-0ca1246e7bd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833423, "uuid": "6d9814ee-9012-4441-a949-712087baa26c", "value": "3072:dDPDc6JSDNY3T2hEUm9eRsvendRIiiVqcdSB6O4ZGROYX+9wqY+mhhhmitqOd:dTDcsSuT2CUmPvoIKmSUO4iOYXKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710833423, "uuid": "c720096d-abd7-42e9-b218-7ea62a221f21", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710833423, "uuid": "9d3e57c1-5edf-4eda-9478-c27ffd5d597c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833423, "uuid": "9a44b8e3-c9d3-46ab-8717-25afd8f943f7", "value": "DEKONT-90486589368903087689000000000000065.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc70e54d-e627-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710876883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710876883, "uuid": "9c1550fd-f16e-428e-9b84-66d333a284b2", "comment": "Malware payload (PureLogStealer)", "value": "f727c0754ddda4ed6354375ab748735b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710876883, "uuid": "0339c855-b4ba-4845-a3ff-a3bbb2024c7c", "comment": "Malware payload (PureLogStealer)", "value": "661a2b6049a9d139ab8ae094b25ea0cfd3f24e7aa18190ae11e23f9e97753899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710876883, "uuid": "d7fb1a06-6e8c-4377-910c-c4c69c476b18", "comment": "Malware payload (PureLogStealer)", "value": "2ad7d52a12f896817edfe511ec26212580dc5958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710876883, "uuid": "26e4481c-9222-41d0-b4fd-3dd3babb5c90", "comment": "Malware payload (PureLogStealer)", "value": "146a7f0f4c016d1442ce024484e86b2ae1249071695536efcedc8b5d3672ba7341005316e718916fe2375d7d8e91d511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710876883, "uuid": "3ccaf9ab-1482-44e1-a754-ccdce57c1193", "value": "T19484D0393EDCE517CAC843F994D250A287F1BA12B557EBCB644696F436723A04E1321F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710876883, "uuid": "9e85eeeb-2938-4ab8-bd1f-141e00323dde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710876883, "uuid": "f53e49b7-5688-4130-b43d-acf719e210e7", "value": "6144:jDDVjYjHaWUpUL/D70J/t3VWMu/RuwtYULAFzcZjSwBJFryh4jSc57cmYV5Yv4Xc:/DVjYraWUpUrD7sNQMu/YNzcnBJhjSA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710876883, "uuid": "d085c64d-2317-438e-9be3-f516db5e88c5", "value": 381952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710876883, "uuid": "abf63298-8152-4cd6-a8c6-d1b74c4937c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710876883, "uuid": "2a9cf3c7-0110-4417-a639-adfab106b9d0", "value": "SecuriteInfo.com.Trojan.Siggen27.2545.14164.26978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc20697-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837076, "uuid": "a15dbc4c-8232-4b4f-bc75-4581ae100621", "comment": "Malware payload (AgentTesla)", "value": "85a63e63ec53f072b057908bee2785d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837076, "uuid": "95b57a4b-045f-4bc1-985f-90447236deab", "comment": "Malware payload (AgentTesla)", "value": "66ac53d08f951a77ffe9c5275fa3072f10447648074c6307e1a49a6d6bd260d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837076, "uuid": "ab784ee1-8776-402e-b1a9-c8b3fdcb8af4", "comment": "Malware payload (AgentTesla)", "value": "4e6f6e19f3438e8ece68e94616123361ccc6d1f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837076, "uuid": "99c6dfd9-21a2-47d6-b514-de8e9f555f64", "comment": "Malware payload (AgentTesla)", "value": "47adac5ca136e973bc5da51f3408345742902193a48ed8cf94b53ded774d7539f01f12f80b5e21a2502a6cd65d5e5ff3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837076, "uuid": "689190f9-6628-46b2-bf96-ace16788729f", "value": "T184F3F7E3DAC52A184A462AB3EC574B734DB4415D37232F34ABBCC69D604395882BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837076, "uuid": "faa46a65-a1cc-4858-8f75-72bff0be6986", "value": "3072:su4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNR+fOV9muREutj1PfgpJfmVwh0:su4yENVOY0NpVXpK68kH3DPbkhZi3eNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837076, "uuid": "b9414462-4ae0-4465-beaa-48ba30d08529", "value": 171398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837076, "uuid": "955cdcf9-9f16-48f9-9960-5ab14297e7bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837076, "uuid": "382c31be-34e0-4d77-a310-b39d78ee08ba", "value": "HISHI PLATE 102E_Salan PVC Welding Rod.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ccd984-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710854595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854595, "uuid": "80735eb2-bf52-49d2-92bf-417a36985963", "comment": "Malware payload (Formbook)", "value": "2f89ef7d6d9776d3d36a92de59523b4d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854595, "uuid": "8687925b-1950-495c-91f2-09984a5a3d14", "comment": "Malware payload (Formbook)", "value": "679d8696fb96346aad61af543ef68d125b5ac0f4208b0d242f270145d327244d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854595, "uuid": "1efa8faa-933a-4fb3-837c-090ebd84419b", "comment": "Malware payload (Formbook)", "value": "2c58fc4880b51601d7d92f4b4017ad902077cad0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854595, "uuid": "69d8bd38-97c6-4438-8807-b67c7e6d4d93", "comment": "Malware payload (Formbook)", "value": "baf2d1a799a3d9de3fcb2d35e37560af40d8a0e265164f6807f9b73e618cadf45bdfd911fa94dcb9e81dece92fb9969d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854595, "uuid": "e44c2218-6a54-4a24-9aa3-82561d71a148", "value": "T114759D0273D58036FFAB92739B6AB20156BD7D250133852F23982DB9BE701B1277D663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854595, "uuid": "7bc3ef54-f299-4a96-a71f-3e386ba30ea0", "value": "24576:iAHnh+eWsN3skA4RV1Hom2KXMmHaP6LHXm6SFpHm6sfTd5:lh+ZkldoPK8YaP6L26Wpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854595, "uuid": "90c014bb-4589-4a4d-87e0-915ee91c2400", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854595, "uuid": "14f8fcc9-2034-434e-ad61-0197d7bd1de6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854595, "uuid": "f7a96a69-1aae-4adc-a5d8-50c0b0a94d9d", "value": "TRANSFERENCIA.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108a9fd9-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710837081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837081, "uuid": "34247cbb-5924-4a9c-9fd5-bfbd239d5c10", "comment": "Malware payload (RemcosRAT)", "value": "44351f5b633f64c785a5cb681f54db24", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837081, "uuid": "0b962a39-417d-4a19-80f4-e5e7b3195de1", "comment": "Malware payload (RemcosRAT)", "value": "680acae485ed1f4a3ac87a63eb7b640f15019e6feb43664654c3f6c0ab4cc118", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837081, "uuid": "671d1380-33aa-4260-9ea0-8f5485b7743a", "comment": "Malware payload (RemcosRAT)", "value": "72b14e85f0676ef6829937060fea448753c357b5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837081, "uuid": "fff4cfe8-ccb8-4934-9c76-8db0a19b8d54", "comment": "Malware payload (RemcosRAT)", "value": "f1c9c6dc324f8be8e000a6e3b7ad87a852d5fa85a06b81474c28c7b49e13036ec39fa52887c228391cc7f26cbe83743b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837081, "uuid": "678fa3b4-0a1a-4cbf-b274-089c63bddf78", "value": "T183A290F9EB8A0FD67D1FAFF2584EE6C178F44880E1BD4021A95E4E88B5074C8DD25698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837081, "uuid": "f2a6fa87-6732-4a81-ad13-7bf3dedf6d99", "value": "384:CE686K1TZNiwsye6fUoQvHjNTvDDzgN9g8gT:H686KZHipf6sFxDD3ke8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837081, "uuid": "85a674a8-e438-49d7-8a1e-bfb7ba520e72", "value": 23116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837081, "uuid": "79caf955-1b7b-4b3f-876b-cd9334e19906", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837081, "uuid": "897e92e2-8e52-4c22-9324-53c7615c2ce9", "value": "NTS_eTaxInvoice\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e748be-e5e4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710847960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847960, "uuid": "2ae50549-48cc-441c-b14f-5323ca98f68f", "comment": "Malware payload", "value": "5f3c52c804bf6adadac97e2e53179bee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847960, "uuid": "ec0bf243-0357-4261-b0d4-f25391ee2100", "comment": "Malware payload", "value": "6846565038cf634e9eb81a923f408e5fe4c2170e27ceb40856968a38d59c3db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847960, "uuid": "4638b3f1-ccae-467a-a344-1a461b0f61d7", "comment": "Malware payload", "value": "6c0b4bf6f5f157cb0e764547a551453d9c5eae8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847960, "uuid": "b1bf0635-f902-459b-a8e4-2362b6b8f5a1", "comment": "Malware payload", "value": "36a17aa4ca5fd2d179be4469e30d75c592018c5980e718f7573b58d36ea5154ebdb75003932d4d93a3162abd70d27a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847960, "uuid": "20d3779b-f80b-4b75-9a79-4a84ad140586", "value": "T1D2C423A097984161F7AEADF808636BDA2533F367C51B4F8E64073C06933939B91A5733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847960, "uuid": "50fca2c7-5cdf-4ee2-b309-35de194f0fae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847960, "uuid": "ba9ebceb-db66-4dae-bd2f-4adae60df8f3", "value": "12288:zZdfrXg+JwuKt/S/60G3SpaFKnXNFcTFNJL:zfw+Jwz/S/6cMkKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710847960, "uuid": "e4d0fb49-275f-4a3d-981e-12162f6e8d35", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710847960, "uuid": "6ef06118-8271-458d-a25b-185de66801cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847960, "uuid": "4435be2b-029c-4b89-ae48-5a8594c41ae0", "value": "SecuriteInfo.com.Trojan.GenericKD.71742547.10027.1801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed901068-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837022, "uuid": "62ac0f5c-db21-41af-93d9-7fc0a1d11979", "comment": "Malware payload (AgentTesla)", "value": "e78c1dbf5a60565752827b9da8be8f7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837022, "uuid": "0ef327e0-c2b6-4667-8fe7-00aade69ded0", "comment": "Malware payload (AgentTesla)", "value": "68f921d55e5ebbc383106e2de957dfd3a9db76117d8baeaf60d824954e4c3dd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837022, "uuid": "75ff2790-319d-4d5b-b551-ba1ccea0c042", "comment": "Malware payload (AgentTesla)", "value": "4a12a76c1156ba36a5ba6c71d861d9fb6d67b625", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837022, "uuid": "b5f58edf-f96f-4432-ba9b-42445fabc0e5", "comment": "Malware payload (AgentTesla)", "value": "6a91a1cc291a87bebb511af6c2ea723feade6a523ed0f5bf724c4bbacb3fde2cd3f1ffbd9624fd441704d501a7b5f948", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837022, "uuid": "3f98f690-f25b-43e9-a9e0-4367033d5e1a", "value": "T176E412E26E03DCBEC4BF02FA543E74245903AC59D51B295E61EBBA44C3BC5A4E433792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837022, "uuid": "dde0799e-4b13-4438-8e9f-75799f13e837", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837022, "uuid": "e9d78082-bf37-402c-9240-5479bdabaa95", "value": "12288:MYV6MorX7qzuC3QHO9FQVHPF51jgcSpMQQpDkzgsp6YTzV+nvZSDaK4Tc0jNu:rBXu9HGaVHS2JDHY8vwaK4TNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837022, "uuid": "dea0a257-43cf-4e79-9200-f858b019c95d", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837022, "uuid": "c231a49c-8f13-4d5e-9650-cbaa854c207c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837022, "uuid": "6ad69d88-77d3-44bf-8655-2008039e9822", "value": "DHL 04410921 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f57d04d8-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837035, "uuid": "055193ff-b5a3-4c6e-9eb5-243127529268", "comment": "Malware payload (GuLoader)", "value": "247a5a1f5933ef09476fad1942017672", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837035, "uuid": "e685fb05-0f17-47ba-84f1-9521576dcf13", "comment": "Malware payload (GuLoader)", "value": "68ffc937e7b453f7c8cf8b5c4fda0f4ab84932cfa62004f956e357bfa02e6b9b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837035, "uuid": "3a651cb3-9ad8-4268-8388-0160725854d0", "comment": "Malware payload (GuLoader)", "value": "6a43e03c579d26400c5f86d7fc99b3a30b886531", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837035, "uuid": "b46c6f0d-7198-4346-8dcb-f9396e7c17e2", "comment": "Malware payload (GuLoader)", "value": "0395f54dac7dca13834a455f4a7d6d3c076a8152692b8400417b63ae47291c45efbe8002cb877545d91841c492f254bf", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837035, "uuid": "dd715abc-cebd-4c54-af2a-a8e058241aa1", "value": "T15DB4F16EBD53CC44DA4B187295B8E67984E8BE016F9C9603F2C21FDB7772C08B50A532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837035, "uuid": "91916cbd-d65a-4bc3-a120-d0975bb78b9b", "value": "93dfc16ed07ebeb5b405221f10d12c0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837035, "uuid": "0bb68bab-febf-409f-9004-0931993f3f4c", "value": "12288:oS2dnErpbwb05ql42qevFw3zGZTPPpl2E1s5ud:L2dE1b405qlfqiw3zGZT3pl2osM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837035, "uuid": "f925c613-8b58-4db3-9a18-a84aca5b076e", "value": 526385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837035, "uuid": "a3d10a97-ee19-499c-bfc3-6d17326aa47c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837035, "uuid": "1fa453d2-270b-41f6-af67-c7a40dc493c9", "value": "DHL Booking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450ed50a-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834592, "uuid": "0159ab46-037d-4f38-85a4-34897d0b0769", "comment": "Malware payload (Mirai)", "value": "8826e63957c1b01af4863d3e3b0e753d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834592, "uuid": "4482cff1-882b-4421-aa6b-320beb2eb5b5", "comment": "Malware payload (Mirai)", "value": "6a7254b853016b6b1aeac4a2fa1c6f331dd9cee71412197124814dc032524c48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834592, "uuid": "38cc3683-7413-4f20-b2b5-bf0cb38ed029", "comment": "Malware payload (Mirai)", "value": "abc0a06e446875539f86e304c309998ae31449c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834592, "uuid": "436635d5-87e2-4076-bad0-7c8a52ead2a8", "comment": "Malware payload (Mirai)", "value": "2ee74f8bbde059b97cbd9e6c5e366fe6b5401caed96c39f558b347be9d0740d7bf2524e85c65e60f6fbd67a89a5bff40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834592, "uuid": "9b6d066f-9535-465f-a6fb-17598e234fcc", "value": "T1B243074179929623C6E423BFFA6E018E332623A8D2DF722BDC215F51378A91F0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834592, "uuid": "8058b745-494f-4403-8971-2399c3149f4c", "value": "768:lt0oDd8sAt+v2MizNAuhLApmJdrPUN0ZQD2EF2tNm5oZOGR6YpNJmWko0F/NPiFb:ZD2sAttuEJdrrZQ6Hm5UOGzmWOcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834592, "uuid": "c5f53382-1480-47f8-b71b-c87c49acdb7c", "value": 58436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834592, "uuid": "96bc13ba-3bfb-45a1-805c-0545e8aef779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834592, "uuid": "ac1139d6-f89a-4dd3-827f-f962e7ff33f3", "value": "8826e63957c1b01af4863d3e3b0e753d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21552939-e58e-11ee-a120-42010a9c002e", "comment": "Malware payload (Stop)", "timestamp": 1710810910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710810910, "uuid": "b03fd1bc-29d6-4e60-aa64-1911754e76d0", "comment": "Malware payload (Stop)", "value": "d719fb3907f47d91d33b86497eb07d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710810910, "uuid": "87c1a4a2-bd79-40e3-8f75-defda4ab7f11", "comment": "Malware payload (Stop)", "value": "6aca49f129d7eb89f198149671cfa552ddfbbc5dc40039dbadadcb7158431d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710810910, "uuid": "0d0e8a82-cfce-4441-b54f-33de23d46f9e", "comment": "Malware payload (Stop)", "value": "6fbcbedeb4346d742b99fca9aa2cf0738f19ca77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710810910, "uuid": "19ba3756-3f6e-4d15-92b1-794723c10deb", "comment": "Malware payload (Stop)", "value": "221d49fd3c0677eb9b75439f0aebd76da56ddec883638da5bce08218e2c698097b09d4b1e4b0b00fdcdb8194dd858323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710810910, "uuid": "3c13e485-8a85-41e4-92d9-8cdc6f20e7aa", "value": "T1E905F05375E1EC61E15243350E2CABED6B3EFC669DA54B9332943F0F28302A1DA63761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710810910, "uuid": "06e0237f-6b36-4a08-9343-1dcec1c34149", "value": "48a41026330940883e631637d6182ed1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710810910, "uuid": "ce5bd718-e25c-4650-940c-187a193ede45", "value": "12288:/hUA8ilQsk3LARKULCAhqJehiK7iPsVi8QjDxOTEyJl+7pZgwrjy6g0kbvFE:T8PsGETL9Q47mjNOTEoovLrsvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710810910, "uuid": "c69849d6-845d-4162-8398-969c340e5d9c", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710810910, "uuid": "d41a86e0-c7ae-4f0c-bb50-fd1b08f9b2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710810910, "uuid": "c98ee39a-460a-48f6-83a3-ca4fcf0179bc", "value": "d719fb3907f47d91d33b86497eb07d88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057bcb9e-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837062, "uuid": "903c9568-d660-4ab0-907a-7cc4f446d64a", "comment": "Malware payload (GuLoader)", "value": "807ab2044eb4c9be0aae827cef21dbe9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837062, "uuid": "f98dc568-ebde-4ec5-8380-cf33c937a84f", "comment": "Malware payload (GuLoader)", "value": "6b3541fd675b6b9b1ab2450e632e54e8b950975a807e74f0e1e0d87563c9aca7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837062, "uuid": "3aed0d89-e66e-4915-95d2-3ac270edc8f2", "comment": "Malware payload (GuLoader)", "value": "afe94f9dfdc9d6cdad94ebb8c6fec4dd17ff2ec2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837062, "uuid": "63ed1774-9e40-4513-a705-819e4ad1ee54", "comment": "Malware payload (GuLoader)", "value": "319f68bf8d034c3392a040e7c2d1132f6cce126ffea738708cc87576cbd35562d3760524375249db0dbc11da4c5187a3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837062, "uuid": "313cb831-fa37-41f3-8ae8-d028035cf9af", "value": "T1F7425BFAD8030623890E53D6F196C44184BD10CFFD2904297DDA573CA1B3C98A39AC8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837062, "uuid": "ba7d1435-2102-4e42-880b-692bb33311bb", "value": "192:nLB+BSKoP0h+G4cszTHlyNWioYJ+dXhnlbp/Iu5YQioN1ytucyoS6AK2mFAt:kSwh+oszTHvYAZBSQJ4rS6BM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837062, "uuid": "048ea5fa-704d-496a-b0fa-32d4e08b141c", "value": 12033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837062, "uuid": "d644a89e-8c97-469f-bbb1-e6bdb5fa680d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837062, "uuid": "56f464db-f168-47b8-983c-5ef21c2b30c3", "value": "Budgetterede.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cf3d92-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834999, "uuid": "46375f89-5d99-4419-89d6-1d920e0d33d9", "comment": "Malware payload (Mirai)", "value": "8c48a472f35912ca073f97cd81fe1cc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834999, "uuid": "50c07fb8-43df-4777-8d5d-c06bf7204ef7", "comment": "Malware payload (Mirai)", "value": "6b5b0cb0b8566b6ea62999268cf729e5181656bae7a9763bb7728b0e8c3b4a80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834999, "uuid": "ee619ab5-36f0-4a20-90f2-a674951527f7", "comment": "Malware payload (Mirai)", "value": "be13569baa340e6b4789efb9a8deba503b811fdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834999, "uuid": "a1d8dece-5dee-49db-8cb6-05045dddbefd", "comment": "Malware payload (Mirai)", "value": "8931484cda1a512a134668ad662d0b9e61f255b6fa6f0efb19b4d7473476598d739797d3e8435ce2dde4c1337249e2c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834999, "uuid": "ff8dbc7e-5a2c-4e7e-aab4-899cff3bd2cf", "value": "T1F323D6817942A62BC2E423BEFAAE418E336173E8C2DF322BC8215B55778551F0D77B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834999, "uuid": "f6b9977d-9574-4d73-b607-c77cde284c43", "value": "768:EzNrZV/TLLJgXvPuaMTnwZvYDK1jQYVQ9Gd7aDH5KDO8rDGhFuOxloZgG0YZ/8NZ:YHLyvPu39GBaD8S8rKqOxlUgGPOk7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834999, "uuid": "1890bec1-a6be-4de0-87b7-58babdc5d901", "value": 49412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834999, "uuid": "3e3052a4-e9b8-48cb-aefc-9fcdd33b23e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834999, "uuid": "20989962-a608-4e7a-8479-e1b7d74800a7", "value": "8c48a472f35912ca073f97cd81fe1cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8dc31d-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710836784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836784, "uuid": "da03a988-39ae-4964-ad0b-49a51d3c220b", "comment": "Malware payload (PureLogStealer)", "value": "790d4950a2fca3ded5a3c389849963a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836784, "uuid": "fc87b288-9606-465f-bcd6-b5bdc0bf0c8a", "comment": "Malware payload (PureLogStealer)", "value": "6bbff8dfbb00bd3bbfb5d01061eace7284e9f52b2677dab989db304da953a74a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836784, "uuid": "8a45dfe5-c7ca-4073-bb14-6bd060e9fb70", "comment": "Malware payload (PureLogStealer)", "value": "5fd3ce0258cd67c531c21aadf5cd582ffec5cb69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836784, "uuid": "a26a6c0a-8151-4c0c-a21d-6b15f337c613", "comment": "Malware payload (PureLogStealer)", "value": "d259df81187eb975b0b326fe177681f4ad29e849b6646d0541cad1d72ce27d5207719b2ed84f9e608851af40be409172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836784, "uuid": "82a49798-7120-4d21-a1b8-9a1dd4124596", "value": "T1F7942304A638DE7CCFAD127DA857428EB3745E029B97C36918D0E9435BFA3954FE10B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836784, "uuid": "b3139294-23cd-45d2-8bf0-7eecc41c38de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836784, "uuid": "2fa55ea7-9fda-4e55-8273-7ad52d787695", "value": "12288:S8kPNM0pmy/9delbEt//4ki5fnRk/DmbnmTX5:Sj1Mhy/90lbES5VRkqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836784, "uuid": "aaf416a5-9730-48a3-9ce9-998276504910", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836784, "uuid": "9eff6dcb-fe69-4ac9-92e4-262b65d9a085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836784, "uuid": "e88cb541-f572-43dd-8089-8babfae482d6", "value": "790d4950a2fca3ded5a3c389849963a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977445ea-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710840314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840314, "uuid": "7ddcefba-de17-4de6-a662-59dbc39297ef", "comment": "Malware payload (RiseProStealer)", "value": "24f4955e8d3ae76e7f1ec9cd9eaa88b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840314, "uuid": "a3a6e785-a57c-44db-8d80-74f0909677a4", "comment": "Malware payload (RiseProStealer)", "value": "7072ab5130e9363ddd1113da878eaf0ccd401baa90a3386af361139bf217d6a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840314, "uuid": "1fd68576-ac21-442e-9b56-1405970f2ce3", "comment": "Malware payload (RiseProStealer)", "value": "210cfd3be83e0cf02af89387608a89c12b332445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840314, "uuid": "52c86fbb-c5b0-45d8-9682-fa46c1316c30", "comment": "Malware payload (RiseProStealer)", "value": "cc62f7021d76a0ae20b68e8d7e0c20de99548a8a6deb5332acec64572692c3bd70212596002b8f9ae7e5daed5037ab26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840314, "uuid": "086bbe3d-9984-4f7b-b231-b59d11d31c1d", "value": "T1A5A533D7C55A4DDAC85140BF47D4FA092F3388B66BA2CDDD281F53A42E6861E23C872D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840314, "uuid": "b1908f3b-0982-4573-9cba-7e72f55ff183", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840314, "uuid": "41409e80-c837-4f6d-a85a-809b4b563cf6", "value": "49152:X7x9bpL0mfNlL3QKXTBsBA5WGiyURGtCQ2X:LzbpLBllLgKjBK7yUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840314, "uuid": "5304d47b-467d-448c-a806-022e0f8da164", "value": 2126336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840314, "uuid": "cb128c79-5ffe-4262-b017-86abfa31ad3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840314, "uuid": "d6ecefe4-be73-4934-85f9-ab4877a63e40", "value": "24f4955e8d3ae76e7f1ec9cd9eaa88b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65de0af2-e60f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866430, "uuid": "47e01b98-6425-4ea0-9366-719caeca0c8a", "comment": "Malware payload (Mirai)", "value": "451d3e272150de7a2befb44d85cb9f64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866430, "uuid": "9f5a408c-fd5e-49a2-abbd-f4f72eb9e21f", "comment": "Malware payload (Mirai)", "value": "720c38a57fc6cda08025a38ea4fd098e208674ba39e3789cfd2a911c2f73a5f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866430, "uuid": "603039c5-7c11-4aae-89ba-6f5be98a303d", "comment": "Malware payload (Mirai)", "value": "aa38327545eea22bffb8e99b6375ef64ceb02f36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866430, "uuid": "6470c936-d7b0-4db5-8b3b-2e79af3b6d2d", "comment": "Malware payload (Mirai)", "value": "91ca59c1be3c102d8c226d7cb464794db6e4974ab68c311c5e3c78c40749566501131c9771f2a3ded5f9f28270cce5e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866430, "uuid": "e16bb7ca-9887-4e1b-acc9-5fc53f0a6778", "value": "T10682BFF3B44B5D3ECE0493367726952957889451C7BF637BAE8CC406208B2DA2D25DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866430, "uuid": "703ff4f5-3946-447f-8d0b-1b5bf45bade1", "value": "384:MyNQUwazRvact+ayWZ6wYZ+dvYc6avp16ViW6+MdZNq5klhMvmP3yG:dRSclXtYKH546+MdZEyumqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866430, "uuid": "14e7d5dc-8304-4976-a15f-6fdb5bd59547", "value": 18200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866430, "uuid": "0852f278-5d96-47c6-99ad-800045320e3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866430, "uuid": "1e01bea1-12bc-4e59-8db6-427f988164a8", "value": "451d3e272150de7a2befb44d85cb9f64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6041bf77-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710836785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836785, "uuid": "a3abe416-fee1-41e5-8c79-eb17a345171e", "comment": "Malware payload (AgentTesla)", "value": "28d1e626e9dd2fcd9d4e2bc2210f62ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836785, "uuid": "14401037-6077-458d-98b6-ba3e065c405b", "comment": "Malware payload (AgentTesla)", "value": "721193d75a79678d8d5803eb53e715a469317e8d860eead6d873154e80820d74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836785, "uuid": "640b2e37-ce1e-4321-93f0-9278741b3193", "comment": "Malware payload (AgentTesla)", "value": "47e81fce5a214e87745df493784adbdcbb88f7e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836785, "uuid": "c6ae9ecd-2f82-4013-9c91-a9e9a7c98e83", "comment": "Malware payload (AgentTesla)", "value": "a93ec4b1ab4ec9344fc9cf305aadbf7c960d608c2e08ae8c5ab0e4b05d0eaa6cf235ddb736118820c2b09445cbf1bfc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836785, "uuid": "e4eb903e-544f-4dff-840c-f871f21e9644", "value": "T193149B2DD34B01598F520377AB1B1E5142BDBB6EF38552B5346C433933EAC39A1262BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836785, "uuid": "d705966b-4bcc-48dc-a444-68da164f8856", "value": "1536:LwAlRkwAlRkwAlR7+diS8CPFIfiUGWHWj:LwAlawAlawAl8di3wFIfGWHWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836785, "uuid": "f0384bb7-bb61-42b1-9fea-04a4d49fccef", "value": 197625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836785, "uuid": "13c0e8ba-990b-46e8-bd23-04dc89abbc49", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836785, "uuid": "2c4d3bc1-8d4a-4cc1-b8b7-43a888e1f8a4", "value": "PAYMENT ERROR.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fe78cd-e59b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710816857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710816857, "uuid": "7c17d8dd-cf43-43f1-b28f-cf1c94afe062", "comment": "Malware payload", "value": "1ce7d5a1566c8c449d0f6772a8c27900", "object_relation": "md5", "Tag": [ { "name": "1", "colour": "#4151BA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710816857, "uuid": "c3a6168a-12ec-4232-8cce-0c8c57c7e9cd", "comment": "Malware payload", "value": "73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf", "object_relation": "sha256", "Tag": [ { "name": "1", "colour": "#4151BA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710816857, "uuid": "bcde6f94-cfba-4c0d-803f-5a0c49b20a70", "comment": "Malware payload", "value": "60854185f6338e1bfc7497fd41aa44c5c00d8f85", "object_relation": "sha1", "Tag": [ { "name": "1", "colour": "#4151BA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710816857, "uuid": "35de24aa-433b-4fde-bf1b-ed9e460771ba", "comment": "Malware payload", "value": "3b3296296352456b3772e9144b05f31a0c802990dd341746401a32478e6d006f7880fd388bd3f03ff1e3ffc424466f20", "object_relation": "sha3-384", "Tag": [ { "name": "1", "colour": "#4151BA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710816857, "uuid": "d1ab75a4-474c-4325-ae71-a4160c2bad41", "value": "T1F784AE11F48180B1E4BE057439B9BE6649BCAD11072896EBD7E80C2F5E746D1B733BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710816857, "uuid": "0ef89efb-c9a2-4e33-87b6-2f491a8da42b", "value": "18a9672c82a5e7523b8185670465b54e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710816857, "uuid": "e7fe882e-22a6-4bf1-a7de-7c7b10bd40f7", "value": "6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710816857, "uuid": "10e3230c-5b03-4511-b963-eaf3672e4a8f", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710816857, "uuid": "39625f75-c19f-4a96-bb6a-e3651b8f4201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710816857, "uuid": "6431036d-0a02-42b1-aac8-d3465ef8ac11", "value": "gcapi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa1e30e-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710854358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854358, "uuid": "922fafd3-376e-403d-917d-a268e03829db", "comment": "Malware payload (RemcosRAT)", "value": "190289d0ddede637f0ac6f3782cec3a3", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854358, "uuid": "014d091e-54ee-4333-8087-bd6067544e38", "comment": "Malware payload (RemcosRAT)", "value": "7530a6c1b0af5633319393a4658cccbe0f098b61ace0eb8c19f9d54201dca1ad", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854358, "uuid": "4b6f8128-5bd1-4ec2-9bd4-f25b93ac4d0d", "comment": "Malware payload (RemcosRAT)", "value": "8369635c92be1a222ea3683ef768b91865d57400", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854358, "uuid": "27b24622-15b2-4c38-9810-3ed3072c8c5c", "comment": "Malware payload (RemcosRAT)", "value": "7a974e44849316d52d482d341d543fb0fc5e127afa47125bc233bea32c5db151326655b99aeba360ab6cff090926d091", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854358, "uuid": "32edbb05-22a3-41f4-b91e-bc4a2a604c25", "value": "T10295E0F7A4A10477E23601349C4B74D4A425FE732E7435C62EAE7A4C9FB83913A69363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854358, "uuid": "d11590fe-d0e2-45f7-9f31-82f88e960d6c", "value": "24576:d16ftUKJqekypS2EBJYewl7+6izHE+lsx4sAXsd1AqVjxW7RXtLgiED+enxbIl:dAfgQvslHE+l4wgmNdtECebIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854358, "uuid": "24e7d287-4381-4db4-bd39-a18981cc09b7", "value": 2031616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854358, "uuid": "3c255590-59fd-4886-b708-e6e1b4295404", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854358, "uuid": "df4aa9ec-f932-4c7f-a62f-28eeee48d076", "value": "nMACHINE SPECIFICATIONS.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7315e63-e5d3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710840770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840770, "uuid": "23039afe-4be5-41fb-813d-879c27a72bb1", "comment": "Malware payload (Formbook)", "value": "8ceb39273e909637b997dfa6d05ae618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840770, "uuid": "904bd9a4-291c-4a25-849d-81d39aed8ae1", "comment": "Malware payload (Formbook)", "value": "789fabbbfa7aee3dcb77932312bb7a4a8facae1327dfd834c966ebb5aa7aea65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840770, "uuid": "6b1a1ea1-a9ff-45f5-a7f5-6adbe2732389", "comment": "Malware payload (Formbook)", "value": "9bfe24f8fa060fdd447cb1bd5c32d1318974f64d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840770, "uuid": "31c5adcc-4c27-4819-95b2-5cebbd9e1bfd", "comment": "Malware payload (Formbook)", "value": "7e7361b5b891205a59ccaa7b6b2cb53f00baed1fb91aa7090d48f2c30fcee28ca0faf2fdbb3ad553ef97a54670a3e450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840770, "uuid": "8a70f7cb-631d-479d-8193-e6d986d7e25e", "value": "T1C6E4235ADC9D62E7CF6A8AFC18D52B60E2E44427F8D5EB496C00A8E739D73D00443779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840770, "uuid": "8b17e32b-9552-4e05-bdc2-18cec33fb767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840770, "uuid": "b548d52d-2104-4f48-ae77-05eb86df0117", "value": "12288:bdujpteUPkPpo6WF4EoruL6d+Qc2Y02KmKMSQm0359aKDTMBbOOJRYWq:4jLNkPpoaEo38kVXVMSfu5HkOOJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840770, "uuid": "0f7ebdf5-d75a-4132-aefc-06ec1cdc1780", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840770, "uuid": "517512cd-8801-46d4-853d-14853d976907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840770, "uuid": "9875e4d4-41e9-4505-a847-675085004a19", "value": "SecuriteInfo.com.Heur.21813.17790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d690ecf3-e5cc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710837843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837843, "uuid": "4439acf7-0b45-47a5-8b29-c8b8ac199599", "comment": "Malware payload", "value": "14a623ff8e460b9c66ada3ac8c46ced9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837843, "uuid": "a5df6bd6-2d6d-4601-8810-81da620adeaa", "comment": "Malware payload", "value": "78f0a7a59e4ebee326f0630f21f6d13b1ba7b9e7bc6e90fa9547d06ec7e39b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837843, "uuid": "ff5ee5ff-674c-462a-be22-1c92d237e9ac", "comment": "Malware payload", "value": "e02b11784403322b391b2c68b80c67331669396e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837843, "uuid": "f7e29fc3-3ed1-4738-bdc0-723fcfacbfce", "comment": "Malware payload", "value": "4d2a2e772e0ea0514b2a2e88c91f31e4ba5e87d69aba7cbda4192785a26163f4d21ae82ef216c0eb7da168b14c28cfe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837843, "uuid": "b0cbdc49-62e6-4d05-a649-a6b06d675010", "value": "T1FA37BE01B3E841A9E5BBC27885665637DBB17C150730D7CF1694EA691F33BD0AE3A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837843, "uuid": "fe812560-e646-4434-a883-a38a6810da24", "value": "b819c89ac9b569d0bbb77889674017b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837843, "uuid": "c803563e-f2fb-4479-aeb1-7c3a4b31f145", "value": "393216:+G251FGAsxevRZx3Iev6xALRadLxlkux8Ei++90R5X:+D1Ftx3exl8H++90nX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837843, "uuid": "bcc687cf-77c0-4b6b-b666-c656f2d746a8", "value": 23771662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837843, "uuid": "3a5b67a7-28d3-4a6a-9060-eec9f479fb13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837843, "uuid": "c66727be-fed2-469b-80d4-da7b0594b557", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.107313.10364.21294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b7feb6-e5b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710826005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826005, "uuid": "a8e31207-1d54-4b1d-bf1e-a739f88d1c7e", "comment": "Malware payload (Mirai)", "value": "e3fc1c1f530cc1b08d90d391555bfd29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826005, "uuid": "91e32f6f-4ef1-44e5-a56f-4a53341750db", "comment": "Malware payload (Mirai)", "value": "79501fa5517b50fb697cd452e46724b470013c9091536daf0c34fd735bdc71b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826005, "uuid": "c944882e-5185-47b7-bb7b-8e305f363932", "comment": "Malware payload (Mirai)", "value": "19a55c63e1ced29506c5b78ffd4bf7168418b72a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826005, "uuid": "418fda0e-d12a-41ce-8dbc-59072f67f2f7", "comment": "Malware payload (Mirai)", "value": "a1cf3d33cd929094c0d526158a9b99cd6aa9e534104ae0ec07db3b647776f53ff91818eebb44b72293c3c31f9f145748", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826005, "uuid": "ea2faebe-c6cd-4a31-9f9d-d512f25e92bd", "value": "T1D0E32ADBF800DDFAF80AE3374853080AB530B7E155925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826005, "uuid": "64ff2a07-729e-43c3-99f1-3fa45c4717d4", "value": "3072:HRsZAhhrvKPRq05NDAw3CMlI9Vrjbi7LLhQ06ysgdYC:xsRZ5BAwdlI8LLhqys+YC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710826005, "uuid": "70a34869-aeff-4ce3-a6b6-a3286da8a87f", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710826005, "uuid": "0d2be708-dbff-42fc-81c1-abd6d2598dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826005, "uuid": "0cff0472-505d-4e16-9d12-faee1ff502e9", "value": "e3fc1c1f530cc1b08d90d391555bfd29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd5536a-e5c1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710833023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833023, "uuid": "a60d7362-94d9-4c36-820c-e15522629d1e", "comment": "Malware payload", "value": "90fc55601210f8ecfa52637f7e8ed43c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833023, "uuid": "a5662f66-413b-436a-86af-88c2f0e22278", "comment": "Malware payload", "value": "7950a9e19e2710e575095c73143a2e90d33fe8ada97c6ce908e27d54aa2775b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833023, "uuid": "07043ce3-e7bb-4a37-bc09-dc53797776fb", "comment": "Malware payload", "value": "f9f180cba05cb8c9359c0dc6f629cf3a79146eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710833023, "uuid": "536ba3d5-ec88-4d2e-82bd-127bc6a3501e", "comment": "Malware payload", "value": "9d0f1d2b0c6f95ee3c4856f3c70a2a248dcb27a6513c3be599d927b8eae0442b6400b33ff8f0c92180ee89e4d343f2a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833023, "uuid": "0253671f-eab3-4e8a-9c31-0f6de5466c2a", "value": "T1C6B633CB6F6CBC64E5465CB01E02D8A121E96B06A8BCECB190DDA5DC7F6F30653163E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833023, "uuid": "6f9ab90e-a4c5-4a27-aa67-934cc7a1c2ee", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833023, "uuid": "d83ebb1d-bfb3-4b60-93c9-78e25117fc97", "value": "196608:wZ7WNduHZiC5OWnfoSmpwwP7ywy2Tl/sl0sBAoo5ghr/tJis4SP5O:Q7WruFOWfoSmp3WPA/WBdxHTPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710833023, "uuid": "49683717-b77a-43e3-bf10-8c885dcc701c", "value": 10425824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710833023, "uuid": "c279983b-5133-46d7-a878-742a7db52ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710833023, "uuid": "1cb89fb7-abb3-4487-84b8-332a0556957a", "value": "SecuriteInfo.com.Trojan.Fakealert.57879.1872.2251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63eeb82-e5f2-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710854109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854109, "uuid": "8970089f-9ab4-4309-bc9c-d89931079ea7", "comment": "Malware payload (RiseProStealer)", "value": "897f4d8b08511001cdf8b89bfb550490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854109, "uuid": "5400f38a-ffea-4a54-a156-e4fb76366a0f", "comment": "Malware payload (RiseProStealer)", "value": "7a410ea5ba07d756ef3114466cad99a49f71b433a1080c8c8fdf4c3f196a84f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854109, "uuid": "b96566bb-00b0-476d-bbb6-2f0d1280ddaf", "comment": "Malware payload (RiseProStealer)", "value": "0af9592867c8e80e4a7d995a309c2c4853eae0ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854109, "uuid": "573fd3b4-5112-44c3-9bc2-74d3d557076e", "comment": "Malware payload (RiseProStealer)", "value": "5e8dcba0444c57dc68cf26f06df458210465d40447801ec04fa25dc12df803fc6484ac2bcff9bacc0435d29b2d7170a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854109, "uuid": "a4bb436d-9d0d-4486-b6d1-1c5c3b41a5bd", "value": "T107A533C17D11C42AD89E00370EE9BB5ABA96F4667254C0F8A18FBF2F7E79E5D5380480", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854109, "uuid": "3983f180-e55e-41b4-9c6a-9dcd0f455814", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854109, "uuid": "a091db22-31e4-47c9-b39f-8ae835a2fa7c", "value": "49152:J7x9bpL0FkRHpAbdvX7hhObuXPnhtyKQRj:ZzbpLm4JAJrRPDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854109, "uuid": "a45e7ec3-e68f-42b2-bf5f-c9cb05aca256", "value": 2088960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854109, "uuid": "ca19d7a0-0615-438b-bdce-a31155f493c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854109, "uuid": "686d6cc7-798a-49c0-912a-ca355b8b5ca8", "value": "897f4d8b08511001cdf8b89bfb550490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464dee9e-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710835024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835024, "uuid": "e3a2b49a-52e2-48ba-9d4b-aac373c6e8b9", "comment": "Malware payload (Gafgyt)", "value": "09270c938224f658a1820a2fbf213b32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835024, "uuid": "a3b6ad7b-4901-47dc-ad16-87d0f26d438d", "comment": "Malware payload (Gafgyt)", "value": "7a97a3282820dab8f7e50d27799de49ce669f246e9d85848ca3934aef2c7241b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835024, "uuid": "08c0f674-8f28-4074-86b2-ec3dbbf4a06a", "comment": "Malware payload (Gafgyt)", "value": "c8ab1ac8ab7f0e3a542344eb4ec14fc9946f4708", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835024, "uuid": "c6966e7c-88d5-4e28-bb92-ca5fb272d0de", "comment": "Malware payload (Gafgyt)", "value": "d752a40245a2ebc10ab93c761891f0c37190ec315aad1b148f2a3e4d27e2514f7d7f99d21a6e2ed421ed36b73a9af182", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835024, "uuid": "0918a7dc-05e0-473e-9785-5871cb3241eb", "value": "T15B244C24E5404B57C2E323F9AA8E428E3B3247E573D773154A389BB43FC2B9A1D71925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835024, "uuid": "9f8c131c-c8d3-408f-9f00-bd580eb26346", "value": "6144:FZzyacCwXJ4DbpW0vI5hbL6+uM/9Ocgym0wfB5RyAn:FZzyacCwXJ4gP5hbvf/dgym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835024, "uuid": "461cec9d-a0d5-404d-bb41-ac8623672f0d", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835024, "uuid": "723e59a0-5fce-4a13-a461-20465062f50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835024, "uuid": "9641ca0e-01a6-4ec5-8812-48309a594f42", "value": "09270c938224f658a1820a2fbf213b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89c0f76-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837014, "uuid": "1204a19c-3e40-4c96-93d2-02ee5e4e0e47", "comment": "Malware payload (AgentTesla)", "value": "6f6c752642671dcb19dd46c635ba7010", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837014, "uuid": "84f21323-a4d9-496d-81a5-f0a0a9aa79a0", "comment": "Malware payload (AgentTesla)", "value": "7ab78e7d259ab104796723c7246268165dea4e0b3fe7dd377a55a51108710030", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837014, "uuid": "835559cc-5734-4e7b-8460-d6c06888f650", "comment": "Malware payload (AgentTesla)", "value": "09283babfeaedb5755db2b9086b211d2eeecc0d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837014, "uuid": "770f6306-eaf3-490a-b7be-158ca4cd37cf", "comment": "Malware payload (AgentTesla)", "value": "8bf5d38922a31564504b3cc39959d3a93a5ff77e5199c2ca65a6e67ec82d97a071b45a151aaf16cbbeab7598e1e5b381", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837014, "uuid": "a3833da1-951e-4e29-9893-3922511c6ce3", "value": "T1DCD4230476E45323C0ED5FF6AAB1C24017FE265B6C22E3594E5608DF2BE2F64C192B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837014, "uuid": "4e8e530b-e351-4365-a2c4-607587fc89ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837014, "uuid": "1d5590cc-072f-44cd-b274-4a43e6e8d5b1", "value": "12288:O7gRhUApwZWKFuVud+ERJ153jpdxNVvgje5Muyv54V64Uf2gMV4mDc2Pu:O8PwwAdfpjpN6hv54ATvM2QG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837014, "uuid": "5fd32a0c-a65d-4638-a3c3-9a2cb26c0af1", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837014, "uuid": "ba6593a1-344b-44cf-b5ac-f6b73d7b3891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837014, "uuid": "db919b69-931a-4d87-8610-0efb87d8f66d", "value": "DHL9407155789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a05db9-e5fc-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1710858318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710858318, "uuid": "c25247fd-04bd-474c-8fe7-ef64063c982b", "comment": "Malware payload (XWorm)", "value": "35dfa84709482403fae73333eaa0f4be", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710858318, "uuid": "8e827673-8cd9-45a7-bf6d-2afbc1d1540f", "comment": "Malware payload (XWorm)", "value": "7b768394fa0869d92f872eb486f49fabd6469ef3a8fd8bdf9cb49d35b39ea73b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710858318, "uuid": "f046058e-f6e8-4b6a-af0b-7eae7a3e8b5c", "comment": "Malware payload (XWorm)", "value": "636d1ae335692e547fa65ecff198d853ea9ce083", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710858318, "uuid": "e588e9ac-a1a4-4715-9efa-0a7cbd356eac", "comment": "Malware payload (XWorm)", "value": "3b1a5ffb5bac721dc1899d483fcf3e3a96b591ffb9a6395965169e4541431120a7eafce944b2bf957c0803da7a1929fb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710858318, "uuid": "37c76ecf-e267-4c54-a4cf-b267e4631d5f", "value": "T1AB538A2EE74F0915DF55977B034A4B4A05FCB33DB28140A179BC97343BAD82E4A628BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710858318, "uuid": "d11b3164-5993-4324-81e7-d56cf5dbbea8", "value": "1536:rupF0AsOgrfO0HFO6nVZJQnq3QEowpt85aXFlgYUKhXmjjx6lW:iEAsOgrfO0o6fvQEdpe8XFlgYUKhWjjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710858318, "uuid": "33c869e3-e708-449a-8e75-25a638e8efef", "value": 66496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710858318, "uuid": "32d90814-5f4e-45b4-9c36-9908320c5295", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710858318, "uuid": "e91c8736-dccd-40b3-a929-4c3f8937a5e9", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.32.28597.30591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d305bd2-e5b0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710825479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710825479, "uuid": "3edaed22-d400-4a2a-b18f-f782c027ca24", "comment": "Malware payload", "value": "30a6f7d32afab50730fe7f8d9d2b1ba0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710825479, "uuid": "f5a7935d-622e-4494-9193-8cb57a233216", "comment": "Malware payload", "value": "7ce698f6f1790066a5b890c1e55d00355f451d712e8bd3115ae1f31b1e7064ec", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710825479, "uuid": "432e098d-f235-416a-b2f1-e6c45a4dc083", "comment": "Malware payload", "value": "dc2a7c80177f299cf8153d44b49700822410dd35", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710825479, "uuid": "cbd9529a-8c7a-4ac7-9313-09d6bf10a4e7", "comment": "Malware payload", "value": "95fc4e2724f6f6833af295d24214bc8e17d2555b15bd04f08f9c28b7c77e049c944868d34b65a6fbfd7dd4848cc2a88b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710825479, "uuid": "29926d1e-8d90-459b-896c-e1dcb8558ed1", "value": "T10CE73321F595B437ED2E58731972873D06A5BC200D30882B7FE476FE2DB2A817631AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710825479, "uuid": "1c32e16e-4c42-47e7-8dcc-912f42758d06", "value": "1572864:RLfZlKmjl9ah31EZLz6Cgnx0m/cgIBMB8nut5Df+:F/Jl9G31cn6CgTZ+MB8nuttf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710825479, "uuid": "b4a4f87e-aa59-4fc4-a52e-ab849b4d8b09", "value": 66485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710825479, "uuid": "45c6cc7f-b764-410f-82af-e888fbfd26fd", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710825479, "uuid": "8200db20-49af-4130-ae86-00fe0c5b8617", "value": "SecuriteInfo.com.Win32.Dropper-OYI.24950.8180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f936abec-e5e2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710847350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847350, "uuid": "e72eea3a-7ebc-41c2-8a5a-a11384c4e055", "comment": "Malware payload (AgentTesla)", "value": "cbf4f55d72768ab66a8aa6e5a95d7ba2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847350, "uuid": "c6d729f7-874a-4873-893d-9f18ffee59fe", "comment": "Malware payload (AgentTesla)", "value": "7cf17555838483a995b9ecb9b44a200462800dc7e20020c8f59b947f70e786cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847350, "uuid": "be6181c0-7874-409f-b404-574fedbd207d", "comment": "Malware payload (AgentTesla)", "value": "e23bf26511c8a2171ee9daf6598ddbdf56368602", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847350, "uuid": "012c8ffe-7e93-4ad7-83f9-657b7c23ca5b", "comment": "Malware payload (AgentTesla)", "value": "0b5440b41fa584be330b7e778c6bbfb959bd0b62b93ad60f07efc1382e3fa1eeaa5891147efd0b433707ccc1469a3f76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847350, "uuid": "c090c8fb-b78d-476b-9d6c-4d14ff277509", "value": "T1754507E2DAC52A18CA462AB3EC5707734DB4415D37232F35ABBCC28D614395886BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847350, "uuid": "1c0d43a7-3d3f-4270-89a6-de98322c9f1e", "value": "6144:Iu4yENVOY0NpVXpK68kH3DPbkhZi3eNRE49mheV4pBm:TPZTYs+4bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710847350, "uuid": "de26db1c-de92-439b-ac06-c99e4596fb72", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710847350, "uuid": "049b54e1-6a0d-4a60-a28b-8112a261e84b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847350, "uuid": "26889a7f-9f8d-4ba3-9d07-bc9a2481f509", "value": "TT-Copy Chip 1 Exchange GmbH & Co. KG.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aed6595-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837071, "uuid": "e5f9dc9d-5850-4312-a812-a1b2bd8c293b", "comment": "Malware payload (AgentTesla)", "value": "49caa65eec81a698321bff9178f4d0ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837071, "uuid": "cafec35d-0457-4c99-b133-03e79d0cb8d6", "comment": "Malware payload (AgentTesla)", "value": "7d2ae8fd359c02f8cdf9f1b389c3d0dc85a627dac52ee4ecba78cfc55b693ab3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837071, "uuid": "fd0bb941-e28f-4e98-b27c-873fecdced95", "comment": "Malware payload (AgentTesla)", "value": "30ab954ae827b523bdc6c5b0fca27a665cba50c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837071, "uuid": "0116e75b-150a-4a2e-926f-bb8ccf5e6cfe", "comment": "Malware payload (AgentTesla)", "value": "3a96500384545bf431c0388a2ec6bb6e5239563ebb2a1f794cb4481920428838ca391aa3f1c4d882a52daaf7067dab77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837071, "uuid": "46c0cbb5-2744-4765-9468-febfd7ae66c3", "value": "T170F307D2EACA26184A861AB7EC534B734DB4409E77131E349BBDC24D604399C86BFBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837071, "uuid": "b4de3b83-1814-4802-b92d-bd597634d81d", "value": "3072:sI4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRn4OxKLkYDttMgH5+p6x+/ruf2q:sI4yENVOY0NpVXpK68kH3DPbkhZi3eNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837071, "uuid": "19c9e045-3e2e-4b1b-b0cf-f13df551de7e", "value": 172106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837071, "uuid": "f8e37811-64e8-4010-b2a8-5fd877beff9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837071, "uuid": "381aaa4d-169e-4759-b666-37b4442cb55b", "value": "Battery order-saj-polska.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c64ef77-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834658, "uuid": "744bd2e2-74b9-48e6-9f20-f12ba353e7de", "comment": "Malware payload (Mirai)", "value": "8eb61537d84f2f7e5e97bd9de8e6ba63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834658, "uuid": "0b49f0f5-2fd3-465d-b9e9-9c5e8c0b4289", "comment": "Malware payload (Mirai)", "value": "7d2bb35bf6e7f5b7358632db180cc52409bbab652c68d8cf06fa3cfd4cc96cca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834658, "uuid": "c82027bc-785e-4158-9d0e-9b25df6e7b53", "comment": "Malware payload (Mirai)", "value": "819a1c3c99d9ab712d025b4f3cceba57f259b7b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834658, "uuid": "6f2a8f98-ea5e-4df0-b3b9-8fbca38d5d8a", "comment": "Malware payload (Mirai)", "value": "c7f614cfd9a7b2091c645fc87ad03a20b9a6658481667a66b6d73b9e4ec333ef6322b9d3ed6cf0578dc56fd3d562e46a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834658, "uuid": "ef2825a2-a0b4-458b-bb4f-f5da19a39ad9", "value": "T103337C77C47A8D94D0888E74B565CAB81B03B10081A73EF76A9A8A764443FDCF61D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834658, "uuid": "129a4893-5e35-4533-86aa-565e8597072b", "value": "768:7am4kKPS9sU8yM36tClr/dmCj7p/2lDVDDrVGytJWntBmNg5Z3I6wU4yhGtEOctT:7aB6Ov36qMQqEGCMU4oaGUQCj39C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834658, "uuid": "059556a2-5c0a-439d-929a-0516f3787092", "value": 50892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834658, "uuid": "f2f5da77-07a9-4491-86c6-2f9feb3b7c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834658, "uuid": "bbdbc944-bc7e-48f6-a61f-6bed4afe7f53", "value": "8eb61537d84f2f7e5e97bd9de8e6ba63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b6f0a6-e607-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710862853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862853, "uuid": "fda67b6a-bba7-4285-a4f2-c9a439c64d16", "comment": "Malware payload (Mirai)", "value": "7f2b7dd59bca3e59ff676aa15a7412b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862853, "uuid": "1c65cae3-5945-46b7-a180-fb1013833738", "comment": "Malware payload (Mirai)", "value": "7fd9d112964864daadafbe06806bc3bee398499d48f3ee70fafda676efb66ddd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862853, "uuid": "a30f1f97-d81c-4d52-9c2a-e0c3e12467d5", "comment": "Malware payload (Mirai)", "value": "7209931708352b10dd21b85a2012b7e5320e54e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862853, "uuid": "b89506fd-0e98-4e5c-811f-7e1ea597f50b", "comment": "Malware payload (Mirai)", "value": "a417debb359071033cc8124986c9e0c9ac960cb3504a3b7d3a3aeb90b5a0b60851c06f76541fbda8024c2d571f3add2f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862853, "uuid": "1b401fa6-0a52-443c-a44b-61d453ce48a0", "value": "T132E32945FC519B27C6C212BBFB5E028D3B2A17E8D2EE72039D255F64378A85B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862853, "uuid": "2cf4ee84-c987-4de1-9ce9-412fabb472bf", "value": "3072:AZSpa6FgfHl0fFKX94y3lInKqZwZsjcYld:AZesHOwt4yynKqwsjcYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710862853, "uuid": "90ad4598-6586-4c2b-a4d2-cbc4fc0b908c", "value": 146272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710862853, "uuid": "19d45a91-f94b-4a6d-91b1-ba5aadd79979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862853, "uuid": "755dc543-2eaa-4fbe-89d8-0c613e6cf5b6", "value": "huhu.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9849da5a-e5f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710854918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854918, "uuid": "6deb5a31-882a-4c21-a4d9-e7f1efbc6756", "comment": "Malware payload (Formbook)", "value": "fe2a1da4eebfe9515ef64e0849da543e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854918, "uuid": "e3156763-6ca7-4053-8579-08488f04e6a5", "comment": "Malware payload (Formbook)", "value": "80bf4a9fa656711ecb841491d70fb6cb3696e6b23eae176c904489a382e66a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854918, "uuid": "be5e78d5-60a1-4a0f-9bee-219cf1687b0e", "comment": "Malware payload (Formbook)", "value": "f5b3b907650b61c928b564ce554faefae9a22f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854918, "uuid": "df12fadc-765d-4ac4-93cf-d692f8bcf53a", "comment": "Malware payload (Formbook)", "value": "88d7af5dc88abbc388585fef35c8b30a9e901e02b555ad67b4908543ebaaedcd24b430a9db76391ad8137c7a234b18b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854918, "uuid": "5c19466e-0e5d-49cd-92f6-464d98e83ea9", "value": "T180E4231476BCE647EDA697F412D9176263F271200B86EAD72CC460DED8F3F02425B623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854918, "uuid": "18586a30-185f-4662-923a-07ec04341445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854918, "uuid": "c8eb8d22-16a8-451d-98aa-219451e465a1", "value": "12288:nlPloOJRYWqV5IdIZmkt5Kxe66qRUgd0AgvGNS8W9E/r2tb/vsrz9F3Y1mLt+l:l9oOJb9dIZmknH61RUgdHgG08WWWXs7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854918, "uuid": "0bc9419a-8e43-48c8-8b09-5e1b9dfd7442", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854918, "uuid": "93130e6e-35e1-4b71-8b06-071b326f878f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854918, "uuid": "bd58c553-f92a-4197-979b-a58d5bc1a094", "value": "SecuriteInfo.com.Win32.PWSX-gen.260.6578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a36603-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837064, "uuid": "0baf15ec-3bc9-4340-8c3d-efbf213bd5bf", "comment": "Malware payload (GuLoader)", "value": "563fdf863028c9563262cd9e3a7f9b29", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837064, "uuid": "67626f02-1469-4b28-ae03-5851696788a9", "comment": "Malware payload (GuLoader)", "value": "811fdf7904ae24da19b8595df3fb4f3b41f08b009b582fbe8cb8e8567cc5c77b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837064, "uuid": "2de0a058-99d8-4843-a921-5989669c91eb", "comment": "Malware payload (GuLoader)", "value": "9a3554d0d01d9811985149455547b91c983c70b5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837064, "uuid": "fda429e0-3ed2-4bf5-aa82-54f544249628", "comment": "Malware payload (GuLoader)", "value": "25a9c7e38db108de553d6cadaefd39c212c39ae1ca9bb55650a1c4b5b12d741edb6d31d913521dffd71e3f709771b881", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837064, "uuid": "8c42fb82-b397-41fc-9a37-b214c132d37a", "value": "T1814208B9BD030122C92E2392F865D454BCED40DDDC50145A7EDE42AD78BB8AC937ED8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837064, "uuid": "a056c390-b6b5-4d2b-a884-e2bbb0657034", "value": "192:nLxBSKoPKEFbh1+NSVQM8qcLpKyU4ejJHHoeCFVLKjCVnB1ZeVhucnJa8WU0wFAp:vSWEFbh1IcH8qc1eNdsKCZBDer7Wge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837064, "uuid": "40e92149-fe63-4658-b62a-957fcd53c42a", "value": 12469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837064, "uuid": "8a08b526-6e43-4c10-ab23-82aa90773ac0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837064, "uuid": "114b2d41-aba1-4e89-9db3-d6c64d596bc5", "value": "Trsten.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804158f9-e591-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710812357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812357, "uuid": "b4e67142-4ec6-4d86-80a7-0ccdf7ff6d0b", "comment": "Malware payload", "value": "c27c2c97c0689b8d392be27bd416cb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812357, "uuid": "9bd0b06c-1217-4589-b76f-4a9dfd7ce677", "comment": "Malware payload", "value": "82d2fbbd2af6dbaa60b5d59ed6c797979c51a00307ae035503f2b21bec8d62be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812357, "uuid": "56a65e0f-348b-4914-a05b-b1f0f31a5ee0", "comment": "Malware payload", "value": "57754d5844e2ebbee9dad25d2cd80d6ec10a40e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710812357, "uuid": "b99e3bb3-d988-4fdd-b932-c6ef7c7eae53", "comment": "Malware payload", "value": "f7f611b4f9528823cb3c835d6a7c9919e1d58dcf496e6276c8ca9fd13a327164a2e9b884c37562cd0385aec5bf9170de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812357, "uuid": "d79f1de2-be5d-40c3-a0b2-f109a4dcac64", "value": "T1652633769A25E4BFF42DB131E64A5FB003B1AC34F256B7B7A0803D4A7DBD9261E05930", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812357, "uuid": "a489cd6b-1225-4906-af61-008deb8154dc", "value": "4a4062425570325eca30bd0611c1875b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812357, "uuid": "2e6dab67-12ad-4b91-ac35-ed78419e25b6", "value": "98304:ZdY8mWOvB6jwi5p3FMdTe3iRzzBf9L4kfP+w4V6aI8v4+3yutBcT6b:ZdrmWO56j15p1kTeS9/fWV6Lv+iuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710812357, "uuid": "22dd8474-4f25-43d4-921c-bd7105d5996f", "value": 4767232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710812357, "uuid": "8be746ff-7686-4102-be2a-c8dc9eabd9c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710812357, "uuid": "231df932-bf3f-4cde-a36a-cbdeeb0c33f8", "value": "SecuriteInfo.com.W32.PossibleThreat.23211.15824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d37f779-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710835035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835035, "uuid": "df129ea5-33dc-4ef7-8964-3a2fad90f8a8", "comment": "Malware payload (Gafgyt)", "value": "62c97334fd02c8187de78b31d0f0ec88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835035, "uuid": "db591fb8-ada8-41d0-9817-8bc370505ae0", "comment": "Malware payload (Gafgyt)", "value": "831e3c1db59b562886c5977503ef0f5d7fa7345906490b1ea28cd368b21e9d57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835035, "uuid": "737e2e94-86a5-46ce-a76e-1423aaf60ced", "comment": "Malware payload (Gafgyt)", "value": "d9032d814f63b5f678af7984aa9ef4998312456b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835035, "uuid": "155da943-9bc0-488f-93e7-9f0eb58e9865", "comment": "Malware payload (Gafgyt)", "value": "6887d77f472cfaa843f43f4d8cdea7a4152a8682a3f94769e9f6f5590bf519f2a7248dbd59f5127166365b75266c808b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835035, "uuid": "10d3c13e-9153-419b-8adb-b482f586183e", "value": "T197F34A36E0A04EB3C0476AB5286ADC310F1AD5D3176F2692663817F04B9F4CEB45EF69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835035, "uuid": "20f9370c-99fd-4ccd-aa12-3944b51e42ff", "value": "3072:aIC6S95GBRKr7nyvF+OkvA5hyl7pmwsweDdAH:az9cBRiq7b5hyltmwsweDdAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835035, "uuid": "846036d2-4f75-46ee-8c61-e4c51e46e3da", "value": 158757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835035, "uuid": "c8fbabaa-ca8f-4238-84f9-c0de95ae69de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835035, "uuid": "5d4ff569-5e64-4d68-9ce0-59305fc949b3", "value": "62c97334fd02c8187de78b31d0f0ec88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa980196-e60d-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710865820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865820, "uuid": "ec578d08-34fa-440c-b5a9-ff615c440cce", "comment": "Malware payload (RemcosRAT)", "value": "9ced267dfca0c3f0a7856e4969813cfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865820, "uuid": "1498c8c7-7d9a-4030-82b8-3ae153143159", "comment": "Malware payload (RemcosRAT)", "value": "83fcbb145a53ef5f35ce64746e84ed386b2960ffc6c1af5943e2fb77522516c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865820, "uuid": "7047a5a2-83cc-4a34-8629-2be1a2f1155a", "comment": "Malware payload (RemcosRAT)", "value": "fc963847ec66ff054204eff6c2fbade6b5742831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865820, "uuid": "b30fd6a4-f52d-4821-b302-32ed0055ee50", "comment": "Malware payload (RemcosRAT)", "value": "c0bfe7b714ac672a729c8fa1dd64aa137d415eaa71d37af5276699c46fc1018576c07d7e8d931b66c5a97287d1d047dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865820, "uuid": "8017dcb2-a8cb-453b-a7ab-b48a418b0693", "value": "T11B559D76A6041571D0150E30CA17C7E9941CBCA17F14A8EF2FF86EAC5A3AF9BFC12562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865820, "uuid": "ae6f4493-dc8d-4459-8cc6-fdfd6d225f23", "value": "e67c859a7da4b267a97b9cf609e1ba03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865820, "uuid": "f21c9019-1b43-4f14-aaed-f4997f64f5d9", "value": "24576:EJWUid5kZHYX+fEHxniHBvag2ZCMVAgfM:EJ05aYt4dcsMVAgfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710865820, "uuid": "756c879d-f078-40c8-b38e-d8d995b97711", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710865820, "uuid": "2401e246-9f2d-41c7-8f5a-9a6b06e580b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865820, "uuid": "8d63a8ef-cbfb-4cf7-8798-ecdb99017129", "value": "bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e733031-e60b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710864699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864699, "uuid": "70cf4964-4db0-4da2-9ace-df2b5b2a4db6", "comment": "Malware payload", "value": "5ac2d5bcfd775d99a3aaadce4eef5d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864699, "uuid": "f7aa1eea-41a9-43c4-bc0b-e650dadebfd6", "comment": "Malware payload", "value": "841a7dd1080fc87a5d73eaa4635e43f14b770b419e5e68c5e8772f567f1afc86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864699, "uuid": "747a14d7-382b-416b-a68c-5bbd14ab9734", "comment": "Malware payload", "value": "675d744f798e812d605f1a91d9b274b1212567f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864699, "uuid": "06354f66-828d-4a42-96ee-aa9e0a93f8c2", "comment": "Malware payload", "value": "a25c040976d4fc08f47c1c1954ef4b3a75c3847d7c399abf0ef1b7ec8e3d97f6b8e949a5dac31f3d9cbd2a2d1b0a0525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864699, "uuid": "c5b5ae85-45a4-4483-bc73-7bab761cd973", "value": "T17E55AE15F764C0B2C147417E8856C76AE772B8250B748BCBA7A04F6E9F233D1AD3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864699, "uuid": "9cdeeb0b-243e-4bb8-a18a-e9e5ccdff29e", "value": "97684ed2b4bb5eb7f373577c0891222e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864699, "uuid": "cbb3a723-d6e2-413a-a8ea-1ced91d23870", "value": "24576:UZUwXfHfdrWqVn6tnFE2A8ZF6Qm+pKVGX9fcwDLMQG+d2XlR:Cf/RCGmdpKe9fc1e2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710864699, "uuid": "db2a915a-353d-40ac-af08-70890675879f", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710864699, "uuid": "8629a7a6-fb00-4935-bc6c-3b03ad3f3fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864699, "uuid": "5573ef6c-9668-4e44-8f08-361582132070", "value": "65511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9992b7e4-e5f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710854920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854920, "uuid": "c0293193-c1b2-4202-aac6-6a5d64e4a244", "comment": "Malware payload (RemcosRAT)", "value": "b26007c701f550b1bff5150c37f824f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854920, "uuid": "8088f015-64a7-41da-af83-7a697d73c1e9", "comment": "Malware payload (RemcosRAT)", "value": "867e3c9147ef41bc4edff6002959c37c785d919b13edbd7e8ed150ea51f9f15d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854920, "uuid": "02eea25f-376c-4407-adae-eae814819fa8", "comment": "Malware payload (RemcosRAT)", "value": "d91621bf95cf9be7b7b6e941e715f27e0e9f5b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854920, "uuid": "37319b6b-e552-4d11-b004-88115dd2164a", "comment": "Malware payload (RemcosRAT)", "value": "5a69f99947cdb7b91ab7e08be496860456c3b6abb0f40048e95e15ca93121a392eb7fd7b98b5e9e3f2447d746f6cf9a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854920, "uuid": "def73077-2247-42fb-8309-847c94cc1e52", "value": "T19355CE0273D2C036FFABA2738B66F64556BD7D254133852F13981DB9B8701B2227E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854920, "uuid": "3c80fcb2-3b33-4787-94c1-969eb2eba1c6", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854920, "uuid": "4818cfa6-0b94-4ef5-bfd2-3dcda233ad77", "value": "24576:oAHnh+eWsN3skA4RV1Hom2KXMmHaYQ3viOWeXvtSHIqS5NV9n5:vh+ZkldoPK8YaYrHIqONVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854920, "uuid": "6a3e39a5-26c2-4742-bef2-2bcf104e8644", "value": 1326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854920, "uuid": "2730a3e7-6060-44fa-9dab-ac8ebe43af58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854920, "uuid": "98fbcdce-0fb0-47c0-bc4a-5ff374333985", "value": "SecuriteInfo.com.Trojan.AutoIt.1343.17334.19923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da43479b-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710836990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836990, "uuid": "073c1ddd-fa9b-48a0-b9b7-947fe8b09546", "comment": "Malware payload (AgentTesla)", "value": "3090d7a4175545ff24d818d6eabf9483", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836990, "uuid": "0b18c640-415e-44eb-ae36-4b684ddc27a0", "comment": "Malware payload (AgentTesla)", "value": "873ed554676a269bc32af837ce8ce2730c8fd401293d323daf7e80498be3bccb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836990, "uuid": "edad74e0-d6da-4d9a-8f29-65f17743fbec", "comment": "Malware payload (AgentTesla)", "value": "f2540639f9a58e4be1163dd4caa2a651a5ee4df3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836990, "uuid": "b5019d4d-17c2-45ae-b3d8-165ec2135e7b", "comment": "Malware payload (AgentTesla)", "value": "dcbd7edb8f2cfdcd5b7bcc63824eae621a59c38b749aedecbb75d6eefdc1be81d180bc48ce87399a940321c10a5a6d7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836990, "uuid": "6550d222-935e-4b22-8087-21338e1697fb", "value": "T18ED4220576B4A263EE7344F81D281B205BB5EA3A2E65E7E85CD6208DF1C6F022753F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836990, "uuid": "4f9c80d3-ca9c-4a27-b483-4d197d42a06e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836990, "uuid": "7172f7b0-b58a-4b4a-8bdc-51f252c1d571", "value": "12288:mlPloOJRYWqDj1qT9Yx900DEKNNBGsJajUqFikg6/ZHVqe7ThGlAv8YMQgol:Q9oOJbEMM900jNNfJNq9HVqJ9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836990, "uuid": "57c8bba7-c524-464d-943d-df1411899a0f", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836990, "uuid": "e904dfcd-70aa-43db-9d82-7a9c6261ef67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836990, "uuid": "a5270c4b-b600-43e2-b9c9-c4b5c94f7ce9", "value": "Ziraat _kredi karti odeme_5472 5842 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c07ed2-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834647, "uuid": "b6caef46-a5ad-4572-bb09-d6ec85c7d589", "comment": "Malware payload (Mirai)", "value": "7ad60adf232dd282cc1176c0aabda9ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834647, "uuid": "a6422460-1825-446b-ae9d-99cab8cea200", "comment": "Malware payload (Mirai)", "value": "87fc4a4ab6a3689c741dba488beebcb544c173be21978f8d7d829d90ec004658", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834647, "uuid": "33f746a0-7375-4fc4-b95d-b088f6834840", "comment": "Malware payload (Mirai)", "value": "727b28bfedd31458b9db637472833b88278ec31e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834647, "uuid": "3b2c0460-a39c-40aa-b54e-1656507f3859", "comment": "Malware payload (Mirai)", "value": "787e950b36d6e13d0d1fc8cd0ac05e60ed77c4854a5413d1a4b74a58bca334b9626bf7077b626e54211db55a06eef3be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834647, "uuid": "be0e86e3-3771-48dc-a758-b1217613df97", "value": "T186D32A46EB418A13C4D5277ABAAF42493333A754D3DB730699185FB83F8679F0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834647, "uuid": "479db80a-e3fc-4916-b96b-e87ac68540bb", "value": "3072:gyOUbZkP3n4xkYYS2n6HBzjKazf4M/9ba9r:bOGY3n4xklVnuhKazAM/9ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834647, "uuid": "103ba89b-a180-43cd-8c28-b7d2077f160e", "value": 130598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834647, "uuid": "2aec867d-550d-4d39-935c-7e8657c89901", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834647, "uuid": "e9f5d80c-6902-4258-9188-55b8f704a30c", "value": "7ad60adf232dd282cc1176c0aabda9ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eea0ecb-e5a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710819281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819281, "uuid": "79bf1169-91a5-4ac6-b24b-4ee12822ab53", "comment": "Malware payload", "value": "1f0521b9dd34dec3e82f77b4dbd16e78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819281, "uuid": "e1c29211-2137-49b2-89c7-f516ccf5b305", "comment": "Malware payload", "value": "880026daedbb54b15f2eba8267cf09ee6bcccea69fbb02c61bdb8c94d21a789f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819281, "uuid": "adaaf54b-87ec-4348-9fc6-6c9dd9a9636a", "comment": "Malware payload", "value": "1ec3d875fdc325a0bcce0a435b72c756243e3ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819281, "uuid": "9df82eb5-a191-4fec-91d9-5cf92493e64e", "comment": "Malware payload", "value": "11ea11edda928d9b5c7789e40cc9de84d8ea3fc5088b4bfc4191efec1ee9d8c0b54f071d647e94aad6d4c1b623f4388e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819281, "uuid": "7558d189-f9f1-4d81-84aa-11d310782bc2", "value": "T16A452C1A7E61DF2EF5A8C23149738B3086D566B22BA05646F16CF32C1F30A4B651FBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819281, "uuid": "d6186132-978d-4be5-8653-9fa219ec3c95", "value": "24576:lHX5wqR86Sz1sev4jVYXrUxXyfXzG/tMWmq/GGKGMVJ4E:l3BSZsASYXrUxif2tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710819281, "uuid": "f6a62cc1-722d-489e-80c3-a447c9e707ca", "value": 1267132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710819281, "uuid": "238ddaca-e3b1-484f-ae56-f598482a927e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819281, "uuid": "d5d96000-33aa-4046-88e0-52c75f3a554f", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24808.26380.15126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3708454-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840387, "uuid": "89172e78-3d71-46ae-9e13-6421736d2dc4", "comment": "Malware payload (Mirai)", "value": "6f38d345e170a890b411988d13043451", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840387, "uuid": "ea56cff2-a3a6-40e6-b848-009a6699016a", "comment": "Malware payload (Mirai)", "value": "88f7aabfa0046dfbfb9a949f004948fc5e037ec87473063f76b58cecefa97548", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840387, "uuid": "869ef068-ce36-4847-adc1-8fccd88f5ff9", "comment": "Malware payload (Mirai)", "value": "380c9c273f6be426aa42ffa0b2b033f95f338d47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840387, "uuid": "81295d30-dd54-4d04-a983-02e244153fe3", "comment": "Malware payload (Mirai)", "value": "ad56156edb1710bdc06577f29e21dae299863a97dca6e02d96ec8dab5b7f55db52301c886356f03fa50e5a53eaf3da8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840387, "uuid": "8f6da804-f76a-4661-9e37-1e50e3d0baf4", "value": "T165937CD5F383D4F5EC8705B1513AEB325B33F0B92129EA43D3695A32EC92510DA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840387, "uuid": "a3281b3f-1926-41de-af12-10c77ff986d9", "value": "1536:cNpLUcrAcjghstngpJ5Cy/C1dpmUfBdT52X6yMdsyzWSNyLS5u:cNpLFrrjEogpGWC1dQEToKyesUvZ5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840387, "uuid": "06da7a68-3f37-4e85-877f-e1dbde3e4b58", "value": 89544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840387, "uuid": "3ed5f128-5ef8-4646-be8e-9f90941f0e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840387, "uuid": "4f29bbef-8a7f-4f0b-8f03-ab69d0788c84", "value": "6f38d345e170a890b411988d13043451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc08d0a-e607-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710862849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862849, "uuid": "c77ab442-6d8d-45a2-8c6b-ff156f21d21d", "comment": "Malware payload (Mirai)", "value": "db685620f2bc06548bfa6e31c6801405", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862849, "uuid": "806cdb80-fa54-4268-8117-da021bd2c3c0", "comment": "Malware payload (Mirai)", "value": "89d4930af49dac134c57d1b306bc01f45a46a6e1f16c41aea59a60657d9ecbbc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862849, "uuid": "0542fb4b-d400-4308-8400-3fb1134b2518", "comment": "Malware payload (Mirai)", "value": "db8272eac749ac07b8de10be69b915d46b8954b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862849, "uuid": "5c711b49-b761-420c-9aef-d2438fdd18cd", "comment": "Malware payload (Mirai)", "value": "ff6648f48b1b08520dafc1e00126b649b6e12a86a87726f6c3c4c010f7229ee55e85cd253598395c92673b063eeabe1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862849, "uuid": "580143a4-64a9-420a-80d7-158b23b14e04", "value": "T161E35C0BB5C184FDC4DAC1B44B9EBA3ADD31F49D1238B16B27D4AA222D5DE304F2DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862849, "uuid": "aa00c1ce-4bc0-4ab5-b616-eb77c8f990c4", "value": "3072:CPcmzjA+DVFkbEODmrWKdpn61vFnD/McPpRyLM0AfT:CPcmzjA+DVFkbeuBD5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710862849, "uuid": "2f706276-57d2-4a22-b524-1092ef384ae6", "value": 152024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710862849, "uuid": "e8fdf1b1-482e-426b-a988-d07d32294a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862849, "uuid": "25973b0b-f6d7-48ca-af24-c5b550b7a4f5", "value": "huhu.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c5ff25-e601-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710860423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710860423, "uuid": "30347352-f3b6-4243-ace8-e0d797877ca4", "comment": "Malware payload (AgentTesla)", "value": "eef80ad0744688be6c6029e7793dcf91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710860423, "uuid": "c2333f14-0d2c-4ac8-aa1e-e43a74286443", "comment": "Malware payload (AgentTesla)", "value": "8a3597999df227bed6a515aebd8ecf14468a8e3f23d570af30f42d72b3f6356b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710860423, "uuid": "31cee77b-2507-4621-8dcf-738e30d6c4b6", "comment": "Malware payload (AgentTesla)", "value": "35c0251531d08a060807c429e0833b5d48099a9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710860423, "uuid": "9f12e0ba-364e-4e9e-a837-b9794009ef7f", "comment": "Malware payload (AgentTesla)", "value": "1bc5e58efc5843685bbf24bc183f6c9dc37867168d4daef4615e165712e828fb6d34d6ce42ab65df1b13104cb95e1b2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710860423, "uuid": "7f2db210-f8f0-4724-b1c7-fd7eb56a5590", "value": "T150C423857A84C836FD738331253963671FFEF81958B98E0B7394361D7A7A680120EB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710860423, "uuid": "5e68d161-7167-4041-986a-93630c18d2be", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710860423, "uuid": "96bcdc5f-cfc2-482e-9396-39e917145b3e", "value": "12288:EMwrhdMp7SyAHZ5lEhugESlldjfmj/IiZY4CqXr6pSD8gZLI:EMwr0p7STUE6+jdm9qb/8gZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710860423, "uuid": "54f51ef4-bfd7-4398-8bd4-0a46eaf0ca2d", "value": 571672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710860423, "uuid": "ed5b8e9f-67d3-4231-89b0-c6ada4788983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710860423, "uuid": "ac125b5b-2224-409c-8b8a-1a2d676cc7bd", "value": "COACH MARCH ORDER +COACH JUNE, JULY, AUGUST ORDER .xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf99487-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710854627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854627, "uuid": "92416bbd-e046-4339-8ff9-70a6829283c9", "comment": "Malware payload (AgentTesla)", "value": "0d34ecd6d4c329fe3bc092404b764e1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854627, "uuid": "497842ac-1456-47ce-b75a-4e7f8badf5cd", "comment": "Malware payload (AgentTesla)", "value": "8b3b36dfc9aa033bc2225c66d7792dcd1838b4ca3a0f09c56e0ea9d48cc2f402", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854627, "uuid": "2155e5db-a34f-423b-96aa-cefb2a52cbe8", "comment": "Malware payload (AgentTesla)", "value": "279e2dca12aaf1499d6245c223be9de314ce43fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854627, "uuid": "d8e264b6-58b7-41e9-af39-dc42e470a97a", "comment": "Malware payload (AgentTesla)", "value": "2b58098baf208750905a7bb391a67e9f758c9e4850b2dcdb7695edf670ba455563cb9ae17a1304d4084a28c9b8afd14f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854627, "uuid": "c4bb2bf2-53c0-421a-a092-3f66dd71b909", "value": "T15AD17D7F9A1E2A79DA68FDF8C591783C2627322563C32DC0AA047A4611C9728CE23C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854627, "uuid": "4dabc3d9-2cb6-4afc-a3b2-c8caa87492b8", "value": "96:IXTu2WF0bNm64EuHo3Yv3HD6auu0V88Slip7C708SdMTjms7Z9EDGBoy:6u2xd4EU3HD6au388Slipu74a7Zeymy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854627, "uuid": "c0747083-546c-4cfe-87a7-0aa849c590f0", "value": 6283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854627, "uuid": "9d684459-cf62-47ce-b49f-febf062af6d3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854627, "uuid": "d15b9316-4f7a-4d71-978e-0e93d3d48abd", "value": "36KV XLPE Materials-300mm\u00b2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce09f585-e649-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1710891515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891515, "uuid": "60a84341-5621-4a08-b1e8-8bec2313a634", "comment": "Malware payload (Stealc)", "value": "287c0ab11acffca7b5ce14f4d8ae3f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891515, "uuid": "bf5f02d4-65c3-4be6-a898-ff32b4fc092c", "comment": "Malware payload (Stealc)", "value": "8cbafb0ebfb5e7d1cdd0970e10083d987106413aa1dc36df7e9f906d213c7bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891515, "uuid": "f29da263-9a3e-4503-ba6a-16d6c1c2c196", "comment": "Malware payload (Stealc)", "value": "b7dc7904076e6dd4062905c022e44cc467507bde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710891515, "uuid": "37e176ec-2fa3-4631-acce-a755ee730fe8", "comment": "Malware payload (Stealc)", "value": "e44f6934ceec64ae9b9012c3fa940577bb24f579fe61f6f7e6df2cc6230bdfc2ad6ad6a397fb72694f139bb62e59efc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891515, "uuid": "ee8c61cd-0aaa-4819-b51f-95066cb13eaf", "value": "T1D2449D916BF1D531F3B31A704A7596C01A3BB853EA3492FEA260651F2E71EF08D61327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891515, "uuid": "7c747fc6-8986-4dc3-bc04-eaa63d9d22d1", "value": "b15b414076b0d8dd5fe0c12cfe7bf2ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891515, "uuid": "7ea6908a-1f63-422d-8dbf-3c234e272afc", "value": "3072:H9wnPgPpDuBJhXV8y3t3HvMxoBa+xrCvfnJj2Mu5WDeph3s1dP4oriARVF8TMCkA:HqnPgPpD4XVH39/x2q8eTs/vriKVkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710891515, "uuid": "97bd6b05-1ea2-4a04-91e7-ec7ac2622253", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710891515, "uuid": "0e9f50d2-d3d1-4528-b3d4-53dbf5536f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710891515, "uuid": "2f64c2da-cf05-4af6-bc9c-7a147ad4ee5a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.2874.7320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8e6fab-e5f2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710854145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854145, "uuid": "90f49912-4d36-4a60-aa02-9f787490201b", "comment": "Malware payload", "value": "bf63f18cce602cc8de19f9a6d7a30ec2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854145, "uuid": "57f5c20e-a857-49c9-a89f-df47005523c3", "comment": "Malware payload", "value": "8d1bc7fcdc826ae5f14bd9cb649421e558012462ece956edc015b1e2f986a686", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854145, "uuid": "86a78bb8-ebc8-488f-b3f6-296f23995805", "comment": "Malware payload", "value": "2797884002b024bdbf65b48c3a44b5999530fe44", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854145, "uuid": "641b24c2-e8a0-41b8-9206-0a70dc4e1523", "comment": "Malware payload", "value": "d69e8bac69e6fbef46763729164bcf0139b913356787390fbd4bd424a31eec2b40a5913fe54cc2bea529bcb785c9258f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854145, "uuid": "6e74b0e6-7d1f-4862-8f15-26e9620e6999", "value": "T108665317E88611D33F0863EF130B9A424CA3EB332EAA595577C1115C0E2276EBF656DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854145, "uuid": "3294e683-1254-434c-b003-f9481f002a5c", "value": "49152:cI06m8tK7Suu7zxyuF//o4ozt5ipSVT9Fz7AZ5h4QilluwR4vIb0XFtddD2Hw1dg:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854145, "uuid": "a304684d-1136-41e7-8fe0-64141c77dd85", "value": 6552315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854145, "uuid": "6a902d2e-4fc1-4dce-b7c9-0cc6a3c9775f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854145, "uuid": "d0cebf10-ec72-4047-bd54-282ab7288def", "value": "RFQ -REV2-ABU QIR WWTP-CamScanner 19-03-2024 15.13.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ac5c44-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837095, "uuid": "8bf09a06-fe82-49f7-9369-8c89e0a54c8f", "comment": "Malware payload (AgentTesla)", "value": "c76a93bc5db1b5a8f1e064ab0e51a4d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837095, "uuid": "d2393fac-4c3a-46df-98a4-816c09a8586e", "comment": "Malware payload (AgentTesla)", "value": "8dfc4da6cddbe96a8eee81460a0352846a686ae31b567742f4f7e19c0a778c46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837095, "uuid": "85480ecd-3476-4ecc-a5fb-1efca44619cb", "comment": "Malware payload (AgentTesla)", "value": "d9bc68197c03634e12ad62f01c078eb1bc9722bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837095, "uuid": "43ce7954-090a-4b7a-a362-0b72cfe9e80e", "comment": "Malware payload (AgentTesla)", "value": "8c1114dded2dc6da37af22b590ee9571e156132fe0c30355e6b09db11095710298593401898b46aa363a49dc73c800be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837095, "uuid": "4d2309de-c1fc-4ae8-8090-928e7a0af8ad", "value": "T195F307D7DAC526088A8A2AB7EC5307334EB4415D37131E369BBDC29D604396C86BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837095, "uuid": "0b47b0f8-fd70-4525-9636-db6857712660", "value": "3072:sP4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRMpWOuMvmOfyYqygQXUqIZm+:sP4yENVOY0NpVXpK68kH3DPbkhZi3eND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837095, "uuid": "651f7b22-1bec-45a7-b33e-65e72d712262", "value": 171628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837095, "uuid": "2da83649-0047-42fe-b7b1-02c638a9f904", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837095, "uuid": "49ce5fe6-935d-4efe-a6ff-29b67568f28d", "value": "TRANSFERENCIA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de77a34-e616-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710869289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869289, "uuid": "6a474ccf-64f0-4342-90aa-60fc3dfeb1a9", "comment": "Malware payload", "value": "6758f51edd4011db7daaf89b0bd7c309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869289, "uuid": "0d84637d-cafa-484e-8645-e08c0e3632c7", "comment": "Malware payload", "value": "8ed6bbd0558775687c5498b0948f2d993e7db8a50b4a6686567008648a2e40bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869289, "uuid": "e76536b9-c676-4109-84d4-a2bde3593f74", "comment": "Malware payload", "value": "b95eea7df92628205b2cbb8b23cef33a40fee7c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710869289, "uuid": "cd83be10-69e7-402d-9081-23e75d42b7d0", "comment": "Malware payload", "value": "f8d6745bd8e3cfb39c4238d212cceb7bbdba5d940eaa4af696d9c7a68e8dd4a200767f4d64fe87844b838cabfa39a557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869289, "uuid": "759da0a4-9093-4b87-9fa0-85c2287f2cc0", "value": "T13DE435F9638B7A99F824C27C478E7535422738D69815B1EE30232D2CDF5FF106192A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869289, "uuid": "b3480335-75ad-41b3-83e1-fc600d1716b0", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869289, "uuid": "6ef16674-5962-4d1f-89b3-f55ee5e8efff", "value": "12288:afL+T1RZOJLvTDDaV5qYGZ3BHNt6Wf+IPJYli6jNA3THeMFDYU:afLgOJLLDDaK1BHNt6E+Ol3xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710869289, "uuid": "1b0ce58c-408a-4977-ab01-c8066921cb33", "value": 677184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710869289, "uuid": "8514a034-283a-411a-9f12-6e73d58536ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710869289, "uuid": "6ed86c6a-6792-4acf-9e0c-707265d61733", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf56358-e5f8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710856780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856780, "uuid": "2376360c-77f0-4051-84d4-a08c434587dd", "comment": "Malware payload (AgentTesla)", "value": "4ad33cad4479a6b29a2349b1b4f9929b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856780, "uuid": "61fc8b46-c8db-47d5-9826-894acfdb7293", "comment": "Malware payload (AgentTesla)", "value": "8edd24877baa6dd61d0f2e4a6062b76336ea418f26bc96a661c3f942d13663b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856780, "uuid": "5265148c-39a2-4aef-a933-33ab17cf6d7b", "comment": "Malware payload (AgentTesla)", "value": "0c994ebb8a79f465734f8164e3e60bef7ac8d777", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710856780, "uuid": "0fd6371b-8d67-4ae0-9841-d7f0d4448a9a", "comment": "Malware payload (AgentTesla)", "value": "e8a049116ba89e71eef561b6601e37fb89d5641e436f5f9ce5b3cf0fbbd8eb4bf17e7323d631dd6606143b071d45dfc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856780, "uuid": "497c4388-2175-4154-88be-2547d9b9ae6c", "value": "T1D0D423238E247776D75ED2BB5EBE051107F6937A8FAAEB9C8C503CD724803A44811677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856780, "uuid": "802650c0-860f-42e7-af9b-ba8848413ae5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856780, "uuid": "a198d549-ef26-4838-ae2b-5fb9e5587e5d", "value": "12288:flOX6KfwYTxJYWfH0/cP4GCOcmaC5s+z1KspkmihEU1FOJRYWq:9W6KfwYTEENP4MvxsYBU1FOJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710856780, "uuid": "04f38873-d54a-4435-8e74-6ee593f9e30c", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710856780, "uuid": "e54ad89a-927a-42c7-814a-63a6ece2f480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710856780, "uuid": "2f366119-2114-4256-b661-2b4cdf78559c", "value": "Quote--FL202306200039 SWP Inquiry no. 2023-1981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6325f1fa-e60e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710865996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865996, "uuid": "2827850b-866f-4c31-bd64-fac9f9dbd156", "comment": "Malware payload", "value": "08671ac237182bbb7daa41491a7dc2ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865996, "uuid": "d24f8fba-b758-4f74-a6a6-4c29adf596f8", "comment": "Malware payload", "value": "9012a3958219ec427b9b447dffca591b19cb4097f3bb89acc1389c4da59f6dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865996, "uuid": "2ec1b56f-bc34-45c8-af55-b8d17c480640", "comment": "Malware payload", "value": "e16e7b6843e9490135c77ef4726d49899100df1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865996, "uuid": "b251fb70-27d9-478c-b087-4e7edc0e4d92", "comment": "Malware payload", "value": "8492c4324697217541b9d79cf08fb7a20c515b1dda9b3bcb80a5de5555bb777f71375b558557a538d2879f296bfda24a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865996, "uuid": "c90070f5-2d4c-428a-9e73-4c4dcf07db87", "value": "T1E174AFE52E61474BCC10DEBC52D7DC502FE19FE69A7E919E3B04368A347D160F980BA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865996, "uuid": "dfa21c09-dc96-4cd3-8c94-ef1a26d5a769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865996, "uuid": "559835e8-8dae-4a1f-bcad-8131ff965eac", "value": "6144:bkqKjMt83tg7nzYb2WvHMcSsEpS9rJu/IUs0GGpql449R4SEmJE:4Ln367zYyuMqEpSDULGMqlb9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710865996, "uuid": "f30e6596-a5b1-4864-a89f-d5803cb162d4", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710865996, "uuid": "cf1d5986-9859-4c49-ba0e-059be9327a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865996, "uuid": "e49caea7-cd65-49fa-9506-28f235b6a30b", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb0bfc7-e5c3-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710834013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834013, "uuid": "f246344a-6d63-45f9-8950-3a87f8e7ea8a", "comment": "Malware payload (RiseProStealer)", "value": "f76c1ad4cfe3ac9d32beb1a35d83c58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834013, "uuid": "b92a2d40-8b33-410a-9879-dd64bef61d22", "comment": "Malware payload (RiseProStealer)", "value": "9017d75a6a7437cc78a05a96f6a773ce8427a0ca649e460d8bba434ba9a3e234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834013, "uuid": "69ff692a-772f-4843-abd2-c6132d7548e0", "comment": "Malware payload (RiseProStealer)", "value": "0b2801ac6fdfb29452a19a6720e647ecc2c0e16b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834013, "uuid": "1238b463-b342-440e-96f0-79c322f23b3c", "comment": "Malware payload (RiseProStealer)", "value": "afa859a137cb4235290e671eedf8aa9b954557aeb07d8c3af96d89be646794de4bdfd7566aa38015541bbf9032789c62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834013, "uuid": "ed49b230-93fb-461c-b0f0-09361e514a1a", "value": "T169A533059AC22CB3DCF4167A0BE6FB416A2BF06574B049CAB60D5A6F3D65E3123F6D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834013, "uuid": "74f9843b-a541-436f-b9c2-c7ad683bd665", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834013, "uuid": "a76bfb48-2c2d-4e17-ba82-56ba860c4d31", "value": "49152:s7x9bpL0J9P7ndtjxTBQfzcWAvqFkSZgEHiKv7NBq:0zbpLSl7nTjxNTWhLGH4ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834013, "uuid": "c7034306-4fc2-40c2-bbf5-45e443e0013c", "value": 2086400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834013, "uuid": "025e4ce8-940d-41c9-8512-679ed92b529e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834013, "uuid": "f9491511-cb8c-4d17-961a-3d9e76eaa185", "value": "f76c1ad4cfe3ac9d32beb1a35d83c58e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d99f509-e5a8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710822231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710822231, "uuid": "c841f5c3-ebfb-4add-93c9-e61c4576a7c3", "comment": "Malware payload (AgentTesla)", "value": "94c52ad40899fc1fc2523927c0cdf022", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710822231, "uuid": "f9278695-9c43-487d-9a9e-961d6535ae05", "comment": "Malware payload (AgentTesla)", "value": "904b3bd6dc96843fa949ece4b33ef83650d2f735f0caac028cd3384e864ef8de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710822231, "uuid": "c88951be-2e2d-481b-895b-823f72a71da0", "comment": "Malware payload (AgentTesla)", "value": "c5b1bc6e37dd622625ceeed27d3d331f8f7dd970", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710822231, "uuid": "a55138de-5632-433a-824c-5066f068778c", "comment": "Malware payload (AgentTesla)", "value": "ad3e54ae06686a0008d740adb6b6ef7b02e859b3f846610655b7040fea1980fe49627cf5f2aa506c6e108d1740eabf0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710822231, "uuid": "40ebcec2-7c06-44fc-8142-f753feca9026", "value": "T10EE423067270D783EFB212B414B51B121773628E28C5C7C49EAC519E69D2F836B26F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710822231, "uuid": "9d4c36a4-8281-4db4-b0e0-ffedf50d17f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710822231, "uuid": "8083444e-9668-46e3-957d-080ff69569f2", "value": "12288:wLclPloOJRYWqKgS9Pj6gES45VNZlFKbOCdPdPW4vG+W9jnAkgXljkR:aC9oOJbXN9Peg4NZlMdVmn9nAkg12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710822231, "uuid": "d3842e51-9832-4c48-8fe5-d3a694415516", "value": 667144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710822231, "uuid": "67437cc9-72f1-4fbc-9f76-e02cb7aac4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710822231, "uuid": "376c6696-baa4-44fa-b428-1222dd701f64", "value": "SecuriteInfo.com.Win32.PWSX-gen.24231.18855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae493c9-e618-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710870465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870465, "uuid": "213210b7-0506-4307-8e75-62d64e8bcfe0", "comment": "Malware payload", "value": "5738b3716d9c09f902c8ebfc77bb463a", "object_relation": "md5", "Tag": [ { "name": "blendy-game.com", "colour": "#79AD38", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870465, "uuid": "f0bcd4f5-3fe7-436e-933f-632416cd089a", "comment": "Malware payload", "value": "9429ec8822499a198cda14521355f7c9929fb957d1d50b7b08d51ef6f0223581", "object_relation": "sha256", "Tag": [ { "name": "blendy-game.com", "colour": "#79AD38", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870465, "uuid": "0f89e5ce-94f4-46b8-ba08-af716f32a303", "comment": "Malware payload", "value": "14934628611c053aca61c212a40239aa2cbd1c33", "object_relation": "sha1", "Tag": [ { "name": "blendy-game.com", "colour": "#79AD38", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870465, "uuid": "89d7157e-480b-4af6-896f-56ca636a32fd", "comment": "Malware payload", "value": "4f1a5b18e7ea4e1d28879fc65599c6e83cabe4f3ae0c20088ef2caf57275e51514e3235b7ddfcd3f2525217c7a753ed9", "object_relation": "sha3-384", "Tag": [ { "name": "blendy-game.com", "colour": "#79AD38", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870465, "uuid": "a7880e0b-8f92-45f6-aed5-a9432c0d5b4f", "value": "T16F083396CE3BE08B1183922A493D5EFA573484F93579A16812DC8F2DFD86943F433627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870465, "uuid": "402615f1-ce54-45f5-a8d8-4682802d7aea", "value": "1572864:Aiuu1JTNhwgfiebBXkxqmSPQuhQTCfoNX/cPRHp1gzcY2BFQDt9:8u1JTNt66ukmSPQu+vmXgh2BFQDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710870465, "uuid": "252d9f87-0177-4d5e-8f1e-2304a2e3cb9c", "value": 84124052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710870465, "uuid": "78891172-4db0-4667-b118-90637062d579", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870465, "uuid": "cc2c2f46-1dd3-4a46-9a21-9b3cc1e2bb87", "value": "Sky-Beta_Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1930b6f3-e61c-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1710871885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871885, "uuid": "f5ecf76e-f78c-4bb2-b133-dab7d2475d82", "comment": "Malware payload (Stealc)", "value": "eee75523236eb38de380d98d396fd559", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871885, "uuid": "530aab7d-bfeb-4c16-a742-3990734ea0b4", "comment": "Malware payload (Stealc)", "value": "9517500f74a357875b19656ef699378127b52afe33b8f69f0e4afa9f5e548f15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871885, "uuid": "f454b845-b72e-4bd3-a1d7-4f1b5992abde", "comment": "Malware payload (Stealc)", "value": "e81cf8df59159ad74cdd75b870aeb85b7768a121", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871885, "uuid": "1f1fe514-3837-40b5-84ab-67ebac4f8db9", "comment": "Malware payload (Stealc)", "value": "905e7445e321b56954c991c26fdde22c34285dc526f68f3cadcbe3788df8b0307e4e055cca2b7cff4ebf880ed5447f5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871885, "uuid": "d2220ef7-894f-4507-81bd-df234cf5545e", "value": "T1C0446C91E5F19426E2B71A384E75D7F01A3BF8737A74E28E2250D53E1EF16C18A62313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871885, "uuid": "59ecff7e-ffc4-4b1d-82e3-0768e069554d", "value": "b15b414076b0d8dd5fe0c12cfe7bf2ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871885, "uuid": "d7bdbf29-83ce-4f2b-b786-5a8975c7e3a1", "value": "3072:pwnPvHpmZFxwPAhFUGh8eOm6W3E7mu8PXpTEf2tdGj33h8OS3YAtaKH:WnPvHpm7x0A+yPXpTE2DE33qOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710871885, "uuid": "3935af69-a12f-4483-b19e-f88d73891cd3", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710871885, "uuid": "72a93314-2abc-43ef-8ad8-7e6ea2d68560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871885, "uuid": "c54ad241-d1c5-40f4-8e16-ba4ac0ab4c75", "value": "eee75523236eb38de380d98d396fd559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba301c1c-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840372, "uuid": "134d3a11-55dd-4cde-948b-750880a56fec", "comment": "Malware payload (Mirai)", "value": "13becc9e8666a596a3461175351d6919", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840372, "uuid": "4de3d7e8-d6a9-4e9e-893a-11746d7b42b8", "comment": "Malware payload (Mirai)", "value": "952b4b4c87038b29067ade6950eb45f33e3327d7fe8b2b46bb3955e7d176d41e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840372, "uuid": "89dd0ada-e0ca-44f1-a270-7d6e7ff9ac99", "comment": "Malware payload (Mirai)", "value": "c8d9d853f371b3b797b7a302a153235f357c2fb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840372, "uuid": "2b032344-5b72-4d2a-971d-814c36746933", "comment": "Malware payload (Mirai)", "value": "0db6a32c6176fb8521f952274d9fb946ac7591377e06a6be60683a19edf5817a999950104ccaf25b3ff11cdf2b88dc74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840372, "uuid": "0e80a15d-6db1-478b-97e8-b84270270c16", "value": "T15904C81AAB520FBBDCAFDD3706E90B0139CC914722A53B363674D528F54A54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840372, "uuid": "79f9bdd0-7bc3-4810-9ad1-5b8dfcb8bca2", "value": "3072:hTgPeRKqtSVDEV72UYmulovxnju2mH/FG:hTgWcJVU2UJulcVuff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840372, "uuid": "ba1895da-7e22-41fe-814b-897694ec1b0a", "value": 177900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840372, "uuid": "1a698a28-627a-43d0-8af5-8d324615b16e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840372, "uuid": "68edb570-dff8-4a03-85dd-045296f3b98e", "value": "13becc9e8666a596a3461175351d6919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c033bf-e5ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710823883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823883, "uuid": "9358bc07-e15b-4fca-bb84-6d2d85d2d0cb", "comment": "Malware payload (Mirai)", "value": "62e1d08006d1ef5c53be267d3756e356", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823883, "uuid": "504d9c11-dc23-40af-a5e7-e760fb4e1c24", "comment": "Malware payload (Mirai)", "value": "9662daa7bbc36cc2f54859852d27a4baa9cd4228f0191bd6ec592e7f64bf0d98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823883, "uuid": "b3a399ad-b68b-445b-985d-15621399774e", "comment": "Malware payload (Mirai)", "value": "11d496ac514997c61c1346c497991b1f14f0e6f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823883, "uuid": "6980d91c-7519-4672-9637-9143137eb329", "comment": "Malware payload (Mirai)", "value": "1832790c9af4a83e6c69b0d8cd0a779bda247862e7069fc0b8dfbf59bf1fa3c40a67b0b31d4fb9ebd72204d1f18bfe25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823883, "uuid": "0525a603-c18a-45b4-a5a3-cb5c1d2ee86e", "value": "T1B1042A46EB404B13C0D627B5F6DF42453333AB9497EB73069628ABF43F8679A4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823883, "uuid": "f8f673f7-6e44-4ef9-a4a1-d8ae809c662a", "value": "3072:nS/Ns8hjlvbAmfkIaboVSyckpj/HS0BpZi/hJjogM/RXC/Ht6:nS/FlvlcIaboVS7kVdB7i/XMgM/RXC/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823883, "uuid": "58563841-c878-41ad-bc82-56e565c5595a", "value": 179797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823883, "uuid": "89b4683d-410b-44e8-969e-45999ce9d310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823883, "uuid": "ba516025-6526-4a7c-b803-7a370d303d37", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d248dba2-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840412, "uuid": "8e835c8a-a709-4f14-b2b6-07f5332dd63c", "comment": "Malware payload (Mirai)", "value": "b0773828efcf04250a936c7df98b0eff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840412, "uuid": "51d2bdbc-c19a-4311-b7b0-2a7dbe9a61b3", "comment": "Malware payload (Mirai)", "value": "96baadc5bc1bc00dc32bb7858a08fa877e31c9f5e0e783dc63cb6a5a56098ed3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840412, "uuid": "c2fcec20-b5cb-46f3-9d9d-3da2c4abdda7", "comment": "Malware payload (Mirai)", "value": "183ed6eeedc705b0fdaea0475f275b9e0284c784", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840412, "uuid": "2a5158c9-efbb-4680-87f7-33b8242bde28", "comment": "Malware payload (Mirai)", "value": "4f8067e6e79650ef8b42fde7ba873ee2c7e67bfaf48f5b07389c6beb64e148eab040fe8b153a4dbf6fa3c178730efc3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840412, "uuid": "432230c9-9b37-4852-91ae-4076effc0dce", "value": "T118041A45EA404B13C0D627B9FADF42453323AB9497EB73069528ABF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840412, "uuid": "8b314e21-5ed8-4948-841b-b306541e778d", "value": "3072:jXNnuD4qqgAwILauBmmEt8CZee3BFqe21Jso0M/RIXB:jX84q0TLauBmmEt1XBEe2jx0M/RoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840412, "uuid": "53f622db-2349-4e5a-bd18-1a09a640b1f8", "value": 179814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840412, "uuid": "c9152154-7f1a-4d2a-938e-437707d3e164", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840412, "uuid": "a1be7d02-30c8-4eea-9e2c-3e7c3fe7b19d", "value": "b0773828efcf04250a936c7df98b0eff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2552d376-e5cf-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710838834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838834, "uuid": "a8983f1b-3f42-4933-9508-4806fe1923f5", "comment": "Malware payload (RiseProStealer)", "value": "89d1f497e0442f7ca0690d41486d2ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838834, "uuid": "ac641802-69f5-441f-ab20-27b0d2e9a8ae", "comment": "Malware payload (RiseProStealer)", "value": "974ea2606152e58a818dfc7c5a547173ce0e6b9d939512d69a87f8e393ab64fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838834, "uuid": "bb552f57-0601-4671-9106-b167c1432fd5", "comment": "Malware payload (RiseProStealer)", "value": "68f761f7f7de6e508f5eee54b3afb1a3204e4d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838834, "uuid": "7b9a2141-fe81-4f51-a710-b2fafafb3cf0", "comment": "Malware payload (RiseProStealer)", "value": "cbacea15057d4bbf6b60db5bad0058e980244e0ccbcc7e4fe362b1e1194fc5792c4f46477218ca9e6b871ad08a1dc1a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838834, "uuid": "7dfa92eb-1374-4c0f-9e39-872e00be4a37", "value": "T12E46F116BBC4CB16D6AE9A33E4E1341C93F5E6C1B716E34E664167B80D533388D4B2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838834, "uuid": "b9a1a737-922b-46b4-8709-8e968b950bca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838834, "uuid": "fb1ffd38-035b-4629-9402-f574ba76b96a", "value": "98304:CMcXD7eMOGsjo7KpMbkh1S0gNtyNlcryzyD4YpPCoOW1wHIO:CxVTKMbgS0gNtyLcOGD4YpPC1W11O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710838834, "uuid": "4daf4d66-31d0-4b61-85ee-a436e2308fbd", "value": 5878216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710838834, "uuid": "ccf60267-fb21-4c9d-814e-0917208d3039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838834, "uuid": "e55a50c7-c5b7-4856-b070-5f2fe83c92d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6412df7-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840392, "uuid": "19166ff3-1d2d-4b6e-a097-d56923378ae3", "comment": "Malware payload (Mirai)", "value": "70b9b7f945c130617342833f3538a006", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840392, "uuid": "eb0b50f6-eb45-45e8-b69d-feaae1921b63", "comment": "Malware payload (Mirai)", "value": "97732af5d1ea340172d45088d45240e92c82cf71cb1c49660281faf44ab7715d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840392, "uuid": "b216ba8b-04a2-4d42-9e33-92166568a8a8", "comment": "Malware payload (Mirai)", "value": "6048a1b9a482b2d751ef4b5bf96b01715457dbd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840392, "uuid": "97080dca-7f59-4f07-95a3-9c02df993755", "comment": "Malware payload (Mirai)", "value": "5c861dfd384107fa2c37d76ce6a21657cd7b0216345f45ee9c0029a1efd50c029b45e92c1c5c48694a054afa1e1b5d68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840392, "uuid": "e308c1cb-7d4a-40fa-bd43-a79e17d642da", "value": "T140E329D7F800DDBAF80AE33748530909B530BBE245925B373257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840392, "uuid": "a78cad87-6e1f-4c33-b8cd-5a76eea9b15d", "value": "3072:kns2W3sjr5rs/PzbB3cScA8lqLVrjbiRL9nLueyP3CTtN:MscULbBsSUlqIL9nRyPSTtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840392, "uuid": "9fb5e097-d552-4b27-aa44-b792092377df", "value": 150432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840392, "uuid": "744f6905-a3f5-43fb-9bdc-cdf7b1984dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840392, "uuid": "e948544a-a335-4b67-8ffb-c060373e120d", "value": "70b9b7f945c130617342833f3538a006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1578ff-e5c3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710834017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834017, "uuid": "ba6c9d1a-891a-4991-867b-f1f08c20c849", "comment": "Malware payload (Formbook)", "value": "1abf700508843d5d3b3705f6a7e8cc8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834017, "uuid": "eab7dd62-dc6d-4b07-9ffb-eb5c37fa787d", "comment": "Malware payload (Formbook)", "value": "985e0fe889294d68765df8025b8a904ce6095b47feb9889759e6262f605c063c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834017, "uuid": "45eadbab-a18a-492c-9bb8-9fd111c44634", "comment": "Malware payload (Formbook)", "value": "3848e30976825bfb5efeebacb9ff98d445e30e02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834017, "uuid": "12516725-bda0-4e5e-89db-1dfbf6de1583", "comment": "Malware payload (Formbook)", "value": "4e85612d2fbe536a0084037b89f1d2758e706cb2f00e278528b4c53670555663ec5ca91323bb66fd22ae79e51efd6a6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834017, "uuid": "bdb8c4c1-6329-4f43-84cd-cbf316aa5105", "value": "T17594E004F665F186C86D27719B9A96245F76EF44226405C7123CBAFD3E72242C88BFF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834017, "uuid": "712313c0-546f-4511-af76-2849a0513396", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834017, "uuid": "01a46737-f200-4b92-8982-331fc8c04b76", "value": "12288:eeo8E2Lf9G498ogcxAy+ryz8tqXjadxlrXhh:jxAy+SHudx3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834017, "uuid": "6740bf32-cb54-4a16-99a7-3c28038cc85b", "value": 430272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834017, "uuid": "ecfe5c9b-112b-42cb-9f12-986390e2586d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834017, "uuid": "2a4b765f-fc7b-44c9-b7ac-bbb841a60919", "value": "4000382404CAPMO -PI SIMONE xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b683fd-e5d9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710843082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843082, "uuid": "07495242-9e46-4532-a010-08cd20d89f47", "comment": "Malware payload", "value": "d36738689697fff4cd6dd39dcd065aee", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843082, "uuid": "1b8f2f2a-e4a3-4038-9aef-80f5586910bb", "comment": "Malware payload", "value": "989d32416fa41d152d4db47469c9cbc7a35c50c72b0d3b52f5781709227896b3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843082, "uuid": "e4305b9d-72b6-4918-84d3-c42d154c9cf1", "comment": "Malware payload", "value": "dc8e8a4988987f7c8b6d628597429ffe9b398056", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843082, "uuid": "b5a9f6c3-d366-43da-a183-d65a79fa802b", "comment": "Malware payload", "value": "62d22599bc0949e2df3c597126dcd6cf88c6b1a3a879c8668bf517793952b9dd5f127538f37a66636440b10d7ff44d86", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843082, "uuid": "48be692c-0e95-4be3-9285-4f22074eb814", "value": "T18953BE6EE34F0915DF95A67B035B4B4A0AFCB33DB28100A1356C973437ADD2E4A6297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843082, "uuid": "5f363fa4-5349-4f1f-98b4-5ad25de913de", "value": "1536:8ETwKq9+Cpxr5jcCOV09CLKAcY+IFI7qaDoTFT9CSL/ijWZnNQjdrNL0zKGMAo:xTwKq9fZfOV097Y+IFI7qaDsFT9CSL/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710843082, "uuid": "b0a6f5bc-146e-45d0-8142-6cdb3b2ad228", "value": 66563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710843082, "uuid": "b7d3390e-ca51-48a7-a522-3538ee831a9b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843082, "uuid": "f84e4de7-5ec8-4b0f-af0c-d730379512b2", "value": "d36738689697fff4cd6dd39dcd065aee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50584115-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710835040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835040, "uuid": "f36c8400-5a06-4eec-b099-29f0d8446ee1", "comment": "Malware payload (Mirai)", "value": "ddef0731c6d1f5cd251ee10207ecd713", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835040, "uuid": "848e2348-9ba3-481f-8f0f-9b60dea63463", "comment": "Malware payload (Mirai)", "value": "99199e6003ab8a0b8a529c3645b427a40aa305b2efc4f8ee9566a76a8f9ede85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835040, "uuid": "38e7c478-e2fc-44d5-aae2-994e74830b23", "comment": "Malware payload (Mirai)", "value": "f30f585e932dc3c2970ab98c9d712f61bb29e1a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835040, "uuid": "7e80b029-2d64-4808-b8dc-0372e8190411", "comment": "Malware payload (Mirai)", "value": "5a0c6bc68543cf1821a5c02325d8aed79f9e611fccea1bb87f14f39860fff0032ef81d1c77ad2fd08bb7bd9379a940be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835040, "uuid": "7218a255-29fd-4e7a-babd-10aba432c417", "value": "T1F6333B2236580B47D3A24A70293F57E183BBE59074F4B98DA50F7B4A8275E373086EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835040, "uuid": "1dbf1923-b002-4e6a-8db3-6869d4501398", "value": "768:58ftXBn3TGkE98UPfYDK60MpTbbgZNkTYZWcrkTbOuWlHIYDz/0wJKw2paCGV2Y:KtXUKIKLxnTIoY8wJKw2Qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835040, "uuid": "9e61f68d-6d66-4515-8aa2-3ee00b6fa349", "value": 54440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835040, "uuid": "dc1be5e1-145d-4c85-b3ad-ac1ed7ad44b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835040, "uuid": "8b68a94e-454d-4ab4-bb58-d063fa80084f", "value": "ddef0731c6d1f5cd251ee10207ecd713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcba6e63-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710836994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836994, "uuid": "920dcca8-1cec-4be9-b6ab-169a727ed9b8", "comment": "Malware payload (AgentTesla)", "value": "3ab91ddca77430d4f4b1a811611bc622", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836994, "uuid": "de0838dd-6c08-4632-8b1a-3be132495cc8", "comment": "Malware payload (AgentTesla)", "value": "994e690703864150e91ac5f4d3cd5264d45e2ecc182424bd5285cbf935cb855d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836994, "uuid": "43f39272-bc2e-4729-81de-ec33e84d94d7", "comment": "Malware payload (AgentTesla)", "value": "064a306cc2cddf4617d8c96d641bbcc11e90b8a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836994, "uuid": "8e16e419-f974-42d1-b7ca-050ce467984a", "comment": "Malware payload (AgentTesla)", "value": "91091602e6287f9956db5b01fa3cdb5e4c8ae18443a61cad548655d4ad8ceef09a4087a3e866b95cb9cd09cc935b3fd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836994, "uuid": "a8147faf-076d-4702-8d96-6d5d8a32a2db", "value": "T1E1E42351A5B9EA93DEFB56F015EC160523BA65762E92EFCCAC9910DF0AC3F461703023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836994, "uuid": "e931c7d8-b50b-46cd-8fd7-b604418b84de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836994, "uuid": "5bc27f71-9701-4f5b-a37a-7e2556dc3f51", "value": "12288:wlPloOJRYWq0WVVj9T/XSsGSol24i+okhoBfw4pPcyxCig1ewhc0IPg5jYvUyJ1p:O9oOJbjWfVzoV8kho64p0tIAhAg5+UUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836994, "uuid": "85cbe200-0dcc-40db-a911-b2e430055ff5", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836994, "uuid": "e9e1e19a-ed2f-4742-95cb-2f09ff4b7191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836994, "uuid": "4f9360f6-5e15-45b2-be90-a7559020ff18", "value": "HsbcpaymentSwift.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2605e27-e5cf-11ee-a120-42010a9c002e", "comment": "Malware payload (MassLogger)", "timestamp": 1710839070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839070, "uuid": "8343c208-597f-439f-916a-3f2036e6a224", "comment": "Malware payload (MassLogger)", "value": "d245cabe0b82f5cfdfadfa329f2dbea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839070, "uuid": "f8bbd1a5-c3e1-4ac5-9902-8a5a1a4dfd3c", "comment": "Malware payload (MassLogger)", "value": "99e5636d65b5d2964b42b48c5dc780781aaf0ee0d3b10c8e3aa56e6acba8a558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839070, "uuid": "7e54da9b-9fee-460f-a1f2-29c5315ef677", "comment": "Malware payload (MassLogger)", "value": "9f4d3de505770db1f7b36b8c182fc3df2b24e1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710839070, "uuid": "e42dd713-fc7e-4a75-9d4e-29be8227e733", "comment": "Malware payload (MassLogger)", "value": "0645fb6d7c132696e5892053f423866aebc66ea9f30fd23114aada1da79e67c557c358369a3e6d1f3a22e4a170d124ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839070, "uuid": "171241dd-620a-4732-9b5b-2eeb9f8849d6", "value": "T107E4F114138CF843ED3E06BD446A5D92437620F3B9329B0E29C656EE9B23784BE572D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839070, "uuid": "1656a8f2-2bc6-451c-92ab-3ef6c56ca7a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839070, "uuid": "621a12d1-db9b-4619-8fe1-993af09d03fa", "value": "12288:CQznJE9JOwL0CXbAX5gVmqUg2ZTEu2ZQW9LTtNScGN4TL:hVE9JOwLpXSej2tB2ZQW1+N4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710839070, "uuid": "5fa5ad0a-acbf-4aad-892d-3454cde91471", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710839070, "uuid": "a9c8abec-22ca-4ce0-9a2b-f247b054ee54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710839070, "uuid": "163a5f0b-d013-40c3-8ab3-216d1cde0fb7", "value": "faktura-marzec-2024 xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fea596-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710834995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834995, "uuid": "0cc92a80-8096-4e54-b486-79233f2fc965", "comment": "Malware payload (Gafgyt)", "value": "a5d7e0f342dd67be0f0e43aec0a27f8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834995, "uuid": "9b7850a6-f59b-41fa-a8fa-f10a18404332", "comment": "Malware payload (Gafgyt)", "value": "9a150002172c0baea0367547dbf4e7773809dc36d3cb401cfa06220bdb416b55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834995, "uuid": "104e7f28-c908-408b-8360-dbd9c334fdf0", "comment": "Malware payload (Gafgyt)", "value": "53f9318cd093fe9d53e8876cc7d0d8fd06de1b1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834995, "uuid": "d72ac222-e839-4f46-ab7a-8e7bd9d310f3", "comment": "Malware payload (Gafgyt)", "value": "0412cae142289542207149ffedf42fcb6679d341fe032260e74a0be3b71239a06f65d808261cecb1bf0ede70c193e575", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834995, "uuid": "988b993c-3c0c-422c-8bd6-c2980a407978", "value": "T194F31824F5408267C2D327FAA69E838D3F3557E223D733145A389FB02FC2B952D66964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834995, "uuid": "386b6df2-14da-43fb-ac83-4fb93441dcda", "value": "3072:Bdy8WoZkeDGOvvlIAFZ3U5c0xkuQn3x5h1X7cKUmSQnNbGUBn:bZv9KBxkuQ3x5h1X7xUmSQnNbGUBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834995, "uuid": "b8597127-4f99-419b-89b0-ff6f4356f1f0", "value": 171215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834995, "uuid": "85bb702b-3235-4859-8476-d02012c74c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834995, "uuid": "efad6f5b-9bbf-4ed9-802c-95f01b4e1c3b", "value": "a5d7e0f342dd67be0f0e43aec0a27f8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f303cbc8-e5e8-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710849916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849916, "uuid": "0a9ee90f-657c-497b-a9ef-5cca446b8750", "comment": "Malware payload (Formbook)", "value": "3f6ce883427891f5f64a7d4694093da6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849916, "uuid": "cb7d815a-71cf-4701-9dae-94d3a8978751", "comment": "Malware payload (Formbook)", "value": "9acf79ea7507e73dadecddb7340b4162623a6f46289eb70517c5ff39121c11d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849916, "uuid": "88495b49-a9ef-4745-8625-f2429b6e325d", "comment": "Malware payload (Formbook)", "value": "ef188afd765d95cde4d30c75353e7da69f9c6847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710849916, "uuid": "9a2916d2-8646-4d57-b436-e09d0dd713f7", "comment": "Malware payload (Formbook)", "value": "9d4f472203b73584f76b161a3a7bc4b30a7bc0950138bafccac84f45d5672cc77f2e57e15e3d6c1f58ef7b07246d8f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849916, "uuid": "85739245-9551-42a3-a390-931bb48da937", "value": "T18F45BE0273D2C036FFAB92739B6AF24556BC79254123852F13981DB9BD701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849916, "uuid": "26e95fb4-d05f-4876-81eb-298fd4cf09ea", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849916, "uuid": "67d6dbde-0646-4d41-83ac-ef52869702fd", "value": "24576:1AHnh+eWsN3skA4RV1Hom2KXMmHasfhc5iKfl/94cgdDVJz5:kh+ZkldoPK8YasZcAIn4cgdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710849916, "uuid": "557faad7-906a-4316-9aaf-1e456162d5e6", "value": 1203712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710849916, "uuid": "eefbdfbd-4703-468f-ac36-71c1315097eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710849916, "uuid": "86af79e9-76b0-4bb4-8ee5-90c2a11c1e1f", "value": "manufacturer this requirements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc44f220-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840402, "uuid": "b727a2f6-44fd-41c7-889a-3317fed5dba1", "comment": "Malware payload (Mirai)", "value": "0cb075c811e9610b5d493be1935890a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840402, "uuid": "eef383ba-cdfc-43ee-b6b0-9628fdb8214a", "comment": "Malware payload (Mirai)", "value": "9aeb3183c57abc3be82ddbdd743bd6c694617dd136a4e873f566678572f829d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840402, "uuid": "7cfa206a-e144-449a-98be-2ffa44ca9f3a", "comment": "Malware payload (Mirai)", "value": "8c3e5c167ff43093e355165ad2ff044bd67db09d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840402, "uuid": "c957e4fd-0255-4a4e-8a52-6ec6bba83e8e", "comment": "Malware payload (Mirai)", "value": "cde5077709993ae57e686d9db0698391e4234578ecea830fe10a2ed5aa056ebf438b4069e27b1b0f1994208d1b386134", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840402, "uuid": "f53026a2-9921-4459-9eda-b24c981c37fb", "value": "T10104985E6E228F7EF668873047B74D25A76823DA27E1D640E1ACC1105F6039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840402, "uuid": "79fa2937-4a98-4ab3-b8cd-e466ddde07e1", "value": "3072:SlWlYf0Xl9bQ6NMD9elxEBqvbKarkDqH7bx:SslM0874Yqnriqbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840402, "uuid": "44c5ddf8-1aad-480f-8eff-3bb6231f334b", "value": 173804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840402, "uuid": "91231c96-3587-4488-97d8-dacb4fc852a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840402, "uuid": "ff507171-3e39-4294-bd40-a91c9dcf205b", "value": "0cb075c811e9610b5d493be1935890a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4126b32f-e5bf-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1710832008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832008, "uuid": "baafd505-d813-4fa3-a5fa-b0e1803c8a97", "comment": "Malware payload (STRRAT)", "value": "1437058c6d28f9a7a3ccdeaceda607bd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832008, "uuid": "3fd3f5de-0db8-46fd-8c6f-a2f40e670208", "comment": "Malware payload (STRRAT)", "value": "9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832008, "uuid": "d591d3e6-d1e8-4157-a38f-9fb7e1926908", "comment": "Malware payload (STRRAT)", "value": "5d7b2f57c74739f8e077dafd25964ef3f990b0ca", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832008, "uuid": "33de107d-32bf-40d5-a48b-50c2e4d41044", "comment": "Malware payload (STRRAT)", "value": "62f65e1d46456a2bd84e67696a66a2370e8490da65a7feaf909f03604bf59228653851d8b83bcedb44d75e279ad95c34", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832008, "uuid": "7d659ef7-6538-4a65-8eff-e48b1765a648", "value": "T11A53F115EE06C937D2336173480A821A74F4426D92CC21BF59F0F997D49BA5A4B07EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832008, "uuid": "9aef797d-8e71-40c7-a625-85eb50a2f024", "value": "1536:fs4vu4cVMHH4/o0oJ4pxtOPLYr/09xIYd3W4Un:fXuMHY/JhtOPLYey4Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710832008, "uuid": "b5c700cc-d40a-4f88-9d42-2efcc088520a", "value": 66091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710832008, "uuid": "9b44ad5b-286e-4881-9984-af53a3b70d1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832008, "uuid": "e3c7f6eb-b862-429c-8334-06adec46a5dc", "value": "Isteme-Formu.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e82e090-e5c0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710832568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832568, "uuid": "87eac52c-629b-47c0-93ba-002d4a57f57c", "comment": "Malware payload", "value": "ebae9b70769458cf723022ec89b95c32", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832568, "uuid": "54c3b4c7-a051-499c-87d1-6b6ba022b7c7", "comment": "Malware payload", "value": "9f8f58faadcda3b49e371c1ae353b30b3713652b0ad8d05b57383142757a74d0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832568, "uuid": "b10dcedd-7a3e-47b6-a068-0f3bb74e93df", "comment": "Malware payload", "value": "3d3135b87fe274988b86f50d24bde82cc08556bf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832568, "uuid": "bcb32d44-8c07-41e0-97ea-61e854877be8", "comment": "Malware payload", "value": "780952227c026d11dd309b6687fc057af499de427908d510aa4bc5779b9461b073dd2d8943ad1ca0ed6115a0cf5bf365", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832568, "uuid": "81170c31-5d2b-415b-9a36-a2dfbc87412f", "value": "T15EA5230BF2C55B36E8DB06311B4F97298A71AC3496228A2B564D560E3DF16B0F7F32D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832568, "uuid": "c43f9ad4-8b3d-4355-abe8-f860e78bcb18", "value": "49152:J3osY5A6b4ms+4UhbrMizYiRpb2mN3rm999OhjY:hY5A6bDhbrfzYiRNdm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710832568, "uuid": "47fcd872-9f4c-452f-9165-4448ef8c00d9", "value": 2085376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710832568, "uuid": "4cafb483-a9a3-4206-8a91-c881e068f709", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832568, "uuid": "12451088-b9c8-42c1-85d4-32b0c132d689", "value": "claro.596166.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc0c5c3-e5d3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710840779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840779, "uuid": "26dc032a-bee6-403d-836f-618d3e8d8378", "comment": "Malware payload", "value": "53b56931fee9c4aaf65492e2cd13badb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840779, "uuid": "31a3d846-db6b-4b89-8100-be6cad9ffd14", "comment": "Malware payload", "value": "9fc0ceb1941f3d7ba4aec425cd0bd116930f5c45649dea273aaf18bd7d7dd383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840779, "uuid": "4f6fe73d-519f-46dd-8211-a336549027bb", "comment": "Malware payload", "value": "a861ef18f662c3970ccdaac657abb2895b89c03d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840779, "uuid": "78b70e62-84fa-4756-822d-95ff3ec03db0", "comment": "Malware payload", "value": "d711a619fc3640e877bfbecc1b116ef75e3890fae2e51b939265aff2fb734657ecadb55f2cfc3ec4205e144afc6f6abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840779, "uuid": "596057a7-4419-44d0-bf65-c42e1d9beceb", "value": "T19137BE01B3E841A9E5BBC27885665637DBB17C150730D7CF1694EA691F33BD0AE3A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840779, "uuid": "f6aec8eb-22c8-4857-b73b-24ce67d13d2b", "value": "b819c89ac9b569d0bbb77889674017b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840779, "uuid": "143824df-ea05-4a48-8918-15209b37fd17", "value": "393216:+G251FGAsxevFZx3i8C6+ALRadLxlkux85m++90R5M:+D1Ftd3Wxl8M++90nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840779, "uuid": "d54068f2-1ef1-4988-b724-bc4c6353081a", "value": 23772168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840779, "uuid": "c0ec8a99-f504-45c5-ad22-e77c8ddc714e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840779, "uuid": "3102f719-2bab-487a-b7fd-a8fa8d36fc12", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.107313.25313.25125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dc5927-e602-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710861068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861068, "uuid": "6ebec3b2-0c46-4c2d-91f0-cf6667d2dd40", "comment": "Malware payload (AgentTesla)", "value": "9d4d4f1df0d4d77b94b4961d5a501607", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861068, "uuid": "86bb2cd7-723b-45b8-bb20-ec7b0bcad0d1", "comment": "Malware payload (AgentTesla)", "value": "a0bd73f38df0f20211cc2308c54c72628d551f4f985e02d9c54e35b98e7a70c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861068, "uuid": "51cabaa1-0bea-492b-b04b-a633040818d1", "comment": "Malware payload (AgentTesla)", "value": "49e39601938fc60cc3d98653253924f39004c3ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861068, "uuid": "78e932e4-94da-4b8e-9397-570fd5d20854", "comment": "Malware payload (AgentTesla)", "value": "1624d6f8ce03acc5c33684c07f1b08418ec2f62b35136a51e70f86a85c6ed89ee23b014c8cb6aa5e4e5857edeb724dd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861068, "uuid": "62160258-b7db-4ecc-ae7a-1ff0832c46cb", "value": "T154D42359A2FF17EEE832A23E45A5430117EAE133ACDCFB7A7AD131C947427228514873", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861068, "uuid": "4ebdf931-ef37-4fb4-8e81-abd960cd25de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861068, "uuid": "edac5210-db7b-4be6-a949-385df0918696", "value": "12288:bslS5WFmtMhhg8fY0Hr3E+WdgAMo0VPB9UUeHWpcRHoOJRYWq:Q2W/p3bWdS7VbZeNaOJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710861068, "uuid": "25daf3bd-7f7a-4405-86d5-432e628640db", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710861068, "uuid": "d9280eeb-97bd-4b84-a4da-a18a6ea18ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861068, "uuid": "6a302fe1-0855-4459-a559-a36eada830d2", "value": "PurchaseOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93bf423-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840397, "uuid": "69d736b7-0f9b-47fe-a153-091a5f18bd47", "comment": "Malware payload (Mirai)", "value": "0163cf9a9b38a015e586ef7858c9af17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840397, "uuid": "5624f808-9d13-49f8-a679-580238c2e015", "comment": "Malware payload (Mirai)", "value": "a0d5fad7bfb3eaaa18f47432b6553b871a00eb968a71c735d1c391fab37e38d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840397, "uuid": "0c7ab838-2792-41b0-b198-754aed3f8728", "comment": "Malware payload (Mirai)", "value": "45e842fb78ed246e1ca5f64b3bc5b52143b30353", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840397, "uuid": "b0940a75-bd2b-4eb8-b988-bd5c3ae3a2ac", "comment": "Malware payload (Mirai)", "value": "4264af03a83edb090fc8145b9b4d929ef1984dbd4c7818c5c4351c60067e6c22ce66055a9ae8e93fbb169162e83e8341", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840397, "uuid": "7b4303ad-6f79-4a5e-8fd9-1c5cb4e0c5d4", "value": "T19ED31A06B31C0A47D2A32EF03A3F67D093EFAAC121E4F640355F9A8A9171D365586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840397, "uuid": "3f84de72-ccac-4a3e-a1d9-afb3dbf0bbbe", "value": "1536:YgNTa0YIsHfH1O17bNhexpnv6RruplRbX4Xbr2ovASWW2Qjb1cqcbW4sfHC8:JYIsCVhexRywNXMr6SqsfHC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840397, "uuid": "e8da6d29-289c-45cd-bda9-17e5641ef9fd", "value": 132312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840397, "uuid": "7d97608e-4224-4e58-a439-7aa289a77302", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840397, "uuid": "0aecd931-0ab8-4a48-a0cb-6f985ff7b4c2", "value": "0163cf9a9b38a015e586ef7858c9af17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffbc5bd-e5ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710823873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823873, "uuid": "4544691d-b2bd-4021-9e6c-ecd6ad865bc0", "comment": "Malware payload (Mirai)", "value": "1f406b02cc96446c3bac2d40a66fcb81", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823873, "uuid": "fcb676cc-9f4a-4a3d-a77e-9f420bb01919", "comment": "Malware payload (Mirai)", "value": "a18619ebf97302d1712b85f9594f2dcb0cc3546e9474e4a7cffd67024570cec1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823873, "uuid": "42f2859a-6e1d-4684-8847-c2ee790aa68b", "comment": "Malware payload (Mirai)", "value": "22d660d425c6de7c09a44b7a59a0235be1487766", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823873, "uuid": "948c4e97-15a2-44aa-ba6c-b3194971881f", "comment": "Malware payload (Mirai)", "value": "44821c95eae375466fbdd969ff1e01461b0366daea44da02d0e74f9ed96d34d2e348e499d925d3e07e43ac22bf48fc4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823873, "uuid": "133f2dc0-3872-4604-b895-4e1e73c4062c", "value": "T1E9936CC5F683D4F5E89304B1613AEB339B33F0B52019EA43D7799932ECA1511EA16B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823873, "uuid": "f1330837-cc0c-4932-abb5-8e1648d57581", "value": "1536:xpmWc2AcighsZ82fJxfcvHv1mSsM8qioFgBQ9TnkISGtAd00xZ:xpmX2riED2frfQHtmLFomQ9kVT00x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823873, "uuid": "bf5bdc51-74a7-4555-8487-c81f160f7a9f", "value": 89576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823873, "uuid": "a3f940a5-a0f9-4c63-a4d2-ca389db34f51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823873, "uuid": "d80aa269-f730-4972-b1c8-a2874b85038b", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a6b1a0-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834642, "uuid": "5d2299df-d4af-4c6f-b648-5d2679ff2b3c", "comment": "Malware payload (Mirai)", "value": "8352522adf34c8b6a2d3b84e744c2ce3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834642, "uuid": "a46a1288-6c0b-4021-a94e-fbfc557c3e2a", "comment": "Malware payload (Mirai)", "value": "a2ba788f17f596b59e80237df24000dbb2c05e9a59bfec16a2e8713f5288b50f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834642, "uuid": "5a298d29-7111-4c23-8be0-7a02499e7ea6", "comment": "Malware payload (Mirai)", "value": "615c19dfc550a86120b99687d9737e38612808d6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834642, "uuid": "0d304327-722e-4fa8-8030-b0b866e57eb4", "comment": "Malware payload (Mirai)", "value": "27c17a54fa6b5fa702e17b1ae263684087903f0adf7fe321bb6437adbbbe0d4191a6dc5039857810e1564761e8074998", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834642, "uuid": "cade3041-bf55-4bc5-9ffd-5c36c5bd8bb0", "value": "T15A33191BB981C5FEC59EC138033BA536D432713E023EB2A637E4FB266D86E714A2D545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834642, "uuid": "51fd288b-cbe1-437c-8cae-7f57fbe7b0be", "value": "1536:CHtHILMaZD9lNamPbPORsoIr5AAtKzeMK4:i0t/NamzPOXISaK5K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834642, "uuid": "3b5eab72-fdc0-4c8d-be31-04d05875cc40", "value": 54592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834642, "uuid": "b0205820-09ab-48b5-ae78-66883510ff92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834642, "uuid": "e247e019-5d57-4bd7-a439-d9287ff787bc", "value": "8352522adf34c8b6a2d3b84e744c2ce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6597ea70-e5e4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710847961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847961, "uuid": "8bd93fbc-680a-4fc5-a7e3-df0dfb42239a", "comment": "Malware payload", "value": "eafc565314bcbce3f407980c04864e77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847961, "uuid": "69e366bc-fa71-4851-8c06-548834db6794", "comment": "Malware payload", "value": "a47c91becda74a743f9886a906496a8e8ea6b0078e004b91c2372dec33801a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847961, "uuid": "e7ab95dc-02da-44bd-9eba-a6fab6a4f803", "comment": "Malware payload", "value": "2b8f17abfb33519f13dd6758e6dca08b8d88665d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710847961, "uuid": "8f2e4a11-6780-4ea6-8b12-82958eac3f24", "comment": "Malware payload", "value": "2121bdba4f505cb1151566e3a21e5cb0157024c6ea5a05147085fbc321020628a2c4eba80e1b999cdbf55910ee23792b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847961, "uuid": "a8a40e46-90d7-4a82-8ab1-2c965c63ee46", "value": "T1265533A352A4E623E2910B31DAC9E5F287932FD0FE11819B73FD7FA73539295420D066", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847961, "uuid": "2b92fb93-e0d2-4091-9e14-33a95e18683f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847961, "uuid": "35c3d5a1-f41d-4778-b302-77ea0d5f4f6d", "value": "24576:BluLLUiianJiLzadrSCN3c5gxMcy/oPnm85tQ5EsKMtgyex2ml/:zerJ91N3NxJ/Pm85tZsKC9fmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710847961, "uuid": "d9368890-4108-41c8-bcd1-9e6c83a14aae", "value": 1315720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710847961, "uuid": "4c8d2541-0778-44f2-820e-27267607afe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710847961, "uuid": "07e12be3-b91d-4bdb-93ab-af22b4aee98d", "value": "SecuriteInfo.com.Trojan.PWS.Siggen2.60328.11377.32540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da371e6-e5cc-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837667, "uuid": "e27be3ea-e18e-4ace-b414-c0772166ab76", "comment": "Malware payload (AgentTesla)", "value": "786ccb5f0aad22627b9bcef3259625c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837667, "uuid": "5489c1ca-d63d-4d0c-938d-b28aef3f83f3", "comment": "Malware payload (AgentTesla)", "value": "a546f9b6698ebddb8c6ee9cf0ea57d95e3e09d226105f8b2f520a119fd8697bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837667, "uuid": "c17e24d5-8cdc-450b-8aa9-ea7ec5ce7227", "comment": "Malware payload (AgentTesla)", "value": "7ba43aca4793f7d9d573697e4ae9be8629ae30ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837667, "uuid": "98cc3ece-567e-4cc1-acb2-f842b4343705", "comment": "Malware payload (AgentTesla)", "value": "a6484e20083b17e3d1636b488fe40c58d9bdbff65e41e928a25b60aeca66d76186ad6d57ab8aeecf4d0c01bf661942dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837667, "uuid": "40926acd-4268-4911-b824-4ccb890d5328", "value": "T135D4230472B1EB93CFFB2AF90665495343B6A61A2CC2DA8C5DC875ED76E3F075A00613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837667, "uuid": "c6367253-ccc7-4778-abe8-a5ba2645f02b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837667, "uuid": "b891e10d-b7c8-4c7f-b140-2eb34c2ac2ab", "value": "12288:IlPloOJRYWq0xbSnwhbL036nXpQ2SusxTCmw9zP1Ha8STEiu8MVsvl:29oOJb/xunw1LHXW2xsxszSTEiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837667, "uuid": "77702245-7a90-4d1d-afaa-5e8651619c3b", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837667, "uuid": "6c4de330-24fa-402d-9c38-cebaddce7432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837667, "uuid": "2f554e5a-ea03-4645-89f6-3768174668c4", "value": "RFQ#9623-358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7eb908-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710837448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837448, "uuid": "d7787c35-fadc-4260-99db-1cae14e7899a", "comment": "Malware payload", "value": "11e28d2499f7c530a6b28db768d10a0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837448, "uuid": "5621e8e4-37d0-4db0-b7de-ae299b73bc31", "comment": "Malware payload", "value": "a5c27b8083b31a15602373eab61c9164437aa14f25a2f9aed522f12c3f0b7c39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837448, "uuid": "aeba9225-69d1-4d91-9019-6d79e62aa204", "comment": "Malware payload", "value": "db6501b6c05023719438399da2316044c2836490", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837448, "uuid": "14a396dc-0565-4ac5-8e57-7249fa080a9f", "comment": "Malware payload", "value": "9f946c955f6bd54f83a095fd4a5f390a8999234aa36eb7fbcc567fd73c3844eb8f0b8ed787c4fa61b3c0d9e85523ba07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837448, "uuid": "4b9bd5ab-dc3e-482f-b3e9-60b2fdbd118e", "value": "T1D272D50063E04426FA3689B6D8265B016BB7E67F2E36D62E340D554F3F73061C2A37A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837448, "uuid": "04c3ac98-5444-4f63-bdc3-898d26a3902b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837448, "uuid": "0aef3ca7-6a77-4ae0-9800-34ac4dd06b9f", "value": "384:te0CgZwF8I7qqHxfNjh8WQwsWL6kYcV6qUiJFnh:tNhUU8ZtYcV69izh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837448, "uuid": "d690e8e1-ea26-461e-a089-e3b143d59f28", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837448, "uuid": "24f16b16-fdaa-457e-8551-fd4fbf2fd567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837448, "uuid": "a30d0b75-ab71-4c37-9f89-8d05a6f8e1e8", "value": "11e28d2499f7c530a6b28db768d10a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f416fc20-e5ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1710851636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710851636, "uuid": "a65018dd-6431-4c14-80a5-4a31602d1f7f", "comment": "Malware payload (Rhadamanthys)", "value": "69aa639bcde54be094a7e30637a644b6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710851636, "uuid": "71e5c18b-c496-4779-be86-6369c8108375", "comment": "Malware payload (Rhadamanthys)", "value": "a62a2d2bf6bce86b9a0bf8a43ae74004f94e5e712400a68d2cc062ec72e1fc78", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710851636, "uuid": "90d292e9-cd8b-40b3-86ad-a686abfa3007", "comment": "Malware payload (Rhadamanthys)", "value": "687a8efdcf258db2dcba08f33a710a7862ad8768", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710851636, "uuid": "779d53d4-fa53-4487-b6fd-0bcc810a14a3", "comment": "Malware payload (Rhadamanthys)", "value": "4447ce86511d23d5f580bc5625491f171340575cbf77e8f1dd1800214402d489da41a66fb96f7b3293188ce8a6cd4396", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710851636, "uuid": "cd1d9fd2-3f5a-4391-bc5d-c1631a0b73c5", "value": "T19E665B07ED9185E9C0AAA53089A29263BF717C448B3167D72B60F7383F72BD06E75784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710851636, "uuid": "eac3f49b-c8b2-494f-aae0-982c800200ad", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710851636, "uuid": "f0b33824-2e0c-4af7-b33e-10d5a0ff4aa4", "value": "49152:zYLO6AMhysrKD3izm8qGvnjHMo84zX5utpKwQiLCPlNlXzTxhrjdO5E+ncfGOmBA:KhAMhysIizJZBunKw/L2XKECXbjAWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710851636, "uuid": "0ee0d209-c9d7-48bb-82ee-9acb4af6cdf0", "value": 6722560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710851636, "uuid": "523561c9-eb75-4f72-aab0-e93796b12ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710851636, "uuid": "6f15c608-ccf3-4fcd-a0da-e106d9593255", "value": "69aa639bcde54be094a7e30637a644b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482eca0f-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834597, "uuid": "06eb3299-3354-41ae-b334-7c0ce519c6e9", "comment": "Malware payload (Mirai)", "value": "c3388ca0f275b3308e4ea7d3f7d6f052", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834597, "uuid": "36b3e86f-52a8-43c2-97d2-de863e45a33d", "comment": "Malware payload (Mirai)", "value": "a83a698962df549bc186027024612c5db5c37573f9fe01f6de5e571f760bdb96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834597, "uuid": "169f4587-2fdc-488d-81ff-64efd6c6e3c7", "comment": "Malware payload (Mirai)", "value": "3b0b2299c58c82221900ee3adfb70c844047ae8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834597, "uuid": "8b265b8c-e374-452e-8592-47762d8ff870", "comment": "Malware payload (Mirai)", "value": "2ba65c75d11ee8797dc53893a46d84907df7dcddb48b36a19f9663c63c1d28eab5ff194a6f013d2c5c9824048202d6d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834597, "uuid": "43c44a7b-a249-4977-876d-5f071c7946d4", "value": "T122434BD9B4015C3DFC5FFB7ED4220A0DF660735961830A2B16AAFCA36CB22955D23D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834597, "uuid": "fb57a57d-bf1a-4a71-bbff-45ec28b05940", "value": "1536:Tng2Xtw4KJVqdRFhkLc0/iT99KTHkrWT0h8sn:TngItw4KJgd5T/KEWYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834597, "uuid": "77af0b60-9d5c-4033-a1a8-abcfcc25e4e1", "value": 55888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834597, "uuid": "51a4c0e1-c2a1-48fc-83a2-10331d3d40ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834597, "uuid": "dc8294a7-39f3-4696-a5f6-8a09fe0220a7", "value": "c3388ca0f275b3308e4ea7d3f7d6f052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a5272c-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710837066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837066, "uuid": "3e0412ab-2565-400e-b7f1-338b9cb8fc77", "comment": "Malware payload (RemcosRAT)", "value": "ff269ad34d024e7750b44eca3c879904", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837066, "uuid": "89853a6e-f087-424a-929d-065f1bcfa4d0", "comment": "Malware payload (RemcosRAT)", "value": "a9312a9b930e013dd4a72cdbb35d121de40fc3d6daf598bb4a73a0ef566c5b6f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837066, "uuid": "bbf2da53-9561-4f90-95e3-9858c08f07e2", "comment": "Malware payload (RemcosRAT)", "value": "83e96d54af11f516455954b6116846e03fd5a616", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837066, "uuid": "37904d5b-90e1-46b3-a896-5164eee4ba00", "comment": "Malware payload (RemcosRAT)", "value": "c956831dab7cdfb2b85b1186551a848af9d27d4f5be7ba028e0b9cb7e3b62e7fc598dc4769ab81c270f00e76e62566f9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837066, "uuid": "034fa36b-a6da-46d7-bf9d-aecf55e0fc0f", "value": "T1179291D38B062B85ED0B2BE958F8EC03D0E0C41FA13D085AE9585354F6DECD99D674D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837066, "uuid": "189a2189-66e8-4536-ae9d-7dbd96223b50", "value": "384:CE685cSTZniRUeNIynzeLCB0++8J0EvPVGZovYG41s8EGgT:H685c29iR7IwzeR20WPVGx1aGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837066, "uuid": "b3b4392d-98db-462d-87cb-46f6de64365f", "value": 20923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837066, "uuid": "5a9df64a-c727-4702-8bac-ecf4424026d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837066, "uuid": "26cd8716-6d4d-42bc-90df-1fd6fa87e581", "value": "B0480571348\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38baa6e-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710836979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836979, "uuid": "47a58107-27c1-44ac-ac0e-dc680f9afe5a", "comment": "Malware payload (AgentTesla)", "value": "29bb88596d13251ffbe4308038551762", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836979, "uuid": "340d4b17-d97a-4b07-b17d-e5a47dc1e856", "comment": "Malware payload (AgentTesla)", "value": "a9b65628029d712ca8aa767fe9427c04afde4eb9902b516a33f54bf93b3abe64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836979, "uuid": "7486968b-64d5-4eeb-847c-e86436d7e1c1", "comment": "Malware payload (AgentTesla)", "value": "eca55de7d02c191d984d733647a5eb7275ebdc54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836979, "uuid": "83d6beb1-4cf2-4cc8-8cb8-85cc9fff9290", "comment": "Malware payload (AgentTesla)", "value": "c58439cd93515cb27d7a93421a34233c652c295e7bdda7c44c4f29b920dce23e0cedef43f053d153c4c0922e2df74322", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836979, "uuid": "fd2af5ca-723a-4baf-a8e0-111fccafc6a6", "value": "T106D4231094749B32F84947B2ADA85E635B3AD3B704F7DB34FE84A28599F0786CD0528B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836979, "uuid": "0050689b-e110-4a75-b9be-eb27fae4afcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836979, "uuid": "df2c48a3-a228-450b-93b0-daae312be826", "value": "12288:yvO+2XXnt2B5wB2MbSxm4ggCuZR2vyavDSAdIPHa3YWgRh:yvO+Bq2W4ggCbvPWAdqOYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836979, "uuid": "23041a01-9799-423a-831d-0b704dc3c930", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836979, "uuid": "1f494c8d-36e7-450f-85b1-785203516a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836979, "uuid": "ffe574fc-5885-4519-af7b-e2b9664ef909", "value": "dekont_HALK BANKASI Mobil \u015eubesi ..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d86655d-e5a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710819279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819279, "uuid": "0c5cd7f7-cb25-4a57-b44f-36c2b58eb3bd", "comment": "Malware payload", "value": "2a326fd62e23dfedc2d71e007cf27616", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819279, "uuid": "3473c57a-addf-440d-9e1c-13b40524e38a", "comment": "Malware payload", "value": "ab50192dbf963fa8fb8ce889170de90c729a624b5724fb8078b7960d3e94f078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819279, "uuid": "be83633c-1593-48c1-91f4-1de6145f0d38", "comment": "Malware payload", "value": "e07a8c0b9d55db22acb58385c45959125ec11831", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710819279, "uuid": "6829b9eb-ae30-4b0c-90a3-8a4ddf44ad7a", "comment": "Malware payload", "value": "05159cbe9cdece5f531e51df699b33a4a830a5147b2742222024beae3f69f90f14089de0e35234a0e01e7bd44d37b384", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819279, "uuid": "2765ca30-8e80-4cef-b2a1-70becc39dd61", "value": "T1E392C74FE3C4CD3ECDE8533684AB43325376E064A77193272B10A17A0D633985E6BDA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819279, "uuid": "b92d489f-441b-4245-a6a0-cf6a7c4c9d9a", "value": "192:RG8owDGhkh0avE8UMkc0a5cSW14XQTEKklQWGbD0hbL4nwiskuvifm:RGhkh0avE8UMkc0aOSWSg4KklQWS3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710819279, "uuid": "cc090e93-c897-41a9-b69c-e75d05bbb34b", "value": 20048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710819279, "uuid": "72e523e8-524f-4d35-b50f-c364fc12b4f9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710819279, "uuid": "b613409e-d9a3-4108-a828-53241961371c", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.24820.16602.28226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9430e3-e5bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710832167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832167, "uuid": "7ede5495-106a-43ee-a2b7-6e398c630dcd", "comment": "Malware payload (AgentTesla)", "value": "be4152bd4bce0f2549085336ec684e7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832167, "uuid": "0caf69d0-e74d-4514-a186-cb2453df1f93", "comment": "Malware payload (AgentTesla)", "value": "aca0a4c82fb2575678e1bfbf0ac200f24e9ae1e95db27a37868bb592c7f62906", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832167, "uuid": "aa326bab-83e8-425f-9911-0e9dc1c6af3e", "comment": "Malware payload (AgentTesla)", "value": "825b3d23c5db1974979f3d25813eb5ffa7bd7bf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832167, "uuid": "4ecbe73f-3bfe-4a39-a121-e86a34886e38", "comment": "Malware payload (AgentTesla)", "value": "33410711192ce0e5544b0527c4a37db3da4aaa37d5b356942d7fa2798f3923ac98e8b44077cea85e1d45bf1895bbc880", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832167, "uuid": "f7285758-98a4-4b59-b22c-10d266eba742", "value": "T102D42319757ED793EB3A65F0048E0B6307B9074202C7EEEC9CA218AD44DBF814B66727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832167, "uuid": "0b67529a-4000-4fac-bb15-d87c2322d0b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832167, "uuid": "ca754df6-64f7-4727-8f1f-0a69606acbc7", "value": "12288:8lPloOJRYWqX89cNMe4m4ygwbiRt4ozOF46Aae0ChULkAMXqBEXG9vl:i9oOJbZ9cNMe4mfaD42Ge3NaBEW9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710832167, "uuid": "ac1f780f-f6a0-4895-a5ff-679488e246a1", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710832167, "uuid": "b15f177a-3fc9-4eff-93b9-0d728f63708f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832167, "uuid": "948667c7-d664-4236-9cf5-c445d4907ca4", "value": "QT 0905752_AC_SY780093887623645-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6deacebe-e60e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710866014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866014, "uuid": "a2aa54b7-147b-4e9a-a0dc-0c5353003499", "comment": "Malware payload", "value": "640adef78ab2704b25f4248158e3ac57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866014, "uuid": "d5a64c4b-d093-4c62-ba86-98a68b4fb8b3", "comment": "Malware payload", "value": "ae99b44516ea3a0e34e04d9c0c2768816823871413fc708e949c08100cdd7b96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866014, "uuid": "ad2f08aa-078f-446f-8811-971955e980a4", "comment": "Malware payload", "value": "c4547c48807f4db719b743e04a415f1d1fe34f3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866014, "uuid": "05ac25fe-0ca9-4372-954b-b7ed13ef8382", "comment": "Malware payload", "value": "6a52df24a92c3ccfdb037581fc53fa1c712d7fa415569c70f33f704401ea0ca3ce6d1d9016288617281d7158ddd5677e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866014, "uuid": "fa22c7ef-86a7-4044-9b93-67581c45a510", "value": "T1D003F1D7E50CC5B5FFB01575EE2B4043924B2CADE8849022E7A0407F1BE22F17A9D5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866014, "uuid": "d48fe71d-5b25-4dfe-878b-2a219110a2f4", "value": "768:DkJ56p6b4LMXOPAppDyVsgrgepgy52Q8Lw956eKpNbq3U7VZ:+4p6b4Q+PGGVsgrFz6w956bpN/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866014, "uuid": "c8f524a7-c2bc-4dcf-b9ed-98c0eac275d0", "value": 40876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866014, "uuid": "14b71349-b7b5-4dd0-97a5-d89fa6334fe1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866014, "uuid": "357b2021-c9bd-4e4d-8fc2-388714dabe98", "value": "640adef78ab2704b25f4248158e3ac57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec409a1-e60d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710865720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865720, "uuid": "24479a6e-32b3-497f-a4f5-9f12aa5fe9cd", "comment": "Malware payload (Mirai)", "value": "4003acc377857fa007a2c78355d92885", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865720, "uuid": "53c9a08e-8976-4723-b98f-f011a9debdf9", "comment": "Malware payload (Mirai)", "value": "afa9cefa970260c3fed6abe9ec1e3cb5c44f319dd5c370729c43fe43ded2dabb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865720, "uuid": "f47aeecf-09f6-4301-8dfe-caef5219f8a5", "comment": "Malware payload (Mirai)", "value": "14968dc8cd41730e2b8e9ba11dac1016393d73ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865720, "uuid": "7d238ec3-a29d-4fb6-bfce-86faf9a518d0", "comment": "Malware payload (Mirai)", "value": "033a10bf47e650cce5d0da54c0ca25a7d252e1bd72331a74f3f735f7da16818bdd5618c061d5570190fd83641dbbfcd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865720, "uuid": "3d4cc264-14b6-494f-a201-7a252152de11", "value": "T189F33AC7F800DEBEF80AE33A48130905B130B7D211925B377297797BED3A1991967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865720, "uuid": "cf4a7249-c7dd-4b04-b7d1-2cfc1784caff", "value": "3072:EkAawtog2sX7z2W1t+M3ySnR7AtuVrjbimLlJZ78Kyyaumw:jAMGD+MiSFAt4LlJF3yy3mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710865720, "uuid": "c5fed810-458d-4dfc-877c-fd427c26fb11", "value": 162272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710865720, "uuid": "1be6d1c2-b368-469a-a5e2-cc5b988843e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865720, "uuid": "645d960f-7f32-49ba-b852-95ee49e01515", "value": "4003acc377857fa007a2c78355d92885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756ec606-e5a4-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710820500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820500, "uuid": "34b33c10-b662-4192-9f97-5e195d93b0c2", "comment": "Malware payload (RedLineStealer)", "value": "c084d6f6ba40534fbfc5a64b21ef99ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820500, "uuid": "b5f15d93-bbc6-4bb2-a43f-61b370158f5e", "comment": "Malware payload (RedLineStealer)", "value": "afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820500, "uuid": "ba2d778d-1f49-4016-98b1-69df8b64be0c", "comment": "Malware payload (RedLineStealer)", "value": "0b4a17da83c0a8abbc8fab321931d5447b32b720", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820500, "uuid": "b6bcd1f1-9e77-4249-a830-9439c42fbe8c", "comment": "Malware payload (RedLineStealer)", "value": "136226097d56cbd88ddb5a261faa2c3f94d1c1392695d08e872c14fc9b0182db85f83e50838cdb7d58fec8dfc7321cbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820500, "uuid": "c51f2fae-0a0f-41e3-8c8d-f9779dc76f03", "value": "T133A4BEE4927BCE66DBDC13FC64626A0197BD4A89DBD3F708585408FA8C16381D1239FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820500, "uuid": "5912ccca-f316-400f-9137-efe19965d45f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820500, "uuid": "d7805cd4-0cf5-4a12-85e3-3f2c7aefb90a", "value": "6144:h0N6TGtpSTJWG3/ss3pVlIp7dwx+r7nF0l79bAh54QcJNSd1LLNI94sfPfJ/+lw+:hfGtWJdLPlEXvOlmj4QcJNS7LRgJhXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710820500, "uuid": "95696cd7-b810-4bdb-a981-827674e25d22", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710820500, "uuid": "1846fc48-4b4a-47ac-ab83-8fa804dc3a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820500, "uuid": "accc644f-c095-42e6-a807-73d3105bf8fd", "value": "c084d6f6ba40534fbfc5a64b21ef99ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc37016-e643-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710888750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710888750, "uuid": "fc6a40e3-eb38-4d87-a839-bfcb13367249", "comment": "Malware payload", "value": "960eb4d74f0f0c05c4c43ce1e98bf571", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710888750, "uuid": "a3089c29-2fc8-43ef-8bd8-c2968f5cc178", "comment": "Malware payload", "value": "b03aa6bdff66cb4a9114ebb3615f07af455b474f7af998cd35ba47f84bbf05b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710888750, "uuid": "36363ffc-16b9-4de8-b393-c6ff630faf6a", "comment": "Malware payload", "value": "9739d9e27dbc19091eeadc3c6d18d3f3d351bff1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710888750, "uuid": "c0068195-82b8-4402-8e28-897a3aabedc6", "comment": "Malware payload", "value": "2dcc6bc059481a06d8aac921f2dae78ba308e1a70dfbbbdbf6ee222f784e9006cb675996c2c80a4d8940c60c1262cd15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710888750, "uuid": "768747bb-0da4-46fa-8977-6dc451e5a825", "value": "T1D374AEE4657BCD26EBEC43B960555A01A77D468AEFD3F709601404E08807B82DA63EFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710888750, "uuid": "22363720-da99-4ba1-bd20-9d618cf138ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710888750, "uuid": "dff6c840-32bc-424e-860a-7bcfd1052f50", "value": "6144:43kc+V5W0MPeogbh0HWE0J98gBzl6e/u:u4MG+eSgBzlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710888750, "uuid": "24595c44-16aa-4ba1-b3d8-16310a6d89df", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710888750, "uuid": "91622098-9b9a-407d-9087-5743a439b077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710888750, "uuid": "5f8366f3-e0bd-4e3c-8948-4c914ba56a02", "value": "960eb4d74f0f0c05c4c43ce1e98bf571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b468313-e613-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710868184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868184, "uuid": "ee5eaef1-66da-4813-8851-0caecff25dd2", "comment": "Malware payload (AsyncRAT)", "value": "f878d57ebaf7ecb49c55d50207b33b60", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868184, "uuid": "0b4aa051-b159-486e-abb1-53216a3d3e94", "comment": "Malware payload (AsyncRAT)", "value": "b096918eb312d3ae41a05ed801cc0c07cb2eae17778012e849a41c1d915ebce7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868184, "uuid": "ce6be456-39a2-4a6f-9e6b-4adc05d1753d", "comment": "Malware payload (AsyncRAT)", "value": "11d3c0062c63684da758757d7f813b7ca03d7089", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868184, "uuid": "81323642-0ccd-4cff-96b7-599209528662", "comment": "Malware payload (AsyncRAT)", "value": "23478e50a0ca6415e273899683cad5d723cb087710119b555d7fe9eaf6a60806c5c4b6c755f4835562da4a25a7c62e7a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868184, "uuid": "207a2c30-4504-4d93-b21d-806e97aaafcc", "value": "T182734B013BE88D2AF2AE47B9ACF256074EF4D1576512CE5E3CC440CD5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868184, "uuid": "c5987915-9175-40ff-bdd5-a8483682b9e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868184, "uuid": "642d2550-e5fc-416d-aa47-3a884d29b7a7", "value": "1536:LUk0cxVGlCBiPMVye9VdQuDI6H1bf/ZHUoIQzc+LVclN:LURcxVMWiPMVye9VdQsH1bfBHHIQXBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710868184, "uuid": "53b58ac2-92f6-4a23-b883-657e34280e35", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710868184, "uuid": "33cee639-a558-4743-8627-4d6256905562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868184, "uuid": "0ce22fe0-0509-40bc-8cd5-abede27c12b6", "value": "bUjO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a1608f-e5c4-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1710834133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834133, "uuid": "fe4fc466-7717-42e8-a6be-6c014e7df29e", "comment": "Malware payload (QuasarRAT)", "value": "2de2cbb979a3b9291b5343339a87a304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834133, "uuid": "886f3a16-5f6a-4960-96de-9ad4e2e49c38", "comment": "Malware payload (QuasarRAT)", "value": "b108344a4bdd297bc875c4da54162c753b1b104abb1e5383b2ed348fea2a0eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834133, "uuid": "b7932d77-ecae-4552-b0de-40980cc3ab2d", "comment": "Malware payload (QuasarRAT)", "value": "5d9c9b6b03d7ba016c45c2b596e39857545d365c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834133, "uuid": "9e5fe795-227c-4aef-92a4-7c2eb6a33541", "comment": "Malware payload (QuasarRAT)", "value": "191e41d536f16169913b815c25f3e92b5038a274b18a3c6cfd7261f6dadcb4642ac8e588a230846f5fbeab50eaed6803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834133, "uuid": "31323634-c029-426a-a079-275f7af4570b", "value": "T131266C14ABF88E26D9AF9776E5B2040257F1F89D7363DB0B2580B6BD2C43B504E413A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834133, "uuid": "79665683-e8b9-4317-a951-4dc87539b941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834133, "uuid": "c3ae5904-e1a3-4dc1-9267-9abb6377648c", "value": "49152:y0wO2S0vjTqpi90TCJ/TCr3xBooZEKZ+WijUs+9VBMsXUK/2HHBX2ehgNTIGs0:y0m/vjTqgGr3xfZF+W4X+80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834133, "uuid": "859f5400-fcba-499e-8361-88eb8224cbab", "value": 4623872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834133, "uuid": "b09200e6-02a6-40db-985f-5ba19d7b121f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834133, "uuid": "3bb99296-5d9c-4d4b-b40f-a11af63c6834", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0047ba15-e5bf-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710831900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831900, "uuid": "e8215593-d5d6-4ac5-a52d-b2ad83653cca", "comment": "Malware payload (RemcosRAT)", "value": "7701e5bb49c897e9be58f3cae4dabd49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831900, "uuid": "d3184bdf-abae-4a1a-956c-6765b8717697", "comment": "Malware payload (RemcosRAT)", "value": "b14204aeb77d953ff920cd89aef1793bfd0629a96984d5a130220d62760f3415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831900, "uuid": "f6fd3680-1a44-4c59-831c-3574f8115c35", "comment": "Malware payload (RemcosRAT)", "value": "7f2d9fb30450b0715d1c1379bf250fc4bd6399d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831900, "uuid": "8b629732-b771-447a-9e21-a18047c85b10", "comment": "Malware payload (RemcosRAT)", "value": "14bc5420478d7dbd5615c3fdeb3d7dfb4598820456c9e8840a6fc5b368cd625ab70801ca72e2d28d46a41a2c2dad6297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831900, "uuid": "b933b0bc-bfe3-4ec4-bb53-f5d0647ef92d", "value": "T18A83A34BB70C47AED79D8AF2B83A02704328DF931546AD59BDC8FD6E057274C2A132E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831900, "uuid": "2ed6ff7a-6b76-4037-9b71-40b19f4dc02d", "value": "768:MfHU1344szr1aCE0Ho1qOb+3SBs9uQjr:SCI4cRxE0Ho8as9Pjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710831900, "uuid": "9ca745f1-b3b6-4a5f-ae10-164dc8150262", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710831900, "uuid": "06cfc612-6cff-43ca-a3a6-3b5f23bdbccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831900, "uuid": "ea5f45c3-5b27-4fb1-959c-d8aa620e494f", "value": "INQUIRY#46789_MARCH24_WaagnerBiro_Bridge_Gulf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c79558-e5d3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710840771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840771, "uuid": "4201ba20-d45b-43c4-b8d6-92c3f2e69134", "comment": "Malware payload", "value": "c5fce184348a776aee596e4738d7584f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840771, "uuid": "c742a329-5ef2-46b0-971a-a2faa8161d2c", "comment": "Malware payload", "value": "b1a563bee27e00382284b0e7e7300e632b53ad4c7b122140fbdc22f741e6aa82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840771, "uuid": "62c6933d-41ee-4920-9f30-af72e6fbdf0f", "comment": "Malware payload", "value": "30f0c02673aa9b1fe1bc7a0c2a0ef6617fad855b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840771, "uuid": "5e9e3e0b-2aa2-4daf-9de9-59d6b2e8f198", "comment": "Malware payload", "value": "f0a1c9802c439b32d4f07a79c93a4da2c46d0cc842c750468dcabb4a8de86523653595fc7ce9830e248df40e93c0e5e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840771, "uuid": "5035954f-72c6-4ed9-b1e8-5eb329aca852", "value": "T1F192E0D6464669D2C0A42170206F55D111C2FB53729BA79BEE7FC4F28293E82FDBBB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840771, "uuid": "e99044ae-2aeb-499a-b570-bfe970fa3d05", "value": "384:L7/3OQ4+CCryYsCsVH6bpnqOA03KbsSoNM6rhjiyW/aM4oIxw5Dj6I:P/3OQvVsCsVHuBq4a1oNLrhW9T4ydj6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840771, "uuid": "45c90e37-d9b2-46d1-90ca-e0f1aada62ad", "value": 19372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840771, "uuid": "840cc735-052d-48ed-afaf-7750be30794a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840771, "uuid": "ec6a207b-7c90-4dad-988a-3e13642ac871", "value": "SecuriteInfo.com.Linux.Siggen.9999.31261.30157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ab7bea-e58e-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710810915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710810915, "uuid": "2e80b7b4-0b82-44ad-8c69-85ce26b638ea", "comment": "Malware payload (RiseProStealer)", "value": "5dee81665d52f2fbbfbd78fd87d3ec28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710810915, "uuid": "10ac7be6-6704-4dad-9a0a-c807ac04ebf8", "comment": "Malware payload (RiseProStealer)", "value": "b1bb37dd8373d6658ee5d8cec09797d6a3c4ebbf7238cc7dee40945323c2827b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710810915, "uuid": "5eb47fa7-f850-4188-9644-9fe5a8a1d350", "comment": "Malware payload (RiseProStealer)", "value": "d38e59be6d45f2124db4d9f023451f12712d03eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710810915, "uuid": "95866bbc-5e51-4a12-a84c-e43fd87977d9", "comment": "Malware payload (RiseProStealer)", "value": "3d945400a5088724db88ddb53d5ee6717f5bea3decef7dbf098dbb44fd82e65af2bd728ba5594c775f3e00093888b08a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710810915, "uuid": "93a1823e-a8bf-4fe5-ac57-668cd02000e0", "value": "T151A5338AAC241439C474B2730B6E674F5F339DBA7890D7B1308D66642E7162F1BB2F49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710810915, "uuid": "c9899e64-324d-42b5-b9b4-82430a8a9c77", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710810915, "uuid": "08488f77-a8e9-4048-aec5-857fd7b24d4a", "value": "49152:Y7x9bpL0tbnpZPyGw5wZoJINy/It9DqIxAnL/TK3/:AzbpLGbnP05moyNyUh+nXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710810915, "uuid": "05301c2d-6712-41d8-b5a5-d25db175c6b7", "value": 2095104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710810915, "uuid": "a90ec792-d25f-486a-bfae-a96f1de5bf2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710810915, "uuid": "c409927f-4e18-4067-a726-b9268f1ef83c", "value": "5dee81665d52f2fbbfbd78fd87d3ec28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38ddc82-e5f9-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710857165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857165, "uuid": "66e56843-9459-4994-b32b-daf751302dbe", "comment": "Malware payload (PureLogStealer)", "value": "537c811241dd180a6c950d208520c6a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857165, "uuid": "98ce86a6-de07-4b4c-8a9d-c8a24212e689", "comment": "Malware payload (PureLogStealer)", "value": "b1e5a8d601ddf099e3e25c1cc2e2c65f471002dbdd4df1241ac5d014f163cd25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857165, "uuid": "d0a8bcb3-a37a-4b70-89ee-5c07b3b0fc36", "comment": "Malware payload (PureLogStealer)", "value": "748d1a1c07b106f065b0c1691ad88bed2a14233f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857165, "uuid": "e20e0202-e7ad-4a9c-8623-601f3723903a", "comment": "Malware payload (PureLogStealer)", "value": "60986c0f4fafdd7ffc3098031ecc44cffee4e91f40c7cf62c8c834d4c819e44ed717393c527a95092d50fcdaa6ebd032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857165, "uuid": "d933c1de-e6f2-4774-a3bb-e26c7e55f11e", "value": "T1C074AFE4667BCE66EBEC43B860559A01A77D4986DFD3F709601408E58903B82C613EFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857165, "uuid": "1dbcd972-5807-4a7b-a7c8-db82b68ffc14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857165, "uuid": "b5f2c999-3a76-45da-a165-0df4a790869c", "value": "6144:7ntVu+z4DpPFPdv1PgQBvnsKghTzHEWG5EHLxy+AE:7Z8nPdvlIDHLxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710857165, "uuid": "43c1bf7c-7914-416a-b833-39257f2b8949", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710857165, "uuid": "74617ee0-03f3-4326-ab1c-1c380d19434c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857165, "uuid": "400f645e-f12b-4d8d-bcf5-d6fca3ced3ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57360f1-e5e5-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1710848605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710848605, "uuid": "213aca2c-1344-4d05-9ff3-3f286948ff19", "comment": "Malware payload (QuasarRAT)", "value": "f319a0df44a2c8f90cdd7377955553f5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710848605, "uuid": "693af734-5434-4a1a-b3a3-a0167d7a0e27", "comment": "Malware payload (QuasarRAT)", "value": "b2ac73060b0d8fd731ebf79beefc02b79ffacc6262a57790e365db9f9cddd960", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710848605, "uuid": "8e0b1305-281e-43ca-8f4f-314a7a40e3ad", "comment": "Malware payload (QuasarRAT)", "value": "392e4e1743f11f241ba0057e11bedd6bc4c56eaf", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710848605, "uuid": "e2cb564d-70f8-4c95-bff2-bd7984d8913f", "comment": "Malware payload (QuasarRAT)", "value": "f8f025b182d64b9e201364bafac8a8043dc8a880a68abc21b9fc8d0bb68057cd2886af3c24ee11e08884c58d980a6892", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710848605, "uuid": "a1738459-e85a-4ef1-9dc3-362b5cc0e9b1", "value": "T11106BE142BAA251E31E6EB4B1EC5BCBD8E49F763E1D920B7541E024B5312D00BF993F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710848605, "uuid": "4a569490-d4a7-4d56-9ba1-ac3273039897", "value": "12288:+80rjp4ZEbqWo/65t++SxPDViVi11vtUNoMLpCgrkm7vwAeu7Bs6F3XLLx+mLhRf:pgoUUdnmEaDx8SYb8OkWEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710848605, "uuid": "61cf9ff4-0835-42d4-9af0-5f66f66d40e6", "value": 3812674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710848605, "uuid": "54246b10-a2d8-40db-bebd-51679151c543", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710848605, "uuid": "f46c0220-602b-4841-8538-3b247797369a", "value": "eyiqd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242a58f4-e5e1-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1710846563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710846563, "uuid": "9477e78b-34a5-4311-9690-baaeedd5295c", "comment": "Malware payload (IRATA)", "value": "245004efafacaa64add5ce3aa63af05e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710846563, "uuid": "376e872f-2651-44de-b84f-c146fe4affc3", "comment": "Malware payload (IRATA)", "value": "b2becb9ae44822f4786e28fc66392763e3e04ee9fd2bb40a8268bcb3b61fa21e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710846563, "uuid": "51ddaf92-ddcc-498a-8bbc-0017bc4938c5", "comment": "Malware payload (IRATA)", "value": "93737ec69a02ea252cacaf617670d98f44cdc652", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710846563, "uuid": "14fffed7-d54c-4a36-b5a9-56ce7be0ca7a", "comment": "Malware payload (IRATA)", "value": "50f2be88cc396915dd299a5a7583394f07cbbc1d663b77141caed71d744ef1e1ee1d3bee71109be6b8cb5ced020b9117", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710846563, "uuid": "1657c6ac-3c4e-4a1a-b611-1e25a3fc59f7", "value": "T13ED52263F336A827C9F6C37232642636257B5D24DB03A746694833FD69BBED84B421C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710846563, "uuid": "3f9e7dd0-0d5f-46b0-8c9b-d5dae982334b", "value": "49152:g/ijZrOqMm7a+6OdNuFpIxlyoiNVAamJDW6iJXH1AKxbgIEr7IiWWpL+R:uPm7X6cNuFklyxNVqxiJNxbLojL+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710846563, "uuid": "85689237-b243-450f-b94d-1799d2bd5fcb", "value": 2961986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710846563, "uuid": "7592f4fb-80ed-495e-9823-3e83b4becebe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710846563, "uuid": "7a7bd71e-4fd8-43bd-8873-97524c3d313e", "value": "Application.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f5b325-e5fa-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710857466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857466, "uuid": "05356e0a-749d-4a9b-a025-be83aff7e895", "comment": "Malware payload", "value": "032c7f5d38908e2e5d95b0bc67bb1ef3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857466, "uuid": "399ab7cc-9db7-4de0-8abc-aa50b545b380", "comment": "Malware payload", "value": "b3cc26ceb4bc938eeeda72f794a74ad7c3e2fd129f1bdd42a34c32639b22ff43", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857466, "uuid": "7d3c7688-5775-4470-ab27-aa74767a0797", "comment": "Malware payload", "value": "a08bca0816adb3eac6b3324f1bb1babcc64b639e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857466, "uuid": "d723abbe-16b0-4907-a792-66e1b50ae892", "comment": "Malware payload", "value": "ef7af926d2154da33df51183f8444dbd883b98170e9590f5ea8defcc58832461711fab59a4cd5107ee00d0cce9a54336", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857466, "uuid": "8f109625-8157-45ec-9d0e-68824848646e", "value": "T10943D018E74ACCE1C660A575044F177A3735A180CBC0FF4E8EB9AC760BC67A92F5A8D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857466, "uuid": "4c5b41cb-45cf-4d0f-8db4-b5aab77d0445", "value": "768:bnrZ932qpaOKFSGOJdGvoZCPAUJ1YxBardD2TSWGdCIKD13zegYN1T/pamp:5J2u4OPKIxoEuDKNzexTRamp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710857466, "uuid": "d271c88b-40ef-4a0f-8114-4e0eb9ebd4a3", "value": 58886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710857466, "uuid": "6056c4ed-e7c8-4cc4-9099-a910ed086db9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857466, "uuid": "d0a856f8-ab06-45da-b5a5-46dec1dea41a", "value": "attach#5514-18-03-2024.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9261be09-e5f9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710857056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857056, "uuid": "d582736e-e669-4232-9f1c-bcf7d1a5d4e3", "comment": "Malware payload", "value": "556f915427f10659a255d34a0e820268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idk", "colour": "#0A64DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857056, "uuid": "0532f91d-2fd4-4951-9c73-807b9276055e", "comment": "Malware payload", "value": "b4839774b9c6a81981dff72303d839b618d09c6f26754cfdfd774e60bc30ae0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idk", "colour": "#0A64DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857056, "uuid": "01f2c11c-47f4-4bf1-b205-032cebf37b05", "comment": "Malware payload", "value": "a0b88f851dd2473f69946382cfdc64610758fb89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idk", "colour": "#0A64DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857056, "uuid": "690c01bf-1756-4ca0-aaa7-54462d8ecea0", "comment": "Malware payload", "value": "e246004c00a94996018e206b0e2f527a6264ab4da9d5e5f5cd36a1a2ca66d8112b4804ab4aea0224e9b8d97b8ac56235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "idk", "colour": "#0A64DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857056, "uuid": "b82a3ee9-145f-4831-b843-a2fe3599dc22", "value": "T13C5633A963F119FADC29C23CD591CD20A7B2B85607B0D7CB03E485673F13A95A83E716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857056, "uuid": "3c59b211-3ed6-41ac-b07f-69103a369c37", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857056, "uuid": "af1ea4ef-5766-4bdb-bfd8-b3548729bff7", "value": "196608:tnE7bxbAQnwejuJDUX47dwdW0LB4nCrD:KxnaUX47d4io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710857056, "uuid": "e0c2e80d-9bd9-4e8d-bbb4-e06a40dcd56b", "value": 6444186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710857056, "uuid": "a5718da4-de02-4cd9-a597-3dc9d4779934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857056, "uuid": "4c15852e-180b-4d06-81f4-798285a6d162", "value": "testmalevolo_puoi_aprire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f97080-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710854265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854265, "uuid": "a2ef837a-e2d1-4ba7-b952-6328e5949ade", "comment": "Malware payload (AgentTesla)", "value": "4fb18356be921b6fee60e0d7ad4a5c76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854265, "uuid": "c2479600-00cb-495c-a1ee-98fae2b4394f", "comment": "Malware payload (AgentTesla)", "value": "b596c4221d9ac6bfc591a7ab0e903264fae47d72267d1ea2ebc72895355e9dc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854265, "uuid": "fce25866-8588-40ce-9649-e10a717540d8", "comment": "Malware payload (AgentTesla)", "value": "36853461322a7505ea32013a17ec181930e87405", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854265, "uuid": "eab66a5d-fd83-4769-9a4d-7956bea1cb54", "comment": "Malware payload (AgentTesla)", "value": "8db371d1ce588b30585bab4bce53f028145219765f58f6ea0e50fe46b1b370a7f1706264a67b15c0508b62759404c212", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854265, "uuid": "45a6329d-7a2a-436f-8a28-13280847f698", "value": "T130D423DEB56577C0670AE2E07ECF486412F79FEA1ACA07520E43BCE1459B8901377A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854265, "uuid": "b62f77c5-1ee3-4824-b85c-b449b1c95c66", "value": "12288:mdK7FUkmbCXuWPZV4z34/GpkjIlEq+99YHFw4ZdDRVG/Rfq8pl:R7tJu+Zez34+pwIlEq+99YpZpGE8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854265, "uuid": "135b6df0-84ed-45eb-beef-25ee041f49b8", "value": 619844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854265, "uuid": "dcea5317-0b19-48f7-9a3b-9e17e51a5b1c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854265, "uuid": "2ce28081-5884-44b7-9afe-721a3359a415", "value": "n2024000000025 scan_Price Offer - 10523 2023935164- BUET 100%.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5a32b4-e5c9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710836453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836453, "uuid": "8a07d228-9dfa-416f-b197-54c53feea7fa", "comment": "Malware payload (AgentTesla)", "value": "e1a4c35915d41d959fdf286da81afedb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836453, "uuid": "567838aa-92b7-414b-9cb5-d7963f2dd818", "comment": "Malware payload (AgentTesla)", "value": "b5a3eceab417c5abf76678d3c3bb087c4b923b2c32a3620407ac266e090308bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836453, "uuid": "b763b088-2370-46a8-8df6-53b59e285e68", "comment": "Malware payload (AgentTesla)", "value": "60ef2a2a370ce3855c7b249462dc5584aeba5161", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836453, "uuid": "c2433dbb-6a6f-49ed-a956-42ca0aff8791", "comment": "Malware payload (AgentTesla)", "value": "f66b9a95d460b84729414769eb8a5d923c560d54613196141b1fcc3f327bc3b424f01cbaf7396d0f19002fffab7a1725", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836453, "uuid": "3a63b135-15e3-40aa-a0f7-481bd39dff9c", "value": "T17084D052FEDA9A51D8A410FBA8357DCD21A12E48C9CBB1F862FC794DCC322D2FE58505", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836453, "uuid": "c76d2e8b-b806-468c-a0f6-039da0dac2ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836453, "uuid": "684e1269-d05d-4e63-b858-d0c72380bb6a", "value": "6144:Y59wN26uzKsZax2DhLFs5XA45DtRk3FresAPGWAq5OIWcUSmR:YNHzxZax2VBsxA4t8csAjA0O/cUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836453, "uuid": "1d715f7b-9581-4336-a7d3-766397c06827", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836453, "uuid": "32a9ec88-008f-483a-bc12-e5b13c2d33a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836453, "uuid": "ecf7ac8a-7855-4bce-b492-cc35ea38fd7c", "value": "OUU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5381fcb5-e5ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710823879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823879, "uuid": "f4ff37dd-71dd-483f-ba83-fad89e369c39", "comment": "Malware payload (Mirai)", "value": "be408e010565253f0e6877c1c8690428", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823879, "uuid": "cf2155ff-69dc-4eb5-bfb3-888c07962731", "comment": "Malware payload (Mirai)", "value": "b625424e66c2879e93f4389d82de1a954d28d149749c203b93403ee5695cd3f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823879, "uuid": "a9f2c840-8a47-40d4-b183-4eb8c369dcd2", "comment": "Malware payload (Mirai)", "value": "b66e3b581c379676f487a3534eda9f61afde452c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823879, "uuid": "0c18a3e4-889c-497b-8f4d-7f2150c00197", "comment": "Malware payload (Mirai)", "value": "a966fe56bbdb304fbe45f4888a4bd4e15b0290692e29fc14bdc997c84205b78b44994c394152acd759022eaf9b5dca39", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823879, "uuid": "a4e8df1d-e184-4ea9-8632-cb648aa9d736", "value": "T1E4D33A17B5C180FDC4DAC1B44F9EF53ADD32B1AC1238B16B2BD4AA221E5AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823879, "uuid": "79fe85cc-95b0-4faf-bfeb-cf9a2984754a", "value": "3072:tGtwnNiaOnUTuFiPT9OSQ7AOaogjV2iZlBWCg0iA0QPdL:tGtwnNiaOnUTcuLyA0QPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823879, "uuid": "8b8c4b83-d29f-4c47-8dfc-5c7362f6b969", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823879, "uuid": "6991bbb9-cfba-4d28-98b3-585cc0298aac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823879, "uuid": "7ae2e245-1ee3-45f0-a4b4-0f926884257f", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2e538d-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840377, "uuid": "470bf24d-36d3-4d32-95f8-3308934aeefe", "comment": "Malware payload (Mirai)", "value": "4cf8f360d71af5c13b516109498f0197", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840377, "uuid": "686c87b2-0275-4bb4-96de-d05c372304cd", "comment": "Malware payload (Mirai)", "value": "b81a83234379efa85d76e9a286e82d7afa2a111793794b543aea23d640a8717d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840377, "uuid": "8118d263-e6ac-4e20-be46-b5a6b6cbb001", "comment": "Malware payload (Mirai)", "value": "46ce6984f0479e3742a528b4e2a28d9ab1581273", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840377, "uuid": "a8de3e38-b23f-4a7b-9852-9d2fa8a4279b", "comment": "Malware payload (Mirai)", "value": "6d43335d278dcd236b0fc79a45601cd836d709e9d75d980ef304aedd1f9d18b56da927ba1325a8c035f5df5d9f55466c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840377, "uuid": "8081ea60-1aa4-41f3-ac16-9b3a4162fe42", "value": "T100D33B1BB5C180FDC4DAC1B44B9FF536DE32B0AD2138B16B27D4AA221E5AE715F1DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840377, "uuid": "aebe2dad-6c39-4c4b-b20e-0a331d85e38a", "value": "3072:tGmwWNq3OGUCsFL2TkqEpqhxoDPp3cBtLegakyALhPdj:tGmwWNq3OGUCXDKIqgLhPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840377, "uuid": "da3041f8-6a58-484c-bce2-2f7e5e6d8949", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840377, "uuid": "78017300-08d1-44e8-9b4c-57b392ac6b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840377, "uuid": "ce22e29b-b0c3-4f5b-ab8c-6dec4311a3b6", "value": "4cf8f360d71af5c13b516109498f0197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867f910b-e5f1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710853600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853600, "uuid": "61cfd686-05ec-4a13-99ef-0f5808282ed8", "comment": "Malware payload (AgentTesla)", "value": "09b0ff1242fe63cb0fd7b07c90e69362", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853600, "uuid": "e413da4f-35f9-4a99-85e2-96a89f196195", "comment": "Malware payload (AgentTesla)", "value": "b8568ef8c461f57be0df8d02e0488a5dbd9d2a7557c8d657e3978f138cbb7cdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853600, "uuid": "8ec9fb7f-25d7-4b4c-8fa0-f23671fc7ba3", "comment": "Malware payload (AgentTesla)", "value": "f022f88791a64ee203db2f9c3c59baeb1353bb66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853600, "uuid": "29ed8b66-c4cf-4275-98e0-8c31e97f6d00", "comment": "Malware payload (AgentTesla)", "value": "4c968b17324dccc234ee84fe72e7517895c6813e2c8938e5c5d7fb814a23f198d8d911b09f5b2d89c1699d32417576b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853600, "uuid": "a99fa5ba-6a91-4128-a287-51e6a23bed59", "value": "T1B045193C19BC1227D175D2A5DBD48023F764A4AB3025EE6988C243D94B6FB436D87E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853600, "uuid": "b99527d0-d31c-4bc4-9d78-ae222dc87b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853600, "uuid": "f7dafa27-e94e-4fe8-a625-ac9bae6924a8", "value": "24576:ZqMSN1FCQa9kiMietnN3/vAzfJooWa4xCyQg+nJ8V869/t5:Zq3N1FCQa9kiMienvIzT4x0g+Ett", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710853600, "uuid": "e2e384a4-57a7-4a56-a8f5-cff2096841e8", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710853600, "uuid": "2d2cae61-b382-4b89-828e-f13ca59ee432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853600, "uuid": "0b7dcf51-06bb-45f9-8c40-ed8f723f540c", "value": "rScanedP.O.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0914887a-e607-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710862838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862838, "uuid": "f7b001a9-9883-4a01-9051-0d9f477ef54a", "comment": "Malware payload (Mirai)", "value": "3efffca5bd3644ce66b74fbe06f51cb6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862838, "uuid": "b6929c8f-e6c6-4df5-af46-8fb8bb890c19", "comment": "Malware payload (Mirai)", "value": "bac22e5e1a484bf607d9f850da0f2166393a46e1f2caf1a14306ffcef620eff8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862838, "uuid": "2b0fac3d-a1ea-4a2a-87eb-e96e4fef0e98", "comment": "Malware payload (Mirai)", "value": "af40df055c147c37f66cb37e6e6ad1fdf6e8c59b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862838, "uuid": "ce83f472-f5ef-4d8c-88f3-32fbb3ba36dd", "comment": "Malware payload (Mirai)", "value": "b7ffdab492d1938f0a93c7956522ad03319f82a1711fcb1fd580a92ddb5eabde3491c18335e7e4058679f721cc7f2522", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862838, "uuid": "91aba426-a4b9-4495-a3d3-df8cde1ba0f0", "value": "T15AE31A46F8819B11D5C111BAFE1E128E37131BBCE2DE72029D246F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862838, "uuid": "548f373d-b3c5-494b-8421-9de0e924381d", "value": "3072:V2oQjR41U1CoEOX+kadoFanTol/ruvCkbkdNln7:8oj1u0OXbad8aQm5bkdNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710862838, "uuid": "190a0f96-fc4d-42ca-a309-4f4a5fbc3ad5", "value": 155068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710862838, "uuid": "0b60a67b-d40a-48ad-b296-2df858f4af22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862838, "uuid": "163e0130-0945-4dda-ae02-afe68df8721d", "value": "huhu.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca682bf-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710854281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854281, "uuid": "8390e029-5d47-471d-aabe-f94649cf02a4", "comment": "Malware payload", "value": "6351659fe38651b7878671bd98e76b09", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854281, "uuid": "64aaa846-fc08-489f-b141-39a180bd4eb5", "comment": "Malware payload", "value": "bb10bb33995fa85491c549f867aeee66a32bc2eec3979ef1aeb6a5b66d7b95e1", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854281, "uuid": "9ad3ea60-c90c-4a20-89d0-e4fbf15a5717", "comment": "Malware payload", "value": "711bc357ae2d2474934dc341656b7079e41f8bac", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854281, "uuid": "52582fda-f228-4146-90fb-46fdf64062db", "comment": "Malware payload", "value": "c206faab81d7ea171c856c51fdd078a09cd60232299416f5ef8d13b20f52e560160b051f68eda302754252ba8f2fbb58", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854281, "uuid": "643be90e-2d74-4ed1-bb8f-84fda01dd65c", "value": "T15034F8E3CAC52608CA461AB7DC234B738DA9415D37231F35ABBCC65D624395886BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854281, "uuid": "2d2deb6d-b259-42af-a023-349d6ff363ce", "value": "6144:6D4yENVOY0NpVXpK68kH3DPbkhZi3eNRt1sSDhJ5cZ:IPZT8FJ5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854281, "uuid": "d8ebbc2b-e758-47fc-8e76-e76ab9181b40", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854281, "uuid": "16b221fd-70e1-40a0-a8fa-449977e9bb07", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854281, "uuid": "2cf31b6b-4c44-4417-b4a4-361b24e90e66", "value": "nRFQ3530904_3000030452_19.03.2024.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4cfe67-e5d7-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710842286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710842286, "uuid": "c5a47d13-35df-4b0c-bc80-9bca4f3995ba", "comment": "Malware payload (PureLogStealer)", "value": "7b379777c8913b245918708c5e221a4e", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710842286, "uuid": "cedf74a4-3871-49da-aacc-f3675563c764", "comment": "Malware payload (PureLogStealer)", "value": "bcfe8808e2702a5700a63b1e003e7c08a1039edcf9d9cd734b5e1937746a1af7", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710842286, "uuid": "50642fa3-d8c1-4fc2-b9ca-a47ef71ed708", "comment": "Malware payload (PureLogStealer)", "value": "e8838325da39d0507bf4eabb7a84f35e17347c15", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710842286, "uuid": "2ba0e726-4c0f-46a3-8fb2-a76d5fe71f5f", "comment": "Malware payload (PureLogStealer)", "value": "c70589a11a7405d20baa78a885a6cd3c938f193d225e55a7a941822888f5f9619fe5a4df880bd60428c3526cd3d5e64c", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710842286, "uuid": "689a2c54-2fdc-4bca-9038-f5576ba663a3", "value": "T1319423243F09AAE9DE7593F0DCCF86B4F95382A81C25C6202386560D5E1D478D9CD9FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710842286, "uuid": "6c1b50a1-3fac-4854-b13a-70d280825c31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710842286, "uuid": "59da95f3-8740-4ce3-ac6f-9ab8b1edaef8", "value": "12288:txNS7GGM3wbDZVo1XGktuGSPhk681G1tc:bNSCGyUZVoxFSZUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710842286, "uuid": "a2bd5adf-bb2a-4df4-8255-3a20cafd2cbd", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710842286, "uuid": "adf1141a-d937-4659-9002-04659ad53c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710842286, "uuid": "3227c74d-eb1d-4c9b-95ee-98b8a7bd67f1", "value": "1710842285bc32657819f851858d9c33dde66b9674f5051b78959c6f234066bc678cc51465928.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f80af7f-e5d3-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710840622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840622, "uuid": "2f47e2d2-c964-4ead-a23d-d703f88e0053", "comment": "Malware payload (RiseProStealer)", "value": "81298ad77dfe3db427ca6feae918ef9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840622, "uuid": "b704191b-4abd-472d-83e2-cf03cce90107", "comment": "Malware payload (RiseProStealer)", "value": "bd81aacc34212fdc8bd7f0788e850e8e95cca31db5906ca926eb505cec8fcb9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840622, "uuid": "f9dc5078-a639-4bab-84c1-3c092f0c19e0", "comment": "Malware payload (RiseProStealer)", "value": "009e93af086ba48f8c134cd8c157f265bf6ca43d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840622, "uuid": "54966073-9c0a-484c-b6da-f91c90851f53", "comment": "Malware payload (RiseProStealer)", "value": "b3fe97d27a5655ebad640ff5340241c78b2771cec0f40edaa715e65adebdd26c70f88c03503a8dde87f103aeb7a0cf9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840622, "uuid": "b47c4d9a-89d1-4e05-9959-a9a2d7340d87", "value": "T1176623537D845DC0D9BC4130866AE9BD31353EB180948AE777BA3F8E9DF3660B42784A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840622, "uuid": "194cd2a9-65fe-4897-a8b4-c7fe7dfab636", "value": "b279e2f2b98cf3638cb7de1d8ce825da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840622, "uuid": "5f9593bc-86da-44e8-9fd5-6999cfdb4b29", "value": "196608:Ud0tUQs133oHnbI8PRlB93CIobiNcGV7E:Ud4UQq3oHnbI8PR/93obi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840622, "uuid": "cd08c92d-f44c-4a43-843c-48246a8da25f", "value": 6522368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840622, "uuid": "3189d598-2771-42fc-b8d5-baf209371cd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840622, "uuid": "836d6b15-dfff-4e42-a8f9-d91b10d8882e", "value": "81298ad77dfe3db427ca6feae918ef9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa5b1b7-e5f4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710854922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854922, "uuid": "0cbb83d6-be3f-494c-b173-03e2827193db", "comment": "Malware payload", "value": "bf12be99c22d4142386c55389fb691db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854922, "uuid": "8376bb53-b5af-4229-b1a3-d23a4c33058f", "comment": "Malware payload", "value": "bdde9c9f93b049664f9e474c2d4195ed6ccdfccdfa58ae151c457e4f23512765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854922, "uuid": "75727cd4-dc12-473c-9606-a9965b8606c2", "comment": "Malware payload", "value": "8ec06a85ada64a9b3d22bc10f2b261d3a8e61de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854922, "uuid": "42b169bf-9ad6-4392-a8da-133be1f3cf59", "comment": "Malware payload", "value": "a30389a2fe5f7101861d0ba72d1578661751bfe7ffaf99fa07900a0edf9e51d3a94e2a277497ac020362bd7aa3ed66a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854922, "uuid": "64f7c1fb-64e0-4ca4-b2ba-9fb1e97f7b89", "value": "T1E16622FD7258335CC02B8838E433FD45B1B9551F41F9C8AA76CEBAD07B6B5248A42B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854922, "uuid": "455e0039-c6c5-4efd-ad16-9cd42079c07e", "value": "ce41c563648f831be44d1f88d1db9e07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854922, "uuid": "72c6bccf-dff2-4b83-930d-fd8290a452b1", "value": "196608:cpttGOWRW1qeihHs/UtEXi7TC8YaUXLh7vL:cEW1QhSU0gC8YaUdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854922, "uuid": "934f1387-0426-4ba7-acd3-e8122afc1e68", "value": 6764032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854922, "uuid": "351f973f-767b-4661-9122-f6afcab0eb3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854922, "uuid": "cf6537e1-8f56-4054-82c7-53afa92ad3d9", "value": "SecuriteInfo.com.Trojan.Win64.Vmprotect.10520.1592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5878fca8-e60b-11ee-a120-42010a9c002e", "comment": "Malware payload (BillGates)", "timestamp": 1710864689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864689, "uuid": "1f7803d3-da24-4b36-b301-b22ee34b549e", "comment": "Malware payload (BillGates)", "value": "5ac9924723ee51a34999132cbd369213", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864689, "uuid": "891a3123-74e8-4e31-bb12-1d1b1de5882b", "comment": "Malware payload (BillGates)", "value": "be9ce96a9612ff32bc0deae2ffed9f15116b644ec106d1906fe44a6776595291", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864689, "uuid": "a6e14042-9cb3-415a-9494-636e4d4a33cf", "comment": "Malware payload (BillGates)", "value": "8bb17a17dc4a7885978c0161d7be2b0274a42466", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710864689, "uuid": "471d1412-e86d-4514-a7ab-e40be230727e", "comment": "Malware payload (BillGates)", "value": "05dc3dbf7a8ca84162bc29fa678c587ea6e8559ae089ce37502f3bf38d48eca1a9716d9148d19572938b967be5fa68db", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864689, "uuid": "c46677e8-a8fa-4155-a8e8-e866adfebba9", "value": "T155456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864689, "uuid": "d1d9b5f6-3773-4eb1-9450-2d997df811c5", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4R2y1q2rJp0:745vRVJKGtSA0VWeoIu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710864689, "uuid": "aba211d7-66ad-41f5-9065-de61534fa588", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710864689, "uuid": "9f931723-1c7e-4909-a0f4-dff629fe2ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710864689, "uuid": "639c9627-5237-4366-9ee7-4ffbb2b30a84", "value": "65533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39468689-e5bc-11ee-a120-42010a9c002e", "comment": "Malware payload (Stop)", "timestamp": 1710830707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710830707, "uuid": "3e79878f-0a97-4acb-838e-0763505a059a", "comment": "Malware payload (Stop)", "value": "180e2b2f71e67f5adc9cb8f36f3dfa31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710830707, "uuid": "c5778641-56d5-4368-8f82-d3d6c65caf22", "comment": "Malware payload (Stop)", "value": "bf586230320fd2bb84f1173e01abbe304392579b55e1f321ce5f60fec7087f14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710830707, "uuid": "b099ee7f-cc0f-4c75-b2f6-74ce68ddcc2e", "comment": "Malware payload (Stop)", "value": "719f39ebafc712d9f5e70483e88a94a88e4cd70c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710830707, "uuid": "3e6ac117-817a-4aa2-81fa-60df8894164d", "comment": "Malware payload (Stop)", "value": "ac096d24b0bd6097baab94641ff9ce03b99b87da5c659353a860126bea80a466515d9ed987e157635d8db30281920363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710830707, "uuid": "cd7b309b-4082-42be-b57a-e85e24a20dde", "value": "T17CF41201E2E16860D291F93C8D66DBF0176AF9793B31D23A3308E27F5EF11904A65F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710830707, "uuid": "4e327222-1e8e-43f2-a618-8456334c9a08", "value": "530a3401076a1984b14298cfc00a780a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710830707, "uuid": "c826ff85-330b-4b0c-9953-5ac0f512f32e", "value": "12288:CST5ud6X5jcadzHY3IATiMMAMhhckbEqS9ydqhiuSYmNhblzmgmj33zhn:FKCjvUslbES4iuE/lnmLNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710830707, "uuid": "50c11696-bf3f-4ddd-ab68-4d223ef3bf9e", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710830707, "uuid": "16cb42bb-1767-4d2a-b94e-491a4c1e9c06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710830707, "uuid": "d6f745d8-7004-43eb-a6f6-cb75c4a27162", "value": "180e2b2f71e67f5adc9cb8f36f3dfa31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb60de1-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834608, "uuid": "097a835e-6a24-428e-9445-2e9e1872536c", "comment": "Malware payload (Mirai)", "value": "ba98bf424b8bb7099d99ad3f0cb9cea4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834608, "uuid": "7e1d443c-ae5d-43e7-a343-40bb5e992f5e", "comment": "Malware payload (Mirai)", "value": "bf625279270d6eddf74b9192658c7f9d5b68a0786b8e2d4904477261f02ad6dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834608, "uuid": "bd4ec61f-9098-4d91-8c24-16ab82f27dee", "comment": "Malware payload (Mirai)", "value": "7e4f60fdb54ca21143078f0a8743355c84e8f385", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834608, "uuid": "2f2eccb6-2f3f-4024-9d41-f0689c3a0e56", "comment": "Malware payload (Mirai)", "value": "2559799fd43bfbe7e9834a93addf0f55f1edfa0e29a3454ab36704596047c75210c7e0300bda632d1b25075a3ea3e293", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834608, "uuid": "ad4b1ccd-a3f1-42d4-ab98-f819879e4c45", "value": "T1A163B70A6E55CFBDFB59CB3447B79E20928833A727E1C542E16CDA001E6138D745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834608, "uuid": "98ae4977-795c-427d-ba40-20e3fad9b3c4", "value": "768:hbK8aeK9/jmyKH1vlfP2Ud1PLLBKAWlBNK8LLfydCwb6AP++vb8Q4B/7X9MbC0fL:2e8/p4L32qBLCRmb1nfSxg9Z3IMcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834608, "uuid": "adbb4a18-2320-4480-b819-923442e161cc", "value": 72036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834608, "uuid": "aa0b8edb-efe2-43c8-868d-2bb32bffaee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834608, "uuid": "99895912-e8d6-45b2-ab9a-dcd8278fba50", "value": "ba98bf424b8bb7099d99ad3f0cb9cea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e14437-e5cc-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837838, "uuid": "71729fe5-05e7-4346-bdac-2325a19aebf7", "comment": "Malware payload (AgentTesla)", "value": "91ed698911c07815e6fd3b5c9e6d839c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837838, "uuid": "46387713-c891-46f5-b756-35e5560b9e28", "comment": "Malware payload (AgentTesla)", "value": "bfc02cc838f9c37b322bc2a390f7cc864c8ba3f817b66c2f0ebdd19d17622011", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837838, "uuid": "456725fb-3a8c-41a3-bb0f-1d13cbeaa9d3", "comment": "Malware payload (AgentTesla)", "value": "61fc14ca808c0d215065fe13e6be4906f98b8abd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837838, "uuid": "05f978ab-f9f5-4ea9-a291-716d1dd734e7", "comment": "Malware payload (AgentTesla)", "value": "1edca76829e186596b33019506dd672ba63574beea3215a55ecc7af8e548cbb35bb83bb68c7f3c4ff302923af81f3b7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837838, "uuid": "6fd014f2-60ce-4a99-be4e-db8175a42ae8", "value": "T1CCD423F6077C02CACBA68B7412EC50270FF2906B0ED5EF58F966D48079853D6961A27F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837838, "uuid": "d6c5f697-a81d-4cb0-bf2f-b956fa944588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837838, "uuid": "76bef396-e248-463d-90cf-57f38e3ce449", "value": "12288:9NfDSmf2yv92LY9rxL6KX4d8mzD0pdZYYTaCtW7QmTZCAPL2KGOJRYWq4kR:9NfDz202M9rZ678mz4PJTaCZmTAAKOJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837838, "uuid": "4d4fe94d-a3a9-4d69-94ae-cec26aea8316", "value": 646152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837838, "uuid": "8b25a4cc-1e80-4b19-a2d1-4585f7d19538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837838, "uuid": "9390cc15-ba5e-4577-a98c-87505801b0b8", "value": "SecuriteInfo.com.Win32.PWSX-gen.2201.21631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30ac377-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837005, "uuid": "ceb0dd80-5553-4434-bf90-2cbddd582935", "comment": "Malware payload (AgentTesla)", "value": "7121386a046bc52158bdc83dee99c5d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837005, "uuid": "87eb2427-4c2b-4311-aa57-a59afe9eba18", "comment": "Malware payload (AgentTesla)", "value": "c07987b5aaad7e8ba333194b3b602ccde40759ab7d957a4af0eac7da722f72ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837005, "uuid": "b5c77df1-56ca-4d32-aa41-4af459b0a204", "comment": "Malware payload (AgentTesla)", "value": "3a178eb0eb55a4f8e71484a159569371138f8e76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837005, "uuid": "2a82f278-9590-4373-8628-9f215427a8c3", "comment": "Malware payload (AgentTesla)", "value": "7622d6e8e6e1c1eb33f9f4220c8242c04cc5e9e043e7517d84ff7267d05ef9aa80a8adecbfc1cee6e8f55aa9142d9c66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837005, "uuid": "c2ed83a4-7550-490d-a8e3-71558d0cc806", "value": "T14BE412CAFD005560DC695B326579CC325A233E7EA874682C6DCE7DB73EBB321600685B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837005, "uuid": "a3e84841-30f0-4333-aae9-be09d1daf320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837005, "uuid": "f04aeb62-58db-4354-b1f7-402b42dd5e8b", "value": "12288:IaHGZk4twxrU1kENlUFnG/YTozVvVEz5iOMuWjZ+y4stgRhyjkR:HllRUZ3UFGQTEvVENiOoNgG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837005, "uuid": "2932d787-fab2-401b-823c-4a71eabde9cf", "value": 707080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837005, "uuid": "b8cda9c0-5640-4528-86b0-84f6a323004a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837005, "uuid": "6db33382-a572-4018-b7e8-f3e6f7375a1a", "value": "HSBC Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed02d7f-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710837454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837454, "uuid": "175943d7-1b3a-48e1-9d12-007665d2e2cd", "comment": "Malware payload (AsyncRAT)", "value": "310b982faa6a9c8473c6a6097a64317f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837454, "uuid": "8505ce82-1f12-4c91-a84d-d718dce62036", "comment": "Malware payload (AsyncRAT)", "value": "c21d1dd6391ae93398507c94f9b075dbe8baceed4903a78b3f6bebfa85cd155e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837454, "uuid": "5b7dff48-9e0e-4881-b006-46ee11bb9eb9", "comment": "Malware payload (AsyncRAT)", "value": "abdc0ee76d9f21d318c04b12cbbb4453c18a4c57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837454, "uuid": "509d90df-2b11-4379-b140-e6d5e697ed11", "comment": "Malware payload (AsyncRAT)", "value": "55429eb5fd5bb67b046beffdb9f9a3d2fd6d684f08fcd096c2a6167c5d384b878b492c6f03b626c3c346219874fcd5bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837454, "uuid": "71dd46f2-4f89-4238-af69-edef475496ea", "value": "T15F232B003BE8812BF2BE4F7899F261458A7AF2633603D54E2CC451D75613FC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837454, "uuid": "8aeefd8e-898e-4e58-82b6-1bb068d9bcf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837454, "uuid": "903375ac-2c42-47e2-af57-922a2a961ab7", "value": "768:huyRNTAoZjRWUJs9bmo2qLxAuXuPeD58vnPIM9zjbggX36PV/n8vvmv4Rk4oTeBf:huyRNTAGo2Ju7D5iAM93bHXK9/n8mQRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837454, "uuid": "69618133-de8c-4564-93db-8e6ef9b453a0", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837454, "uuid": "4f01c399-1a99-4461-a9f8-61a8fe8a50e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837454, "uuid": "487cf6b3-4938-4f20-a3b6-f1d39a1fbcfa", "value": "310b982faa6a9c8473c6a6097a64317f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee83fe7-e60f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866418, "uuid": "fe2915f1-8c75-42fe-b6ef-8c87961900d5", "comment": "Malware payload (Mirai)", "value": "863c0fcacb7aa149c296369d16af14e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866418, "uuid": "b9576990-f4f8-464a-a085-2e0912ff6d77", "comment": "Malware payload (Mirai)", "value": "c53348d996077ac0dc15affe0b0c521d9a9c8430fca283629cbc782fe7a78ddf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866418, "uuid": "de8512af-5b95-40aa-9597-029a2f86e712", "comment": "Malware payload (Mirai)", "value": "48d7ee2c8ea801832d7f37bc5445d728dbfd75f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866418, "uuid": "90cbf24f-b789-4f3a-8f08-8bb89a733e54", "comment": "Malware payload (Mirai)", "value": "180adead96ab340caf157d238b4a4e379132cd5d7121391c1f2101a20786674f98c38ae6d71c6bd589c99a0186239d7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866418, "uuid": "1ed4f9d5-d8fe-4129-8bfb-1a33a594139b", "value": "T17792AEDEA2806C5ACCFD183D514E4BA94DD9A3F0729B5F990B750D9E6934C1BB8C807C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866418, "uuid": "2c4731b7-9560-4f0e-b8d5-1c9027d298f7", "value": "384:Fvn4H2VFCg0cBW6phrhlPvueBjyxNjwbMtUx9lBZ5XBGYToYwWjRWGVCz0Nv6a:FAWVFCg7W6l3rgjwn9d5RGYToYxtWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866418, "uuid": "7adf8f19-8797-4572-aa89-28e1f90e78f1", "value": 20440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866418, "uuid": "d25f6ad6-81df-4b19-8484-d806c0d11d8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866418, "uuid": "e5c1d79f-fe37-457a-934b-93bd2cf634cd", "value": "863c0fcacb7aa149c296369d16af14e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f44489-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837068, "uuid": "1e62a857-dcda-46bf-a29e-5ac8926e3979", "comment": "Malware payload (GuLoader)", "value": "6f989ee976b53636a76681248cb6975f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837068, "uuid": "857654fb-3832-48ad-bfe0-eee2210ee6d8", "comment": "Malware payload (GuLoader)", "value": "c5754ed07c3881cb347b3512721b35f9bf98f5140cad42c18fbb391692db3a17", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837068, "uuid": "64493938-37d8-4072-801b-e004ba634cae", "comment": "Malware payload (GuLoader)", "value": "3374932dcab69323b96c696dfa108dd6d78aba09", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837068, "uuid": "8a3aff5d-76ab-47fd-8eb2-01722df57532", "comment": "Malware payload (GuLoader)", "value": "08bab37b0e4373214057cb83ca8453195f1a2504a482b5029837b406e7fe2f41dff031e8ff657d6f4a4ec0477edadee6", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837068, "uuid": "a4860fc3-773c-43aa-871c-6d091158d269", "value": "T1C74219EEAA075621CD5F23E0B443D050B96680DCAC25044A39EA67FC90F35DCE33AD4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837068, "uuid": "21392f4e-439f-4066-b68e-3255245346e0", "value": "192:nL2BSKoPqhO3XXC8EG4qmiCyDQQ6kNrMYElRruGVEQRpAcEuc7JRn8QK7rdnoA4:KS+hO3C8lZyw44UHAr3Rn8J7pnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837068, "uuid": "1062811a-0e12-46d4-9268-85848761ea03", "value": 12469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837068, "uuid": "ae531615-0e80-4116-83fb-b4e612bc2c8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837068, "uuid": "0dd077ab-82c1-44a9-9c21-1b298a4e760c", "value": "Scanned PO Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5397e2-e627-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710876834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710876834, "uuid": "8b71832a-702a-4bbb-887c-59fc08fb6cab", "comment": "Malware payload", "value": "10c668fb3a7ecc9ab7eb952a14e96c36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710876834, "uuid": "5edada59-a73e-413f-b6ba-326ff7abf031", "comment": "Malware payload", "value": "c63e304ea96adc65f092324050e7f17d2a620cc432959e14465383fffde3537e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710876834, "uuid": "7dfcf8a8-c70b-47f1-ae1c-98fc98b62f47", "comment": "Malware payload", "value": "6fd090c283efc2aee5a69eea90214f9083fd982c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710876834, "uuid": "35e4165b-7417-4196-bf59-34928061a30d", "comment": "Malware payload", "value": "99cb25158674b9fb1e8f70108a9850bb9516a4c000e64e076a7c060a75416c20f4bf6562c2f39d0e5b29302356a5e4b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710876834, "uuid": "254e6358-9d18-4f33-888b-aea551a482cd", "value": "T18B768D47EC9545A9C0E9A230C9B29253BA717C485B3277D72F50F7392FB2BD0AA79340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710876834, "uuid": "f7ea1ef2-4333-49c7-b9bb-c5f8f514b471", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710876834, "uuid": "5475f208-6f99-465a-ac5b-3e790e24f98b", "value": "98304:/KNyzHp7gBN3SE+i7DLAiMBl4uEWm2y7woefLNzn:iEbp7gBNP+mMBo33MoWLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710876834, "uuid": "a1c2a52f-da49-4196-98f3-1d1d74437c34", "value": 7724544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710876834, "uuid": "7d205f72-9221-477c-a863-aead6db1284c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710876834, "uuid": "ecf08a99-2b34-4aa9-84a9-4138790ef65f", "value": "STRIKER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b3af58-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1710837083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837083, "uuid": "1af78721-a92d-4b2a-97d6-e044e12f843a", "comment": "Malware payload (XWorm)", "value": "fc0fee432d7effb42c0133da090d4460", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837083, "uuid": "c5c4d5d8-946f-49bb-968e-fe61adb84414", "comment": "Malware payload (XWorm)", "value": "c69ff9dd668c037efdf9c025bab748b7637347b2f3986150af396f30e5e77dd8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837083, "uuid": "8a088106-f926-4303-85b1-bca2d1fbe423", "comment": "Malware payload (XWorm)", "value": "d336ddf9ce483de3dda6992419fe789cf283e2f5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837083, "uuid": "a7517273-77e4-4cf5-b910-7490ca89f5c0", "comment": "Malware payload (XWorm)", "value": "156104e4460d3bd592dd247bbae00fb79c94b42525a0a2714281e84cb333dba590dc2d6f82ce87e025fc78e3e3e1f1a6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837083, "uuid": "6f797751-72e4-4079-9e9f-80403e62a803", "value": "T173F16C1A9B0703A64FE17E1996D68F4067B87C79D4B194133EE943C2A05EF88E1B1B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837083, "uuid": "c7af2fcf-3815-4679-a885-242e2aa42968", "value": "192:Ouz5j1mG5NFw3rBPnuEDGOw6KE5x6/2jwDnbEaSoz9bVBm:T6uL658PHKwujwDbEszBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837083, "uuid": "cef18f17-5981-40a9-8c04-c23e6ebce594", "value": 7917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837083, "uuid": "547cc489-8ffd-4a96-b174-97b4cece6139", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837083, "uuid": "4ed1c3dc-8999-4c45-aa40-3cb95249f5bb", "value": "fuggy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b159e7-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1710837096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837096, "uuid": "c0d1bd33-1e82-424d-9764-a3ff9dd06381", "comment": "Malware payload (XWorm)", "value": "040304ab389384392f1bab23c4e92290", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837096, "uuid": "c3bae8a8-5423-4860-a731-1cc8e454f938", "comment": "Malware payload (XWorm)", "value": "c6aa9db986deb697f861135503228e416e930b8c9ef6bdfcb4af0486d33b1597", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837096, "uuid": "7a0d67f7-eecb-4832-92d7-b9fcb0831f68", "comment": "Malware payload (XWorm)", "value": "04c255f0c3b7742d5601904146abc7e07d0dbeb2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837096, "uuid": "625eb653-680d-4edd-9446-3d4ee22bfc09", "comment": "Malware payload (XWorm)", "value": "c507bd4f58af9e07459cfcd2849aca06c1189df13c1ef40bbae44434ce5d29664be4a976f94dd2f2ac239341c61cc86f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837096, "uuid": "461e96ca-24c3-47ec-9a78-0db2b1c786e4", "value": "T19C022A699B1B03015F40237CDA4F0C479D7C213BE4178992F8A55D5B228AE8CF4A8F3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837096, "uuid": "3974e9ac-5e34-43a9-bd2c-eacb36d888bc", "value": "192:OCux5QUcmliR5RvzNCyk5nKNo5iEArLvJHqeXFzRd3uRVm:buHwLbJt1qoPEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837096, "uuid": "e5b95b14-476b-4aeb-8a33-1aa377f4a137", "value": 8204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837096, "uuid": "79d1abac-db61-424e-b772-60a2a2b35f51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837096, "uuid": "c057347e-d277-4bb2-b070-23cca4772270", "value": "Erfarendes.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c566fbc8-e61f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710873462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710873462, "uuid": "21e6fd68-2751-40ae-9456-2aca6a6176eb", "comment": "Malware payload (Mirai)", "value": "20b94511ee233f87c92daafee5d9de54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710873462, "uuid": "1a6a5692-712d-4066-9d19-73696be86881", "comment": "Malware payload (Mirai)", "value": "c7b698370e17c31c78da169aa1977b9f1f3c6a137e50b174d6a09efc2129661f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710873462, "uuid": "866a4e3e-3bc3-4350-8bfc-e59c4c30c749", "comment": "Malware payload (Mirai)", "value": "e1b9c98764f132aa1ff4bcf7eb519ad0ed3e13e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710873462, "uuid": "ceccc910-b72f-498f-b256-bda98d60bdda", "comment": "Malware payload (Mirai)", "value": "e6d2f50aad88142f6cecc1554db9863854a4edce5cabf69efb6d48e2632ce9ea41689f889e5886e62e9823b1c1e850b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710873462, "uuid": "9f01d1c0-a036-40a3-929d-815b5d4a72ab", "value": "T1A592CF68561410DCE73AC1F463F847B32DE50E92E843E88A3785F9CA8CC94A831A37D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710873462, "uuid": "634116f5-041f-441f-8135-7e340d06fc58", "value": "384:bahOHUUZwC4YSjQzKdiXQkAEpI6ILhbUTqJgGlzDpH7uNj1JfE:Wh8VCZZEQIpIVUWJgGlzDpbuR1J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710873462, "uuid": "85aaebd9-3ac5-4fdb-a738-56a14f66c1bf", "value": 19876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710873462, "uuid": "7d9d5b4e-83f2-49d2-b74c-e0a276fae394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710873462, "uuid": "7ccb2bc0-a14a-4328-bb33-10fdd03328f1", "value": "SecuriteInfo.com.Linux.Siggen.9999.4259.32315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0773a687-e607-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710862835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862835, "uuid": "1820e960-62af-40fb-a523-f6fd66bffa39", "comment": "Malware payload (Mirai)", "value": "0b8f2ba457bc376fa28e04f2fe51125f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862835, "uuid": "4122dc20-60a8-4600-a3bd-386041c45716", "comment": "Malware payload (Mirai)", "value": "c820e8be2ce346e3f92095d4be56b88189b595457bfecb126edd33799e329794", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862835, "uuid": "bcf3f258-53a5-4bed-93bd-f91c1d1178cb", "comment": "Malware payload (Mirai)", "value": "809dd9d35965432d1ede6ec6c21dfbdaee0a8c87", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862835, "uuid": "02995802-521a-4c90-9f27-4d4e35a94395", "comment": "Malware payload (Mirai)", "value": "4f296ea322ee51c4c551b3bee32549c045209f9b7883c560586fce113151539cd88e05344488108c98454254867b3bec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862835, "uuid": "b7311bd5-182c-4d2c-9b6e-0a409c87ddc2", "value": "T14E14E91AAB510FBBDCAFDD3706E90B0139CCA54722A83B363674D528F54A50B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862835, "uuid": "9aaff939-7dd1-4290-b475-67829ae6b057", "value": "3072:oXT7mT/Pyox/O0el0PXaHkcBRk+wvClsmxT:oGTCoxrel0/mkWXwqyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710862835, "uuid": "9244b140-0b48-4d27-af9f-e27ed32a4332", "value": 190900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710862835, "uuid": "95dfd553-3c87-4756-ad12-404d39740f1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862835, "uuid": "feb9cbf0-a941-493b-86cf-e5b263afce37", "value": "huhu.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630c5a5e-e604-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710861701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861701, "uuid": "e89b043e-429c-4188-8693-6e7c0382da59", "comment": "Malware payload (PureLogStealer)", "value": "c920a8fc975ab6f609a3e20a1f23e43d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861701, "uuid": "83fa6ab1-2ca1-440e-a809-2e435858466f", "comment": "Malware payload (PureLogStealer)", "value": "c8f89ba3b896c3422f97f8fdcb91a19af3fe8beea8af76a5a2298556c4137c11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861701, "uuid": "c9b15a8b-8f3b-4edc-a826-2df0b7c0f581", "comment": "Malware payload (PureLogStealer)", "value": "4c7f42446ebdf228963b974c510e63147c2ad25d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861701, "uuid": "c59ac919-610f-4463-beca-dd4b0f76f2c0", "comment": "Malware payload (PureLogStealer)", "value": "c3b9258f9bed6a48658bd16cb2a98acea906d103f09cfa92a2922014bd1f9f072378e19107a5fbc424c0158e3229462a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861701, "uuid": "3960f95c-0992-423f-8da7-b9c5d0803ae9", "value": "T132F4E0E4667BCE3AE7EC53B960459702A7BD4686DBD3F709501444E18806B81CA23EFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861701, "uuid": "e1298c4e-e6bf-438f-8ae6-886036d2113d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861701, "uuid": "97b3b70d-a982-4593-8490-e2e2280586ce", "value": "12288:ewq1od3iYcPbkbftLgBjJj3MUZE+7+wEExPw8M2QlOG0jJAI8XjrYdLjaPh:qbGf+IUyaiEe12U0jWB3kmPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710861701, "uuid": "a0dbd9ea-71b4-4628-a888-41085ea913d6", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710861701, "uuid": "10519856-84db-42fe-9f73-7aeb12092cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861701, "uuid": "801edec4-46f4-407c-90c8-228b3d9e5ba8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3bfdbd-e622-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710874520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874520, "uuid": "50e2183e-a0ee-42c9-9954-221ee1aa9045", "comment": "Malware payload (Mirai)", "value": "a14ed623730b0740ed545fde060e3956", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874520, "uuid": "9a33dd93-21d9-496f-9dc2-11f4eab46bfb", "comment": "Malware payload (Mirai)", "value": "c9649406911c3e006a6dd6eacf2c560de0a57123b5cbec18d5a58eae5ffa655d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874520, "uuid": "aae65682-4c7c-450f-bf06-ce88cb5af2de", "comment": "Malware payload (Mirai)", "value": "d081b0cd82eb0cfd26ca3db4da416638e7c5670f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874520, "uuid": "e6bef821-fdea-4341-90ac-a6b342622f0c", "comment": "Malware payload (Mirai)", "value": "0df9def8dd6a1984891f7f1c9a2e37bcf6b662b006a3b522203278b29b9ea5189088e03512bdc8d9f854d28255ff236d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874520, "uuid": "3028e7e2-ebee-490b-bd1a-6c0df56c7272", "value": "T167732956B9819B21D5C112BAFE1E118E3313077CE3DE73229E24AF20778796B0E7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874520, "uuid": "c892b9aa-d6a3-4376-808a-11a2d1fd5161", "value": "1536:ten7vgo4JldzaVRibLrN8akdYiQbM5iIyq0nJnj7Km5kYGq9GP:evJ4JlBAALrqakbyqOJnjmmOxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710874520, "uuid": "4f1be6e6-3b52-4312-97f3-f44029c119fb", "value": 75664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710874520, "uuid": "9a4eb620-e780-44c2-a72b-d65bbc16c2ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874520, "uuid": "7c70bcae-4aa4-4cfe-9564-8ceaf5ac5188", "value": "arm6.hh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e2cf05-e5c0-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710832550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832550, "uuid": "40df2038-a7fc-4178-9149-d45f54224628", "comment": "Malware payload (PureLogStealer)", "value": "2c776e62b717c67e97797900c33bbb02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832550, "uuid": "3dc5c5f7-e9e3-41af-9d81-9dcb66fde893", "comment": "Malware payload (PureLogStealer)", "value": "ca23f0a740a9b1aca6448ed63c6d65e8fbff4299d46f0ace20f4dba3f06216af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832550, "uuid": "3f72a2a4-6054-4fda-92ed-6952098da117", "comment": "Malware payload (PureLogStealer)", "value": "e9714a142353a7ec8343ffb6283629ccdf1b5c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710832550, "uuid": "211897a9-8552-4401-a598-83d140648a05", "comment": "Malware payload (PureLogStealer)", "value": "afef0471ad84dbb9caf182c71905677ce2d1f85b3bee7febbb2559ac071b64ce5673ff1b4d952db0b440153bb028021c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832550, "uuid": "83c30d44-425e-49e5-9569-e346f64a9740", "value": "T1F3C523A0567FDE2BE7CD93BC60618A0042FD9A96CAD3F70991544EF48C02794D913ABF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832550, "uuid": "22ae3e34-8d84-4bda-913e-274e35ec0a55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832550, "uuid": "bbc5f156-321c-480b-980a-68bcb00156b3", "value": "49152:bNw/US8m7i9FOONwVXfqK2TMoa7Mlq4dOg+28XzgG9eiv:bNw/cFOwwVXfvH5oldBkXzN9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710832550, "uuid": "f19dbb53-7c08-41a2-8174-2043ea1a1b23", "value": 2583040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710832550, "uuid": "19e3660a-b9b2-4a3c-9231-04d1cb7ca00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710832550, "uuid": "2d1d7b2a-5e6b-43c2-99d4-7442ac5f3671", "value": "2c776e62b717c67e97797900c33bbb02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ef5ab9-e5be-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1710831725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831725, "uuid": "92f39545-df14-4363-bc81-8f70a39472f3", "comment": "Malware payload (LummaStealer)", "value": "d54192e5d0712492f203d7cdd3a024ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831725, "uuid": "5e5a5a29-e623-44c3-bd1b-03bc62fc35db", "comment": "Malware payload (LummaStealer)", "value": "ca43587add418bb511755105f7a297d80840d8d3ed6f898ea124d2c77cdb014c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831725, "uuid": "1e9fc831-74d6-4e51-a160-6049ca46fdd1", "comment": "Malware payload (LummaStealer)", "value": "e2c8b1f0d9e1c604f9ecbe44633e38cda31b6cbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831725, "uuid": "fb9ba072-35f6-4742-a029-0dd2474760ff", "comment": "Malware payload (LummaStealer)", "value": "4a302d57d3fd571cceb10c3e7500d62ac459a06e6655087bcaa26804775d8905ff26510c64394684873a5ef165afe108", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831725, "uuid": "ed8015ef-94b5-4d09-8c0d-d6cb55992589", "value": "T158949C2375D1EC65E4A243310F2C9AED3B7EFC669D218B5737883E0E68711A1D623762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831725, "uuid": "930d346b-0232-4871-9783-4ca79c1f53ac", "value": "48a41026330940883e631637d6182ed1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831725, "uuid": "8b85bfb4-e591-4182-86a3-1b520c4f5ffd", "value": "6144:jcOiy6A/oNV0I0em57Gl/+l1pwRB0KBBv3004ru19:Pv6A/OpEKl/+l/+9D3ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710831725, "uuid": "540792e2-ffbd-4e6c-bf62-acdb3a29a2ca", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710831725, "uuid": "08cf58f4-abba-4df3-844f-3ff7614437db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831725, "uuid": "f2ca8c11-9e39-43c3-a88b-c82344e105bf", "value": "d54192e5d0712492f203d7cdd3a024ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7ecf9c-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710854366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854366, "uuid": "89291018-4e84-4e36-a765-3942efa47bab", "comment": "Malware payload (AgentTesla)", "value": "7c36950a1607d61824ed9ca0f26b8373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854366, "uuid": "ce8b3e3e-5849-412b-8b31-4b8727141b5f", "comment": "Malware payload (AgentTesla)", "value": "ca6e5b9da9a867c52d1eca583fb8a3a39bb9add976568b34a152797d8c7847da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854366, "uuid": "a33b3699-9dbb-400a-8cd3-ca48a8eb5be6", "comment": "Malware payload (AgentTesla)", "value": "4a465a8042a971f36e95669a89b894c07b299bef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854366, "uuid": "e819a414-406d-423b-9f49-4a575e7912ca", "comment": "Malware payload (AgentTesla)", "value": "1dbb2531cfbc729c95ea92a55ee50f60b2ebd61534a7851f8b24eaaf589c69298817fa50ef056f04f407c583375d716c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854366, "uuid": "d6711748-e94b-4fd6-8886-1169d8b9a0c1", "value": "T100D42373730BE0908C98545B6078C99F01BB7531290EB974DE5DBA78E17227F189AF8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854366, "uuid": "f3b2005b-b5f1-4b78-8c06-130cdce43631", "value": "12288:7pp7TRcy6NLGQMmV5Ej9bGGgAOR4+J8WufAriOPDhnVbeG0wjrgU716R5yZ:7p5TUqmVy4Gg9Dufs71nVS0B16R4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854366, "uuid": "0463395c-474c-4177-9470-53a24cd30126", "value": 625229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854366, "uuid": "44b096eb-cc33-4ad1-b582-fc62fd071bfc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854366, "uuid": "953c00d7-0664-43e5-bbac-29e8e57508b9", "value": "nNew Order.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7548052-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1710836958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836958, "uuid": "323be65f-18f1-48b6-82cc-f1dfc98aab1d", "comment": "Malware payload (STRRAT)", "value": "2ab0baf4213242053e434541316273e5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836958, "uuid": "8e15667f-3581-4d9f-a746-d43ef4781655", "comment": "Malware payload (STRRAT)", "value": "ca72bd27ddb2aeefc436005318efbac47bc167b7a326214f35d9d214268fbb05", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836958, "uuid": "91a934e5-59d6-4c37-b90e-d05a4e5daadb", "comment": "Malware payload (STRRAT)", "value": "a48db15eb3465da40e9af9165e3664931b4a9fad", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710836958, "uuid": "940b6263-b1ba-4c69-b7ae-ee0b581f2a76", "comment": "Malware payload (STRRAT)", "value": "e534a9ac43a21e76b9bffc06f12a5ee8d0ac210c648c472c391929e65d96f963914ac525bede01823263007b5a339a64", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836958, "uuid": "611cf446-4048-43c9-a1e3-7856c884e124", "value": "T1527402AF7ADEE079E41352B2212102B1EB2C46D5D285941FB5ED1E4D4C37C888BD6ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836958, "uuid": "842a9c99-8756-4439-bbe1-41e56fe0f00f", "value": "6144:wDQ+vnDRfK7L2IpIpue6ua0ns5/slRqPnVQyMfkUBlKjwW:IQ+PDREKBfCmfkUBQjwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710836958, "uuid": "445ae448-2bf9-4e6b-a70f-0a5706c09ba4", "value": 344526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710836958, "uuid": "24e966f1-74a5-46d4-9e6c-8013f34ed51e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710836958, "uuid": "32969c2e-a94d-4414-bf52-3ee34c3e485f", "value": "swift copy of payment..jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42300f98-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710835017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835017, "uuid": "2db8f145-6d25-414c-bf1f-34f7e13acf17", "comment": "Malware payload (Gafgyt)", "value": "0623e8359bbc4a15d33475552a13e2d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835017, "uuid": "463427fb-643c-4f1f-86ee-6c86edd1b46b", "comment": "Malware payload (Gafgyt)", "value": "caf6b4a0cbb0095a0ef2a3e027fddedaabe30d22e96a13863c5b7e989bcdd391", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835017, "uuid": "1066e15f-5047-4eb4-9860-a09503f80076", "comment": "Malware payload (Gafgyt)", "value": "38275d2a2cbfd0d2537e8b41c0a07f704afd99ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835017, "uuid": "b146c519-a2a9-4e81-95f2-e9d96f9d6206", "comment": "Malware payload (Gafgyt)", "value": "df6e83781ab1616b66a7aaa91437cd99127f3a906b25742e74abeeeb1b565a574e83052bc37b00c1fcd4b9a71412ce04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835017, "uuid": "6be1a1f3-d5a5-4055-9812-cc9ee520d824", "value": "T17CF34CB7A21C0783C4C745F01E6B3FF24F6895E222F7A1855A1AEF905B73AB61051F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835017, "uuid": "c05cde72-c39b-4621-af29-b894c4fb7522", "value": "1536:NEpsna8p7lUHWt/wi4MHk7iQmLSxKBl4yBMNgwr5hCHhTugEmJ/sSiFMh3n:NO0aGUH+Hk7W9LFNc5hCFufmRsSiSh3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835017, "uuid": "bb932db7-57ab-4a0a-80a6-e2832064cb2d", "value": 161069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835017, "uuid": "ec0fa603-8787-41a5-8532-b1a8ece34561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835017, "uuid": "17e7bea7-e8a5-45bc-aac3-6af9804caeaa", "value": "0623e8359bbc4a15d33475552a13e2d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a56983-e621-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1710874056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874056, "uuid": "700e20d1-5444-4c5a-9d35-ceaab22149a4", "comment": "Malware payload (IRATA)", "value": "a866677465af94df5d39d72b2c3751ef", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874056, "uuid": "46d39880-0627-4860-bc0e-42b33c5e3a01", "comment": "Malware payload (IRATA)", "value": "cb0cdb1ad01fa87c11eacbbaeef9f646206ec99046c32f3b3e467bb7f6e265f2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874056, "uuid": "8ec838ef-17a4-45e1-9b88-5497bdcbbb50", "comment": "Malware payload (IRATA)", "value": "458ac281f8f8009d305b4ae54de471a9947b8595", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874056, "uuid": "0fb5f9f6-c027-4ad0-858c-28a26fd5fb82", "comment": "Malware payload (IRATA)", "value": "10261a500b065577b6cb0f8f6b9b510d8e23359bc5ed949c20855e51d3796bd6684182e683e630d27f02ed8437792c75", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874056, "uuid": "65a7960e-11c6-448c-9f2e-98b970a84ae3", "value": "T10F162343F36BAD17DAF1C37221212936047A0D198747FB4A29187BF568BFDD80B85AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874056, "uuid": "d85cbda7-69ce-4493-8d34-c6439e923b23", "value": "98304:4GZTSHh5MkkmXBLhwunIfhcUnpxJZe/YUyYebjMsQ:4GZTSHMaxLFonVjMsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710874056, "uuid": "55e5845e-bcaa-47a9-a270-e24c85950bdf", "value": 4039069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710874056, "uuid": "62e27cfc-ba2c-4b95-a5bf-acb83656c3be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874056, "uuid": "b085694f-cad1-4da6-b6fd-676d1443ff9d", "value": "KissLand.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62824443-e5ef-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710852680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710852680, "uuid": "49015ee2-2e33-43bf-8029-b112ebb7a41f", "comment": "Malware payload", "value": "aaf1146ec9c633c4c3fbe8091f1596d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710852680, "uuid": "6c47ff9d-8c31-4da2-a394-854e087722a2", "comment": "Malware payload", "value": "cc19c785702eea660a1dd7cbf9e4fef80b41384e8bd6ce26b7229e0251f24272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710852680, "uuid": "1dd63185-69ee-4c7e-b351-0558e3ec5e87", "comment": "Malware payload", "value": "a5059f5a353d7fa5014c0584c7ec18b808c2a02c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710852680, "uuid": "8c2ab971-4197-44b7-a9a4-4fac8ebdce4d", "comment": "Malware payload", "value": "9d78ef035e29c003c80ccf1da44d4103c7cdd2eda99c92d940a1eb8ff1721f9219e3c1513221bec6a8bc944365bf616a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710852680, "uuid": "c03dce0a-8651-435e-97f1-75c6a22a4aa5", "value": "T19D25122053A84942E3BF4EBD607180580FFAA71BE966FF5D594874EC2992787843337B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710852680, "uuid": "3481fabf-9ee2-431f-a7cf-7f529163eda7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710852680, "uuid": "bb18ac24-30c6-41a6-84f8-5522e5671524", "value": "24576:84SG1CYXid1fw+Jwz/S/6lAS/JPyv0PTVLsMUcMewnspH:84/1CsYlw+W7SCaMy8PRUcMeRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710852680, "uuid": "4df36849-295b-4d23-b715-672ffd0ab844", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710852680, "uuid": "44306588-4ca9-4302-9185-8ef8a2eef406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710852680, "uuid": "661a5b8a-768d-42bf-bc24-02662cee8ec8", "value": "SecuriteInfo.com.PUA.Tool.SharpHoundNET.1.17676.30887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d22bff-e607-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710862826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862826, "uuid": "a0da096b-98de-4567-a263-efc8462e5412", "comment": "Malware payload (Mirai)", "value": "345dadbaa657bab011724c5503e3f8be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862826, "uuid": "590add49-15c8-46ba-ac26-6eda13bf0173", "comment": "Malware payload (Mirai)", "value": "cd3089f90ee52720264439eac0ae4b244bafaa2778523c0b9969fdcd9cdcd373", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862826, "uuid": "bac2c4b3-9330-408c-bcee-48711e8f3ba0", "comment": "Malware payload (Mirai)", "value": "7757ececfed9dd3e70de8192db9621fa80e4facf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710862826, "uuid": "e06da7c1-f6d0-403e-b8f0-bec47976c655", "comment": "Malware payload (Mirai)", "value": "a0de9fcfa16cd575b09afbfbbc3ffd7e5532d7cfb68059bf10f8e9518f27f08b18ae87463bb562f2abc82b131fab2702", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862826, "uuid": "c6f42f00-0153-423c-baa0-26fc2f480085", "value": "T14414975E6E228F7DF6A8873147B74E25975C23DA27E1D680E1ACC1105F6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862826, "uuid": "df18aa67-a60b-41fc-8199-797e700a9701", "value": "3072:/lWQ+j5jHi/0zWDzY6GrlCSpQGdGO9+FRwuc2/Cl88:/sQ+s/0a5YlHeGIO9KwubCm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710862826, "uuid": "0747c5e7-743e-4527-8f61-a4bff24c3c5f", "value": 190356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710862826, "uuid": "c1263ab6-605b-4457-9f62-1a088cf4fe16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710862826, "uuid": "04171d10-cfab-47cc-b2cc-7338d08f0af7", "value": "huhu.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec535bb2-e623-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710875245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710875245, "uuid": "c21428cf-afdc-40bd-8552-d70d064610df", "comment": "Malware payload (njrat)", "value": "07482a2a2606a16508f564652c80c1d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710875245, "uuid": "4d10fa5a-fb7d-4872-9b1a-2f32682cc17a", "comment": "Malware payload (njrat)", "value": "cdb2580b515e92d91c18ba0cf1e5c8f0db6de62a2edd83f070da7abdeeccdc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710875245, "uuid": "09769d46-5227-497b-bb1b-2873556e090b", "comment": "Malware payload (njrat)", "value": "1d66ed2fd7de47192c07c0a9889b54d0140e506e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710875245, "uuid": "5702d378-ac74-48be-a31b-1ff375cc74da", "comment": "Malware payload (njrat)", "value": "acfeaf36a1b27a9b0079446a783e676199d56e1f85d431c11c5232af1897ef147f0118dc0f3d0542e5e037ce0c7f85c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710875245, "uuid": "36dc96b9-9797-47de-bb23-6b9584c1b7c9", "value": "T133B23B4E3FA98856D5BC1B7485A5965003B0E1874423EE2FCCC550CBAFB3AD91D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710875245, "uuid": "678239ef-7e23-4645-a309-6826c25e0506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710875245, "uuid": "c364f895-823a-45d2-bc32-04a391c74462", "value": "384:koWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZ2HmN:TJuk9pHRpcnuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710875245, "uuid": "39cd07fc-6ff5-470c-a1dc-1844609ba238", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710875245, "uuid": "093b7bba-e3b8-402c-a6a1-03d436ec4072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710875245, "uuid": "1b003160-02be-43a7-aaab-618d6b8417a0", "value": "bUmi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e8f007-e5ef-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710852683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710852683, "uuid": "09a4a66d-b3cc-4f5d-867a-c824e96d0bc5", "comment": "Malware payload (Formbook)", "value": "6e0935d0e6c119b346c499f2d8ec171e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710852683, "uuid": "32e4cceb-cec0-4309-a35f-b81feb222944", "comment": "Malware payload (Formbook)", "value": "cdfb1f76c1338d4881d0ba45d443e48dd8889a430a1cc1ce1cc0b5437e85b77b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710852683, "uuid": "df873b9a-ac8e-4ac7-9ded-039ffb7df573", "comment": "Malware payload (Formbook)", "value": "72649006fafce65ad62619a64e9e785906198986", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710852683, "uuid": "93465c50-8534-4eb1-b417-7f842843a721", "comment": "Malware payload (Formbook)", "value": "99711a7bfa39ee2a70bad9740242933a4a61e2a747c7e70d47b60df494267c514f7d2c5ba1b80e7fbe1ad7c13744df17", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710852683, "uuid": "df1a250c-dbcf-4a72-a670-1bf457ec326b", "value": "T17E63C02EE34F0955DF55A777434A4B4A05FCB33DB38540B139AC97343BAD82E4A628B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710852683, "uuid": "b179ccd7-14c5-44d9-a87c-540545d5b219", "value": "1536:DtP+YANB8+QiDmehCScvbLC0+We6edUadPTeOS/07vIbXwS8mo2/2:DtP+Lb8+QiDme1cv/CkRiBTeOa07vIbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710852683, "uuid": "22c2fe8b-0bf3-424e-8bad-b0201040ff76", "value": 67975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710852683, "uuid": "43df595e-6571-45f1-8195-e6dfb0703abe", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710852683, "uuid": "599e5bc6-600a-4dc8-b669-ada1d3ba1588", "value": "SecuriteInfo.com.Exploit.ShellCode.69.18092.2332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb0fd90-e61b-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1710871518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871518, "uuid": "9f7bbae0-050e-4444-b4f3-b725dd3c2aa0", "comment": "Malware payload (njrat)", "value": "e0fd55bba4b85fefccc50b5b648c8233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871518, "uuid": "431fa974-494c-426c-b57f-40669085d9d2", "comment": "Malware payload (njrat)", "value": "ce385b77503279ba23996904ff4cf68febd2cca79e0dec8182fa116583e536d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871518, "uuid": "131871e1-b1f5-40a9-8ecd-f282d64072cc", "comment": "Malware payload (njrat)", "value": "f5380fb50b77f641d21bf236f46e75bf87370111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710871518, "uuid": "a186b9b5-b15c-4469-a986-04fdbb37e2de", "comment": "Malware payload (njrat)", "value": "cb41f69bcfda4c8d48ca407ec1cea158421e9e8af8cbb2c952b0372a7571c47ab972aee1bb8d6736cedd6d000f9194c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871518, "uuid": "130062c6-0e06-448d-9d97-05a5ec95f67c", "value": "T1F5B22A0E3FA98866D5AC177485A59A5003B091470423EF2FCDD550CBAFB37D92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871518, "uuid": "fc1be24d-2d07-4a5f-81d3-509ff4f6c5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871518, "uuid": "d64dad6a-38b1-46a2-b1e9-b24599bd05d4", "value": "384:zYmdk8XvCJrQLdRGSiEYF7Y65gPyx6BDXNRmRvR6JZlbw8hqIusZzZlX:cwWkti/aeRpcnu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710871518, "uuid": "7b196581-0186-4a2f-94b0-64ec3f32af85", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710871518, "uuid": "12b86210-6ce9-4719-830d-fb986ce5c283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710871518, "uuid": "a5f2ba33-ba9e-4e1a-b620-449718f6ec8d", "value": "bUmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d7a06c-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837093, "uuid": "12226923-d00d-4f5c-8308-10e43ef61241", "comment": "Malware payload (GuLoader)", "value": "fa0c7a4d3ee0622cf24611ff4757dc7e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837093, "uuid": "0e1cfbdf-fb0c-4c8b-af18-f5618b7aa7cb", "comment": "Malware payload (GuLoader)", "value": "d01c34d940384b18592692a86adb5756b2704293ec6d2d67253a617dfba8c2ea", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837093, "uuid": "97a21978-5eae-4fed-9b6e-361deaa1b60f", "comment": "Malware payload (GuLoader)", "value": "e4534066d5a1e3b7a24fbbcf8c063617eef3be6e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837093, "uuid": "591194a5-1ec9-4ae6-b4a6-bd9a27943f6a", "comment": "Malware payload (GuLoader)", "value": "3b3a00f1aa1d8ee1963a0bb20bdaf880f11d2a88035bfda9f3542a20243ebe08066f9168f600b6fb7f2e8274be840dc0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837093, "uuid": "07b015cb-2bf9-460d-aa45-e2d75467c302", "value": "T186F339E3CAC52A588A861AB7EC134B738DA8419D33131F359BBDC65D604395C86BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837093, "uuid": "700fd64a-60c9-434a-ba47-0b94a9253327", "value": "3072:s24yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRHTOXhtqbexwW/gqJCcdb+VVGK:s24yENVOY0NpVXpK68kH3DPbkhZi3eNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837093, "uuid": "eb97ef43-7143-4bed-9d4d-aee16bcfe2fb", "value": 169065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837093, "uuid": "6c4194de-2da8-46a9-ae73-f2cc28f4573f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837093, "uuid": "eed95c6f-97af-4659-954f-6732ea313495", "value": "Escapee.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97577601-e5f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710854916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854916, "uuid": "1cc73f20-ba30-446b-aa26-1f3ebd4e96a4", "comment": "Malware payload (RedLineStealer)", "value": "f05c4d7d8486378b3804bce9d1330264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854916, "uuid": "81fb71a3-05b3-4a52-9f96-cc78fac9a18b", "comment": "Malware payload (RedLineStealer)", "value": "d1e075931e9cac74d85cc1c28f66a9892e20f33775643184cdad0077fbbf3819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854916, "uuid": "70c05a09-f2d6-475f-aec0-b212b32014ad", "comment": "Malware payload (RedLineStealer)", "value": "ba006f476a14d75def6e21b4896d46e1c3191939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854916, "uuid": "808be2d6-6307-42e4-a350-cd075fadbcb6", "comment": "Malware payload (RedLineStealer)", "value": "0596f3d20a540b5f384d9dd4f1fa5e04fb67ded5bf2d9a75d4afe44cfc873f970ccf2d1d62d3fe8a5558d575684aeaf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854916, "uuid": "1d2bf67b-35b3-4d21-bb24-88ef7c04a1e1", "value": "T1D3053A8579E2A7C3E7A7DA34D701AA51BA4719F20B26F5F9973386402AF73100C6734B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854916, "uuid": "a4d1cc93-29e5-4af9-972a-c4dd18001b33", "value": "12290e309f81bd2a39f49e94b684d1de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854916, "uuid": "000f55d6-3b69-4e12-b763-9df7b910a69d", "value": "12288:1vsv7D0yB4aes9ThYBw2OOUrh+RSRoM8yKDhU1XztCN9yCVqyCGHN4h:ev7DZxlKUh+IUhU1XztCN9yCVqyCa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854916, "uuid": "5309f6d0-2e0b-4391-b0b6-00e7275f57b5", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854916, "uuid": "f124dc3c-ab42-4487-a61f-cee065d99526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854916, "uuid": "bcd14980-f797-4761-bb7d-988f6bcf4091", "value": "SecuriteInfo.com.Win32.Evo-gen.19736.4702", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5604bfc1-e5fa-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710857384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857384, "uuid": "35313424-7d2f-4ce6-a51d-361927d16fe0", "comment": "Malware payload (PureLogStealer)", "value": "9b5a036b6c0ad4683c19fd0a5737d296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857384, "uuid": "0807e83a-7bd7-4263-a2a8-59e3bf73e469", "comment": "Malware payload (PureLogStealer)", "value": "d1fa49908480e6cc8369f5802ba0e0cc7ad3cd3fc55eefde91dd78a6e3556de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857384, "uuid": "a81078d0-b859-4fa8-8746-9ffa6f4144f0", "comment": "Malware payload (PureLogStealer)", "value": "d8269692b5c2dd6965f6f1828857818ff597bd7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710857384, "uuid": "e73afdf9-f998-446d-8198-9a34d7e7e8e9", "comment": "Malware payload (PureLogStealer)", "value": "5b42af8e037bd3fac5b285b3462df26621c22fb2bebcc0737b54fee87012ff3aaf39cad4fc2668c0605da2ba84228aa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857384, "uuid": "32dcc9ec-05b4-4edc-bed1-28b71c6117b8", "value": "T118A4BFE4567BDE26EBEC43BC60569A01A77D458AEBD3F709601444E18803B82D713AFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857384, "uuid": "03c82ff1-58c2-4f1e-b79a-7a0c04f13a3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857384, "uuid": "d37539e0-5928-42f8-9f57-ac1c17e96578", "value": "6144:6f3Vu32hIXyVyA3FzB3aLzQILB5LfNBwdMFG61Iu/nE8eBD4pi:643iYyVyCVgzQIzEChqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710857384, "uuid": "25490bc2-0bc2-4bb4-b12a-6d0802fb6fc5", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710857384, "uuid": "48af2059-283c-4c79-bc6e-79fcc411294d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710857384, "uuid": "479e4765-e9c0-43fd-830f-ee695e7f05e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d4efe3-e5cc-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710837845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837845, "uuid": "ad71cf28-93a7-45da-880e-623672a01f39", "comment": "Malware payload (RemcosRAT)", "value": "74c0382c001db494d23f0814dd13aec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837845, "uuid": "b9e2c0b1-175a-48cf-abfb-d2afe93b3a40", "comment": "Malware payload (RemcosRAT)", "value": "d3ccc0fb9071140e8f53038fe2485e98ef1f862811ddef342f9626a3dfa9db5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837845, "uuid": "21ac6a75-cfc9-4cd7-adb2-590f22deb7dc", "comment": "Malware payload (RemcosRAT)", "value": "40a2254dbb1fb817a8c404a38ebb3ce85e12f1d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837845, "uuid": "4fde2c5c-7d2c-47a3-836c-7515055dd93e", "comment": "Malware payload (RemcosRAT)", "value": "2e5ebbbbe0647b0b5fd246c806f9b864f008acdcf5b989229ca45e5a7d0e897e2817837bf175c92ce05b77a8458eb5b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837845, "uuid": "fc011085-7a04-4a41-b9b2-2f0d1a4e6a7c", "value": "T11D1523604BC88FB1CAA25377293B35F11A7141F8848EF57C7DD819492BD3B479B341AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837845, "uuid": "426c237a-faad-4262-8556-e8341f68fed2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837845, "uuid": "de790084-6bb4-48d3-a9ae-d86435a7a465", "value": "24576:r77Dn6Oq9s4uYmSRDlYG9fexl4OqEwClXatxMKT2OJb:r77D6Oq9sSRDly4OqEHJatzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837845, "uuid": "5548d67c-2f99-4419-bfb4-4c7cd18ede02", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837845, "uuid": "128dad84-60a1-41c7-864c-e6c4ba14d2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837845, "uuid": "50c17214-a48a-4a2f-b6f0-349282854fe7", "value": "SecuriteInfo.com.Win32.PWSX-gen.1685.16786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8916cc-e5f6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710855839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855839, "uuid": "89ef1f70-2d36-4389-b227-669b2cc6b4bf", "comment": "Malware payload", "value": "8f05eb5ed7dcb072fa58821e270480a4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855839, "uuid": "dc4f9d7e-cffb-46c5-b9f5-f29db5300b31", "comment": "Malware payload", "value": "d4eb05101d38804d204bd80800c9c7c65883cf2d223768f39d0bb776f78410ac", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855839, "uuid": "5d8a010b-d472-4fa1-8f3e-1d3ca7442d3e", "comment": "Malware payload", "value": "3de08b6cedef9a53a0f8693d192097bb136e8242", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710855839, "uuid": "ee435a5a-5e6a-41e3-af2a-495a72c74674", "comment": "Malware payload", "value": "6bf43a927bdee7a02a9a97d3de0891630ae7a6a8e68baa03659bf19ebfa06749055c2bba0003fe0807f5dda9a56c07d8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855839, "uuid": "d3e80b27-f7d2-4a6d-9db1-bb8d62b5a48e", "value": "T198C312564DB8D4B7F199CA3689914E6ED6B22B350BD4EBD1D37C0206C8263DBBC30D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855839, "uuid": "66d5a860-b42a-4600-8e52-15e41c22631a", "value": "3072:sgQn1beZn44Kbn4CFqjkWPrQ5ej5CA223rqoH:3z44KUtjjjak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710855839, "uuid": "016d03b3-1f8f-4ae9-a9fd-4337ec09eccc", "value": 128271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710855839, "uuid": "427b5543-328e-4324-9a7c-1603cba712c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710855839, "uuid": "f3c33501-7769-4572-8cab-e47c6aee2165", "value": "240306-yvl2kshc7w_pw_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f2d6c6-e5cc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710837837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837837, "uuid": "1ba7e058-4900-413a-a3ae-75a2d67ceccd", "comment": "Malware payload", "value": "563012234f156a94954f42f54b5b8a6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837837, "uuid": "0a2ae87b-97d4-4b84-a516-aa4d888c11b9", "comment": "Malware payload", "value": "d810be2ede09ac295c9e8648d6035681d10706e887586633d8958c0cc2297fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837837, "uuid": "de9d8c1b-5e54-436e-a147-9f0b6f7354d6", "comment": "Malware payload", "value": "0824b8a711d82dac06f5f133b986e15a522605d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837837, "uuid": "0f1f1543-7d7e-43ae-895a-add556eb978d", "comment": "Malware payload", "value": "09f462c70a58ca5b1031e421910380870ad78f103ef12d39acdb06b593b74b7df4d6b01da899ad7109223e1e5039abb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837837, "uuid": "1ad92158-1979-41cb-b358-820ebe822d5c", "value": "T1AA673377445E2EF6E258B2BDE3A25A08C558FEE48C3CEE47C694FD61D186343D01C46A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837837, "uuid": "b953566e-b3af-4fd0-9c89-fa32c5e8a07c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837837, "uuid": "4e8dc6ea-a358-4a56-b4a4-7761645e0d06", "value": "786432:yjOVmbkAE+601xCgI99dn4KrEklko6e2o0Ig8zI:5wkGfC/n5Rlz2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837837, "uuid": "6852d6d6-6551-4c4b-b19a-71d300fd2c7f", "value": 29871118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837837, "uuid": "83ae4363-54ce-44b8-bc86-70e5f105fc47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837837, "uuid": "44ab13ca-3390-43d7-a410-c94d41ec153c", "value": "SecuriteInfo.com.PUA.AdAnti.4532.18252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0cf54d-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710837070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837070, "uuid": "7ba8e35b-d845-4bf0-ba98-4876c7a53992", "comment": "Malware payload (GuLoader)", "value": "be0367af0bf04d28d73bc50ed6bfb2ac", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837070, "uuid": "5f810a58-a9b8-4b2d-88a9-59db67ab7795", "comment": "Malware payload (GuLoader)", "value": "d9a4b1ef7f3a3a422fa5bac6c79941f7657943cdc93815e2542638a93c2dc444", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837070, "uuid": "2b08200a-8421-49e9-a36e-b948691d58aa", "comment": "Malware payload (GuLoader)", "value": "5a846bf906c14add838ac2020f1acda05611e551", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837070, "uuid": "0b2beed1-981f-40b3-9511-e8427382e831", "comment": "Malware payload (GuLoader)", "value": "8b844d9562b79865dc79ca269983d599e7b9cd450936ea7ad2f2efc4ba4d0535882d9d69e08df0cb3221b240a27a03cc", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837070, "uuid": "5e4e2d50-5a13-45f7-a89b-b62fd1b50ebc", "value": "T1B9421AAEBA471B22CE8F2360F4B5C05D5E7E00DEDC124064BDD9929D2873558E369E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837070, "uuid": "910bca1e-505b-4243-a4ba-7ca26e9edfff", "value": "192:nLVBSKoP1RhCzAIm8qmpVOtPy233yN5HAE58Sq5Acq7LbbB+2ucFsmOwRWHxOK4O:zSRRhCdm8ALG5gKTbw2MLwNGtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837070, "uuid": "79aa51a4-8880-4828-9d98-89fed688aefa", "value": 13165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837070, "uuid": "3427c524-4fd6-4a11-ac59-4108656383bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837070, "uuid": "b218bbc9-97c7-4120-bb4c-f3afca4efadc", "value": "Scanned Purchase Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bbb37b-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710835046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835046, "uuid": "6785af3e-8fd1-4e8b-83b8-8ad4fce3a327", "comment": "Malware payload (Mirai)", "value": "7d7eef5e7dec06c0ae685eb8d0dd2e4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835046, "uuid": "dbce88e3-92f5-4c89-af17-1eac82718c6f", "comment": "Malware payload (Mirai)", "value": "db8d753d4ef3a528e9ede6d7ab619d6072979342e8fbc8a8ebf9f648f971b46e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835046, "uuid": "0d505fa1-87dc-4181-b3f3-43a2d907a12c", "comment": "Malware payload (Mirai)", "value": "7baa81f2e55a29aa4b917c5d8a5f37914778ecb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835046, "uuid": "6bc566ae-d121-4d1e-b9c4-67a560db2297", "comment": "Malware payload (Mirai)", "value": "7738551334bae17edac48db1aad1d0de75cb58f5832f521b47e619b48cc49ef6c2a7529c9445921fb94ab17363f547bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835046, "uuid": "822e6d76-3ec0-4406-9a09-aa7bb645e1be", "value": "T169932945BD818A26C5D612BAFB2E028D372537ACD2EEB203DE256F1133C695F0D77192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835046, "uuid": "2ad36ea9-842c-49fe-a1b3-0235e6083aff", "value": "1536:tsodlg66Q5QpQ4QwQ8Q7Q0OkjaKxGlDI1jUAZBviRjZCLnRJFyMHozIQrdZ4DvN:tJdld+u9lZs0O1KxGlDI1jU0BvWFKnF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835046, "uuid": "141ed14e-692f-4d31-93b3-eb67313fae82", "value": 91116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835046, "uuid": "8b441882-8171-4377-a101-4e5d68b2a3fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835046, "uuid": "e865d093-297b-49cc-8220-67bb0ae509f7", "value": "7d7eef5e7dec06c0ae685eb8d0dd2e4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd35022-e5d4-11ee-a120-42010a9c002e", "comment": "Malware payload (Stop)", "timestamp": 1710841209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841209, "uuid": "a402be0b-7b78-4893-97d1-1a2b18db211a", "comment": "Malware payload (Stop)", "value": "46fe1a99be0c8fcfa617314ab9f6e996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841209, "uuid": "96d3e4a3-2a80-4e0b-a894-a1e7aecf56c3", "comment": "Malware payload (Stop)", "value": "dc4c90ff7afc701b97de256780991a61a922c3c28c4e1e478793c5b42053dd5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841209, "uuid": "3ae7cd0d-aae8-46d0-a7d3-eab87ec1842b", "comment": "Malware payload (Stop)", "value": "905a3abae321d0d87f930de5120bd5db281c4153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841209, "uuid": "e6e2dd24-5d54-4a47-ba39-aa36ba1e11fb", "comment": "Malware payload (Stop)", "value": "453a027c0374402344f7bfba40e70c89056d28c310d7ae6b45b5ae5d836eaa8e1d067fc075e70d948ad120ae91c7ca6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841209, "uuid": "d75b8d1d-51f1-4198-b8eb-1fcb6fb325d9", "value": "T17EF40210E2D2643AE2610E7C8D9ACAF51A2BFE713D30D67F3114E53F1AF56718A22761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841209, "uuid": "5d328c5c-a58a-4e4d-984e-13cc24000bbb", "value": "530a3401076a1984b14298cfc00a780a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841209, "uuid": "3a1d730f-a033-4d42-b9bc-669f5e297708", "value": "12288:5zExWbQkSZU0OCbMtKSf6fzACDJx8RGxCkoqVIF3Xl9vYWiLeFYCkja33zhn:hEUQqLtoDbqGAkfVIFV9eIMqNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710841209, "uuid": "b82e6610-f923-4fdd-a1e7-1b5bb16151ec", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710841209, "uuid": "b8dd92df-afbb-45c9-94a9-afb3204a44e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841209, "uuid": "e1c89ef4-1a55-45b9-a737-e60ab539ada6", "value": "46fe1a99be0c8fcfa617314ab9f6e996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c587b36d-e5d9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710843397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843397, "uuid": "275b3d25-18d6-43f2-837e-fa1686b3e029", "comment": "Malware payload (AgentTesla)", "value": "007f71d91f4355b6e74c2f75202d41b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843397, "uuid": "3c6da0ae-6c21-42fb-be64-28ba9bd50045", "comment": "Malware payload (AgentTesla)", "value": "dceba55af1e605a6d7a75e46bc2a0f15a8d33c980ee8f261cf78a8d7061f81b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843397, "uuid": "70fa7bb6-5efe-469d-9b3c-96e6c5fc7948", "comment": "Malware payload (AgentTesla)", "value": "0326e0e59f62eec772e6d9f7af0645d46326af4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843397, "uuid": "d2e49369-60ee-44b7-9370-88d58c7f0e82", "comment": "Malware payload (AgentTesla)", "value": "d5c10249a86fb5fb4dacc5d79e94851e5504d10dcad148128b8c13e2f577c5fab10f90812c7601d363aff6f7dfe79cc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843397, "uuid": "f4e17d62-bc16-44a2-b014-e9ed07dd47e5", "value": "T1ADD4230BA9540BB9E72387BA56B78412C0F3963958B5DE1C5CCCC1873F227E744A31BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843397, "uuid": "6d50c6e4-a6f9-45f1-bfa2-e3d63e7b5353", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843397, "uuid": "46481975-8711-43a6-96df-b833b654d0df", "value": "12288:HIS17WINYe1xb4n0OAp+FOEhI3zXj9tZvBf4OJRYWqN:R1Tvq0OPFODf9tZvBgOJbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710843397, "uuid": "b5f64030-c4ce-41d5-8502-f6987ad7f627", "value": 628224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710843397, "uuid": "0ed7b9de-730d-40c4-b7c4-399d112ad9f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843397, "uuid": "82730c72-4753-4180-b55b-e3ca34d759cb", "value": "invoice and reconciliation confirmation form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffeb9633-e618-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710870554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870554, "uuid": "f70f82be-67b8-4a7f-8985-e48c25e98038", "comment": "Malware payload", "value": "f35cdad9509e69a23a92f011429b363a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870554, "uuid": "25d16c3f-e99b-4c83-b5c4-19ebefbb810f", "comment": "Malware payload", "value": "ddad1649d171367b307aa77f14b10826d6a5ae1d1dc1656ef1a7ddbe6ca43af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870554, "uuid": "5a421344-8005-49e9-a498-110ef3eff7e7", "comment": "Malware payload", "value": "6d4785a2ca81dda97e8f16f83e676b5dc79966e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710870554, "uuid": "abbfad87-a01b-44d7-b3fd-4c2f72d486d4", "comment": "Malware payload", "value": "13858645282f8bc69b33e202412017db63fa690877d4640524886923bac5d273e3cc539c778b347270889cc4fb2707ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870554, "uuid": "079504b8-a745-4678-8bf5-219906ec32b5", "value": "T179083308E356A914E414BEF5EF74663489A1B68339F2D073BFA15A817DE8B12B7350C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870554, "uuid": "105603d1-aeb8-4509-943a-4302afaf507c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870554, "uuid": "926d3ecb-a843-4d4c-a3e1-45e920d3c4a1", "value": "1572864:JkJ39KfNXWLJ9MXY5B8ceyIS7nqYdd6hIEhSmnJZxRByudPXFPR:JnfNY9MA/vP7nMhJnzxRB5dPXdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710870554, "uuid": "279517da-2d23-49ba-9b30-d62c3d45af6c", "value": 84136028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710870554, "uuid": "bcc82b0e-562a-469e-a11b-1c042a021997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710870554, "uuid": "654805bf-3fc9-4e69-84a7-1c93b2905297", "value": "Sky-Beta Setup 1.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8e057e-e5ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710823871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823871, "uuid": "23aff20d-7aec-48ca-9105-d9e7006e3fe8", "comment": "Malware payload (Mirai)", "value": "cce770308d522604cbd1f06b370ea990", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823871, "uuid": "fd517fe7-125f-46c8-9aa2-b7a95e3af1bb", "comment": "Malware payload (Mirai)", "value": "dde10a322aa02357a505f3b4362ed025107b4db3953c0f9112624e117d72ecaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823871, "uuid": "31d89da9-c3ee-48a5-9487-b0d63bf2e715", "comment": "Malware payload (Mirai)", "value": "86354ecc29c25e209c9ab9e9197f11c12a86df6b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823871, "uuid": "53ae5e45-e198-4323-8b27-12f26caa5431", "comment": "Malware payload (Mirai)", "value": "7258d51a08a4004b2e70bc94dd36139f644a3b3bc03643e8014cb0b64972c220b49b87797e4a720b1bf01bd9f039fec5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823871, "uuid": "da7cdcdf-fbca-48cf-92a1-acd2ca37f875", "value": "T15204885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823871, "uuid": "a18ca156-5fe6-44db-8c6e-d83b1f4a3532", "value": "1536:Cl2JvnXPvLIQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/zYt/Y:Cgv/WcwZsCK9VRhAX+bShFSP0HbbYlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823871, "uuid": "a9679418-0a72-4db8-9935-090aa84c205a", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823871, "uuid": "a0f50a9a-d60f-422d-b644-34a6701bedb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823871, "uuid": "163f888c-4374-43d7-834f-060a29dd97cd", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08e9e73-e5d2-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710840383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840383, "uuid": "8275cd67-019f-4c04-98e3-2417571dcd0c", "comment": "Malware payload (Mirai)", "value": "6fcb5fe8eb935d9bb25abadf7aeb53db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840383, "uuid": "4a35ac10-bdc3-4adc-9d2c-92491a6251dc", "comment": "Malware payload (Mirai)", "value": "df01513ee19579fb664509d914429913d4c14e95e2b91ebaebd8335f903b227c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840383, "uuid": "f4ba3e89-9474-4faa-a5e7-031b54f6535d", "comment": "Malware payload (Mirai)", "value": "f3bd0ec16bf4f8e4030bc1d1e8ffe1925ddf7db3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840383, "uuid": "783f1bea-600f-4ca0-bd4c-39a80b1ae1c9", "comment": "Malware payload (Mirai)", "value": "1710bd46abac6e751791645a6faf5c55b10ca647e9d5a808f12068af1148f86a2180df1fdb4924d838ad1296685488d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840383, "uuid": "0385cf23-a796-4ee4-967a-77624a346fad", "value": "T1CEE30B46F8819B11D5C111BAFE1E128E37131B7CE2DE72129D246F747B8A9BB0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840383, "uuid": "88f90ad6-6a79-45c9-90d0-92f7f840bce2", "value": "3072:MQ4AGUYehadXYDorYvaWZuvHE9CmDa7RF7:MQyDHdXyorSafWXDa7RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840383, "uuid": "5d519486-74ca-4aa6-b5d0-1d6d718782af", "value": 143228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840383, "uuid": "7c206860-e298-47dc-aaf5-fa05f378fd9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840383, "uuid": "700eeb99-50a7-4429-ac09-d0d2ebbdf5d5", "value": "6fcb5fe8eb935d9bb25abadf7aeb53db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0bca41-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837104, "uuid": "5610ed6d-aa99-4c86-8397-9fe68b537286", "comment": "Malware payload (AgentTesla)", "value": "d2f28c9b13c5176f8c43810879c7c2a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837104, "uuid": "53367d46-936a-4c35-9f0b-e6ab8ac41981", "comment": "Malware payload (AgentTesla)", "value": "dfbd92318e6be8afcea72ddfe9b409bd9017eca31fe055c7d98ced136cb2e08e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837104, "uuid": "d9268125-1c49-43db-b2cb-cc03bd48ecc5", "comment": "Malware payload (AgentTesla)", "value": "4821597e22c0b9a99b3510be24f076c7ba2c0522", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837104, "uuid": "7ddf0dbd-3f07-4138-8de4-6968888f4856", "comment": "Malware payload (AgentTesla)", "value": "70a6d7603d6a4630da212ae89df43990fa4834e58b605336530085454848cd754bee9d396713d97dc81af4fc45f442a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837104, "uuid": "4d20f703-3975-4015-8108-071e08e82c4c", "value": "T171F32BE3CAC526484A462AB7EC274B738DA4815E37131F749BBDC25D604399C86BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837104, "uuid": "dcdbd958-344e-4830-8a13-8ed7896b6f77", "value": "3072:su4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRZKOgFrqsjSJKgb4AmPVPqB:su4yENVOY0NpVXpK68kH3DPbkhZi3eNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837104, "uuid": "77457675-40bd-4d6b-a3e2-1b0850f077f0", "value": 169596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837104, "uuid": "3c4d178f-7f3a-47b3-9046-ff934bc96e7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837104, "uuid": "b36ad8bd-f148-4dbf-9308-e0723d896c7b", "value": "Order for Frankensolar.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865e8fc9-e60e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866055, "uuid": "6b967600-e9a4-4e6e-8ac1-65e7a5270c83", "comment": "Malware payload (Mirai)", "value": "f593e5922bb1ef9eab437e49dcef73d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866055, "uuid": "6f7291d9-37c7-4fdb-ab78-00badf6a25b5", "comment": "Malware payload (Mirai)", "value": "e066ae17558b918618da04231c17088011b052e438203901aba63fe1105ac050", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866055, "uuid": "4118fe6a-03a3-4207-9926-0e25a177f1ce", "comment": "Malware payload (Mirai)", "value": "7cf6e9bfc2b6d29c623f0bad7bff1e3e649c8475", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866055, "uuid": "6a0d6ef2-3092-4f1c-b493-15ba32c1bf80", "comment": "Malware payload (Mirai)", "value": "f0fe4c0f1a96c664c0e400099fc07d78f50f5830b2422d8fb867fa2172fbe00f449262fe69444640e7ffa45491912249", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866055, "uuid": "41171a42-334e-4e89-8cb2-5b73f75c373a", "value": "T1A7B2E1486169FC61C7706C72D9F9058A3F799BBEC2C720915A95CE2C7EA10C848B53D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866055, "uuid": "e430157c-6408-4a56-9c5d-9c83a1d5a6ca", "value": "384:APS6qjCYugUMyV2zknBDqR36Z9sYU9BtyvGMUkgd0aacEk3zh7qmdGUEpiaK1:e8CYugOxnBDqh6PslbtyOMUkgdfacEkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866055, "uuid": "adc3df0c-6542-4a2b-85fc-236474e78525", "value": 23832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866055, "uuid": "fa47ef56-0542-4de4-801a-e87eae612cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866055, "uuid": "37d9cc53-b091-4ca3-b031-aa10a87c4df5", "value": "f593e5922bb1ef9eab437e49dcef73d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64d3c18-e5ca-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837010, "uuid": "8269e2b4-2072-487f-9461-db2d5405d70c", "comment": "Malware payload (AgentTesla)", "value": "9d734afa7d130bd4a0a02c6a461b36e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837010, "uuid": "bbd33719-3399-4bf2-9921-9478e123b908", "comment": "Malware payload (AgentTesla)", "value": "e0b1bcb5ca129ff46e5623f8fb3bb079df557e688e04ce79747eb7ab8ad1d3b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837010, "uuid": "ac2ffca8-cbae-49e4-94ad-99e6a999ec54", "comment": "Malware payload (AgentTesla)", "value": "878a345533c10e9aac233df91cb34a31fe34bd28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837010, "uuid": "5c83fef2-0f63-4fcd-91a0-0fb121bb8a21", "comment": "Malware payload (AgentTesla)", "value": "2816c7542429188ecbc04be2e6f7c3f49a26dbc28709fe032f70a8df9a57815e68eff0107a156a3d1d5362a9569516db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837010, "uuid": "fde76958-c0fe-4364-898a-0b0e46fe49e3", "value": "T106D4232876F45B22E0BD27F94AB151519FFAA1633870C70D6D8074DD2F96B80D8A3B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837010, "uuid": "51b163d6-a3fe-4a8f-bee3-1437593fa9ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837010, "uuid": "c1d56a07-6e4d-497a-903e-352bbd025e91", "value": "12288:z7gRhxAMnM5zqiX+yAvZue7ze/RkPliq4hP82V6ezIDymDqZNas0uK:z8VVMdqiOZv4e7ze/ep4hPuezIDBOZNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837010, "uuid": "ea8465f9-c569-4a8a-8b07-57e2c3a8a55e", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837010, "uuid": "d73e36ba-7d9e-4468-88ad-76eb23f3ddb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837010, "uuid": "aede31ab-bccf-46df-90f5-64140cbe1d60", "value": "DHL9407155789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af80e4c-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834602, "uuid": "106d1bb0-488d-46ef-9167-f4f3bd593c66", "comment": "Malware payload (Mirai)", "value": "1e9f87608343f81df610822312e93028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834602, "uuid": "207082d4-5f40-44b7-a469-1b069db780d4", "comment": "Malware payload (Mirai)", "value": "e1942bfe431cf8e5f4ff487dab40c46f676922e17811ea0102d4811b8d32e74e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834602, "uuid": "f3e41d90-9148-4ee1-b05f-8d2a77e89964", "comment": "Malware payload (Mirai)", "value": "9eec2b8869c9629cfd4ec17adbbc67a6a60cb549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834602, "uuid": "999c1888-77a7-4ceb-b366-e6cff66d9280", "comment": "Malware payload (Mirai)", "value": "4f6b640d80ce3b7faf6ac09d4cd481576f6ff743ee950f3f7bfb1faede6d98840eb3c649ace6c509d1593f01af2d75ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834602, "uuid": "e3cdc763-6c52-44a2-b236-b15129de853f", "value": "T14963F846B8828A12C5D423BFF92E118E332723B8D3DE72139D115F15778A96F0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834602, "uuid": "79cb36ad-0a28-495e-b83d-0d4d3e9b2c40", "value": "1536:yqnv19gqZmNFNZFZNZvU6eZnzaI4iHW87Zg:CF77VEW87Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834602, "uuid": "853f701d-fec0-4f59-af23-88f832f7840a", "value": 67268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834602, "uuid": "a5a36a7e-66af-4145-9721-91cededd5dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834602, "uuid": "abaf3d37-596d-4fec-ad22-6b5f3d401c83", "value": "1e9f87608343f81df610822312e93028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fbe5f0-e5d3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710840773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840773, "uuid": "d7e11304-2b06-4227-ae65-2742f9a98a53", "comment": "Malware payload (AgentTesla)", "value": "25375705df41c56c40e056545ff3f4d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840773, "uuid": "83003704-20bd-475e-80ad-8b0a116c5230", "comment": "Malware payload (AgentTesla)", "value": "e2838cb88878911f84442041b0f01807d2fa0468a8f521ddf53dc1d578685126", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840773, "uuid": "2e5b1cc4-9487-4d55-b3ad-131d5861b98e", "comment": "Malware payload (AgentTesla)", "value": "8a2c0cd6307e0b60ac92bcce9ec9de0bf91e98fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840773, "uuid": "2d2b94be-b7db-459d-afbf-81fff11a741d", "comment": "Malware payload (AgentTesla)", "value": "f03d0796e01de542b3c3836bd88eeb015813bb6d308d85d9e3ecbea00c9e44657c9e0831f6e3473c18faaf8a10b26b69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840773, "uuid": "2ebf54c3-47aa-4573-876a-154575596ecd", "value": "T1B773BE2DE70F0925DF95A6BB434A5B4909FCB33DB38540A179AC973437ADC2E462287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840773, "uuid": "00d0a61f-9e4f-4f92-8c48-c44f8577003a", "value": "1536:vLROkjy10yG0+Wm0x7mcLiqkep24scugrcfb0ogyi21mOlJWAL5WO4U6Rhq95kVF:vVtm0s+Wm0xNLiqkes4sXgrK09q1mOlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840773, "uuid": "eb6bd722-d6a7-429f-b9f2-25fd85d2ddbd", "value": 76387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840773, "uuid": "3a766c1d-30a5-48ac-82d1-3501ddc39f43", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840773, "uuid": "f6ad8068-0e68-444e-934a-a7a6e940cb17", "value": "SecuriteInfo.com.Exploit.ShellCode.69.7870.25770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fcff01-e614-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1710868789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868789, "uuid": "767a31e9-cfb7-4845-82f7-482b1e37f7f7", "comment": "Malware payload (Glupteba)", "value": "920ad1ccdf5999716f0329fe388aa355", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868789, "uuid": "fe594fb5-983b-4cf3-98c1-a52deec8766c", "comment": "Malware payload (Glupteba)", "value": "e2e37e160be44c58891cf9df768618943349e6a4514d755773449cbd04670dcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868789, "uuid": "2f618994-a387-4986-8871-40de732d4742", "comment": "Malware payload (Glupteba)", "value": "81519a3c733d10cf3587b71bea913c5b1c04b738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868789, "uuid": "831b8c4e-f4f9-46be-988d-13e0f1319659", "comment": "Malware payload (Glupteba)", "value": "e94db117d99867f2672656e163124c6be259191dcb34b56dd8dc7e173f91839e46a1975d5b5720c192e2594ec65846b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868789, "uuid": "2f2dc822-e3b2-4395-a852-48f5a8d2eb24", "value": "T14E163324F7C29834E130493D17E1E2F61B1FF6B46438D4AE7258E6AB57F22A0581377A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868789, "uuid": "6817a871-3db1-4976-8c9f-6c33951a106d", "value": "f78bbdf2183136107a24fb7ff4b7990f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868789, "uuid": "21f2a273-b6bc-4e2e-b130-f81a6fa744d2", "value": "98304:mBYAkxfOsmtVTXBkX43z9WcJmPNEQnex2mBFRztvVxAnQ:BFwN3V3z9dJmPNvCLRLxAnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710868789, "uuid": "1d00f5af-f8d2-4880-ba1a-d9865d95a6e0", "value": 4356496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710868789, "uuid": "54025fac-e79e-4dc0-8c11-28af1845d143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868789, "uuid": "44e2dc3b-1d41-4a1f-88c7-c696fba8d833", "value": "920ad1ccdf5999716f0329fe388aa355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586f52ad-e5ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710823887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823887, "uuid": "4c0534ea-c2f1-408e-bb06-d5bf75daa5cd", "comment": "Malware payload (Mirai)", "value": "36076d843e13dc0ff3ae872eef2de75d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823887, "uuid": "c21356fa-9842-4b29-8b6e-16d730029bfb", "comment": "Malware payload (Mirai)", "value": "e39504842dee1383b3d1e5b2daca5ddce787cf7f15ff465d630e7b35eb23fffb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823887, "uuid": "de4377bf-6f23-4ef7-aa3f-af0b4c31ce07", "comment": "Malware payload (Mirai)", "value": "92449098e246a1bbffad92253fe3efdea4cfba58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823887, "uuid": "769cadeb-5f69-45d2-85e1-8652d7f00e60", "comment": "Malware payload (Mirai)", "value": "592786217771707f4f801f47915bc17bf9d13ca01181554c5c01900598dfc5ecb04e1780db24b331713970bce56add97", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823887, "uuid": "561a22e4-c125-4401-b322-e50e90b1c772", "value": "T194E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72029D246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823887, "uuid": "33525ab1-c180-41bd-9d5c-91e2b6a14e41", "value": "3072:ZUIK7G6UWv4Wj4X5s9YHwIaOuxGj5zCm3295RpY:ZUrnR74X2uHha9G/3295R6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823887, "uuid": "7a24c785-9a02-462e-a589-6b0b5f12e1d0", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823887, "uuid": "de0c4d82-1aee-4739-81da-0b739bcbbcf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823887, "uuid": "d4ac8903-2842-483b-a196-f686badbc2e0", "value": "bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9744b6-e5d9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710843091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843091, "uuid": "614a0340-d207-4779-9a3d-669c17034956", "comment": "Malware payload (AgentTesla)", "value": "82fe0352c1f7872d9214d9e99821285f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843091, "uuid": "ba2d553d-faff-4409-97df-8d1fbe07e47b", "comment": "Malware payload (AgentTesla)", "value": "e3ac69a416608e83453cb0afb001647a7f3569159c4fa8d079c71e55fccf2845", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843091, "uuid": "984bcb88-c6e5-41ef-a13a-3d2731ad3da6", "comment": "Malware payload (AgentTesla)", "value": "2bd2f76044850714fa0b44feac3bccef572ec0c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710843091, "uuid": "5dfeec91-59d0-4c0d-95c1-88d6c2d0e495", "comment": "Malware payload (AgentTesla)", "value": "63e01e57a46db1b9299966e1a955db189b57dc1d354219ee54d640471b9225941b519a4e8aa2089ac9df44464ec8449b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843091, "uuid": "112e5e76-46eb-4bc6-bcd0-ff894e6c848b", "value": "T16CD4E01033EC4229E2FB4A7AF4B588658771FE22B922E75E2CD47B9F10777858512723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843091, "uuid": "312e13fc-9d22-46b7-b96e-f54d0080df82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843091, "uuid": "66de2017-e655-47d1-b225-da13366310d7", "value": "12288:69V08s7T30VQ2c5K8J/w9VSLa29X5iMj0MoKXBpbIq4:5t5rJY9HuX5hjVNBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710843091, "uuid": "84c9bb7c-4277-41d5-8cd1-9e4bc4ff3652", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710843091, "uuid": "392a60e6-1694-47b9-ba0a-b3ce487e3ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710843091, "uuid": "79ad2284-de38-4a25-9fc6-ca958f898953", "value": "82fe0352c1f7872d9214d9e99821285f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d03b4b1-e5bf-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1710831975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831975, "uuid": "35bf2686-238c-41ea-aaaf-7f811db13edd", "comment": "Malware payload (Formbook)", "value": "58a8ccf69147771a1fd41b419dc737c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831975, "uuid": "2bc8c630-4025-4a35-9196-98904072e40a", "comment": "Malware payload (Formbook)", "value": "e6adb00a09ed823974083051f202ad4369411992de634a49fa8c70a1d903f883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831975, "uuid": "a22117b5-b39e-46d9-86bf-bf0b8e58bfda", "comment": "Malware payload (Formbook)", "value": "1332271121d93356400c5d4e8f47afd8613a099a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710831975, "uuid": "761198c3-3a41-4c54-b680-2ace02631525", "comment": "Malware payload (Formbook)", "value": "82bd7b903cf88a1a1ad34e6957f3d1cb96e9c1dae2de052f5673e8dddf92e2dd7ea3daf39a8ee6896887961a3278af61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831975, "uuid": "67771f24-2d81-4661-9df3-6264af7beb41", "value": "T1D4E4238ABA1046C7EB3245F4316D9D535BF11C9B3CA2EADC6C8430EE59F1FA99201973", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831975, "uuid": "ed91a797-3923-4bb0-bc33-9a416b461a27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831975, "uuid": "94b7a462-dff9-4938-9926-0d5cf7bdb12f", "value": "12288:qlPloOJRYWqgWrMPSHNtjtpKGkyXw1D/ZEuTRwuraHPiJtDsdVZFZQlnzAa1na6F:89oOJb96MPSHuTExuu6nsJFZQhlM758", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710831975, "uuid": "30b28d89-401d-431d-95be-acaf3cde6d93", "value": 704008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710831975, "uuid": "7a3c7e25-ba9c-48d6-87cd-4979409996b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710831975, "uuid": "59b3f1c6-293a-4703-9e2e-3a068c9803b7", "value": "NQ No. HDPE-16-GM-00- PI-INQ-3001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57194404-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710835052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835052, "uuid": "edcb550b-fb77-4984-bbd4-7c2d080839ef", "comment": "Malware payload (Gafgyt)", "value": "6e63d6f0965b70f33d439a813740f281", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835052, "uuid": "27298006-5fc9-4e3e-b331-2b9f640accd2", "comment": "Malware payload (Gafgyt)", "value": "e6beed85838f78e0d87b03f08d9747f85ad07334a2451266c346b3a5b8720169", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835052, "uuid": "51f9e663-c9ef-4e9a-a2e7-6f21456945ed", "comment": "Malware payload (Gafgyt)", "value": "a1ce0243dc682c183d234c8df83f98ccd5eaec93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835052, "uuid": "32de78aa-41a4-49bd-85b5-5b2eee2d677f", "comment": "Malware payload (Gafgyt)", "value": "5643f018038eb27637d7dc0fd1e4cbb112b269e50bc43095eb09e725ae841b25138c032e5e96cfb4a03c7fcefdd36126", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835052, "uuid": "e6ff2e18-b827-43dc-8e43-5f5e1466a120", "value": "T1B1D329B9F342C2B3C44706B1115BDA3B5D30B6F7176E6A06E3681DB0AE628C23499F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835052, "uuid": "0ea8b162-da30-4d0e-9f4a-0e7e884b7c6b", "value": "3072:yclx0/BSAMipV3SwwaY5zjS5h6Naqb0mJswdytNr9:y3tD3wjS5hv7mJswdytNr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835052, "uuid": "84971001-3867-42ab-8c7e-134e591291d3", "value": 142599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835052, "uuid": "dfe967d1-5d58-4e02-81cf-edccbf205444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835052, "uuid": "2594fe30-f612-439a-aa9e-131dc9bfffa7", "value": "6e63d6f0965b70f33d439a813740f281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c41cc5-e604-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710861938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861938, "uuid": "5001287c-c692-41b1-b492-f4953564ec99", "comment": "Malware payload (AgentTesla)", "value": "e9507c64edf885a6dc90671b5252633b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861938, "uuid": "94c0e60d-354d-4ba3-8ad2-b30a0a1cef8b", "comment": "Malware payload (AgentTesla)", "value": "e9ee37ffd9af84b5f2e9d6ba15c9a06f7a339dd6eaedf8608005c865e5ff0a03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861938, "uuid": "aa5c99ef-4506-496f-94d5-b1c3e8171d00", "comment": "Malware payload (AgentTesla)", "value": "b9d190ad74ac6408019c732387604ace9f50c44d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710861938, "uuid": "49b28bcf-2535-427e-8356-c26b4130e5b2", "comment": "Malware payload (AgentTesla)", "value": "22a0c32cccbfb1b8730622e376c2cdf080f3276ad807af516b3d2f07ecb6726d0eea1f658e50fd9c27ae64813e6fc749", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861938, "uuid": "360126be-3112-4435-a5d4-aade7618592a", "value": "T15B259D0273D2C036FFAB92739B6AF24556BD78254133852F13982DB9BC701B1267E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861938, "uuid": "89b99bed-b64c-4ea1-aef7-049d9ab37682", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861938, "uuid": "c59926a6-e939-4581-a7c8-22804645c4c6", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaUTI0dsKR+7Sy5:ch+ZkldoPK8YaUTF+KQ7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710861938, "uuid": "55e8b1c1-2f90-4421-aa6a-c8c0044e0275", "value": 1032704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710861938, "uuid": "8ad1c06d-ca0b-460e-a26d-9850b2d420e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710861938, "uuid": "34adce99-de6c-4f1c-a89c-1d03a174f10f", "value": "SecuriteInfo.com.Trojan.AutoIt.1343.21344.27980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702890b8-e5a4-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1710820491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820491, "uuid": "9d59e349-a0a6-4ccb-af06-5d6dec17c476", "comment": "Malware payload (AsyncRAT)", "value": "2644dec48ca3539cfc4a7b4dba0bd212", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820491, "uuid": "872890fe-255f-48d1-8c00-54f085bc5744", "comment": "Malware payload (AsyncRAT)", "value": "ea7efe5b685adb6324eea4717d5a9ef0c09c0222acc527d3bff2dc752d0cdcf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820491, "uuid": "93eee9c5-fb6b-4c01-a12e-ffbf74918cd7", "comment": "Malware payload (AsyncRAT)", "value": "d5fd9c4b6f865ba7dec0604bdd7b06f0f00023f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710820491, "uuid": "f322851a-1b29-4895-82ea-0c2e56be0169", "comment": "Malware payload (AsyncRAT)", "value": "0442ddb2f577afbad430b441bf00f97987eebd9383dabd155bd9d51c968d04bc4fb4f91d1560b5c5a321844a175b256e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820491, "uuid": "45a12284-aee1-4a03-987b-fd8bc72cac29", "value": "T1FF72F8111BF81F21FB7B8F707BF89A221E32BA529D60C65F095582444D32BD1A9F1F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820491, "uuid": "08b6678d-e1c9-4227-83e4-d65bc59d36e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820491, "uuid": "b2e53871-3a2c-4ca9-91d6-12dc28125620", "value": "384:l6IyZLpL3LxYLTL62cpOgAM+o/8E9VF0NyA1epRJ:l6rZFz1Yn3cpOgAMxkEnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710820491, "uuid": "7409e651-e41a-4085-b9dc-dd47371d2958", "value": 16648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710820491, "uuid": "b3c03699-28d1-405f-bab8-27d2013d8752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710820491, "uuid": "08053b0c-e6c4-4ac5-9c2f-4763e7cf5e81", "value": "2644dec48ca3539cfc4a7b4dba0bd212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ab9e8c-e5f3-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1710854273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854273, "uuid": "2c010244-0e5f-4652-885e-5a1832ce713b", "comment": "Malware payload (GuLoader)", "value": "608f5e6a01f876b7b2dfd04d809580be", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854273, "uuid": "a11ff6c1-7c0c-438f-84bb-3b8ffd12b8a6", "comment": "Malware payload (GuLoader)", "value": "ec010920331a5a1c033036baf3a168dd83b75b61c5eee370774cb13d1c4d0358", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854273, "uuid": "ac126219-1a52-43d5-aaf6-275189d8e6a1", "comment": "Malware payload (GuLoader)", "value": "5e07dfe35b23515a087a179e709ac9d5495453e6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710854273, "uuid": "b7154086-89de-4fa5-ad31-2c7514c66a52", "comment": "Malware payload (GuLoader)", "value": "501234c66995a1a0cd3a3fce282cbbc560f5c50aef22b8ce919784b0a61f449f8b22a7c2a440bdd48c6785354df7fa96", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854273, "uuid": "e39f51d3-ece0-4d5b-8a23-ae930d49c521", "value": "T13FC3125603A14B43CCA3A34D484F7865CD6A2D0248896DDDDDBE19F7BCEC1C8A5C26ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854273, "uuid": "9d10a383-90f6-4bc7-9d96-2ba408bebca6", "value": "3072:qZ67JyGBD9nhjRvQz+kAAUvi3JqCmTP2nrj4oBbyYDKEWpJ2L2Cn:y+BxnhjRvQzlMKK2AoxXe2L2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710854273, "uuid": "4f6e7128-4b26-432d-8c3d-1ad85e3995e8", "value": 125998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710854273, "uuid": "62db5eae-fbd6-4dfa-9e16-a3d71e281018", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710854273, "uuid": "12c725f4-ca52-4f90-87f6-fb4d64529b31", "value": "nNew_order_requirments_7383882736_pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1c694e-e5ce-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710838546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838546, "uuid": "4afdd973-df95-4c86-b1e9-38ca7fa6a7cf", "comment": "Malware payload (AgentTesla)", "value": "ee1af796b86fc918fe07727abf265d3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838546, "uuid": "3b01b4d3-e821-4d33-9654-fc273bb9f25b", "comment": "Malware payload (AgentTesla)", "value": "ed8a3593d056c5afa99fc4331390b42645b3800fa98e5b5e0089f7e3260ba283", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838546, "uuid": "ca080297-e84d-405a-bfdb-8e6f5f579f96", "comment": "Malware payload (AgentTesla)", "value": "b980507c8194b0c2009287e8f1d7d1837c58c20a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710838546, "uuid": "d71a8945-05f4-47a8-8188-faac2d144c32", "comment": "Malware payload (AgentTesla)", "value": "16eae6219d587767431d6a347dff2ada4b7f38eced1be89176c79dcf211e198182f94a303ad34c7670efbfab40b00efa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838546, "uuid": "9441d693-b13d-4654-ba9a-1ac751b59a80", "value": "T147D4239E98DF1B3ADBBD0DB21429291143E04DAE2D10FF3A1D5078E17A13BC7786593A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838546, "uuid": "514f1898-50aa-4861-bb41-b137b159d204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838546, "uuid": "14d5bfc7-8bdf-45c4-9bb5-10e387308681", "value": "12288:Rmq89y5ikF+J3WegalzUnurbZPcDnFv5NfEgeYvmnaaSySf+n0eZOJRYWq:UX9w+bgaNUur9cfNfEmeAA0UOJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710838546, "uuid": "28852455-9248-4f1a-b5ad-b9016451e087", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710838546, "uuid": "d947418e-7635-4b26-8061-d19ba930dd4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710838546, "uuid": "16a9c73b-4703-490c-b45a-08150a0b82a7", "value": "2024-19-2118fernas.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc63e29-e589-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1710808813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710808813, "uuid": "e2855186-02f0-4d83-b30a-b5955af93feb", "comment": "Malware payload (STRRAT)", "value": "fadc391eb366687b72ef339d5aae261d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710808813, "uuid": "7070b738-1a28-4e09-96eb-9636f2c383d9", "comment": "Malware payload (STRRAT)", "value": "ee5420e42f0a24abc94f91a63dcf822e21eee1536b815972bfcac06e7a2d9cfd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710808813, "uuid": "d033afd9-480c-4b06-bff8-c88da15db8b6", "comment": "Malware payload (STRRAT)", "value": "4c05a869393902fad202fba4b154af41b398c788", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710808813, "uuid": "a0168809-92cb-4aa3-b64b-29529fbd5724", "comment": "Malware payload (STRRAT)", "value": "12d638cb6fae9bd3d322441452547d614bf6edbb0c94f985cc4cef782adcc04d2c036540751681fd59921e002acbf577", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710808813, "uuid": "76f854d1-4c67-4241-ada5-d102d5300f90", "value": "T11904F06E3C7EC8E4D443953200598273FB09119ADA88E5AB77FC658A4C74C5E1B92ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710808813, "uuid": "04407e3d-fa26-418d-86c0-28ee21f2fc16", "value": "3072:QakzYwQS6NRrYHeT9SbSuxeU6HaZShkSpbj57QaemO9I2xsdzxSN:jnwOTEHeT9tj1b9o/+2xWVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710808813, "uuid": "d75f7f5f-aef8-497a-82a7-25fa0c7dbf74", "value": 187291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710808813, "uuid": "03ef68a4-c578-455a-9088-adb9fa752ade", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710808813, "uuid": "f00a8cc8-8288-44f5-a305-1093de612668", "value": "SOA JAN (BM SHENZHEN OCEANSTAR).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0115466-e5e5-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1710848596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710848596, "uuid": "6000f72c-a2b5-4f37-a08f-dca948bc5e70", "comment": "Malware payload (QuasarRAT)", "value": "c5dbdd47d42994efc153c6ec0475fbd7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710848596, "uuid": "c495597c-1995-4c13-9570-3729e6af39da", "comment": "Malware payload (QuasarRAT)", "value": "ee8d84e3da3e1334daf11ef37d7ec7be0061402f9df2fb3d33c969ba1ef77cc8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710848596, "uuid": "5eb5977f-13d7-4380-acf6-aa0c175b74a3", "comment": "Malware payload (QuasarRAT)", "value": "dce47ad6eb232e1df3b014ad690d3e6233170a9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710848596, "uuid": "856d7321-3d02-42f1-a675-f79875bf8ae5", "comment": "Malware payload (QuasarRAT)", "value": "43ac1d4b20b49c6aa7ba3d457d3ef9b9d0c1beb26ee551f8767caf7d088beb11cf3ae8385966d520b8e5c58e0670584b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710848596, "uuid": "0913b984-11dd-4599-9171-ec7423c9d85a", "value": "T1BEB14BD27D982B607257DF027AD1B5F28D1EB757E977B2FC6040918813E0C846E05BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710848596, "uuid": "ce74a88d-9fbd-4918-919a-d9762f0ae607", "value": "96:xvMev69dHo3vYuG2vwVBAxgQMnXeScYA4c19RqkUN6TM4JE0H8KqCr:xkeCTuQuG2KWxfkciqqfEEKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710848596, "uuid": "93d0e4ba-893c-4797-ad70-ec2d6a3402e0", "value": 5194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710848596, "uuid": "e535e7b7-4b74-41fa-b592-2ab77f00c189", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710848596, "uuid": "c26993db-d3d7-456f-97f9-01824a257071", "value": "558_return.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aca0b8-e5c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710834613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834613, "uuid": "6ad17564-09d7-449c-8d57-89ec95057825", "comment": "Malware payload (Mirai)", "value": "bc2c783f8447d47c538c31bc38aaca74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834613, "uuid": "487da8f8-9d95-4db8-80f0-5ee0b345f2f5", "comment": "Malware payload (Mirai)", "value": "efa55c4bce6be7e04f5ae01a4469d3b82f0770eaa544919ce5fbfe3bc2fb9c7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834613, "uuid": "2791b9bd-9bd3-42fd-8b05-e69d25e8868d", "comment": "Malware payload (Mirai)", "value": "91eb4c1caa62c03dedae2a9b321d6b1eb5f87814", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710834613, "uuid": "b32a0122-c967-4c1f-b259-8450ff014cda", "comment": "Malware payload (Mirai)", "value": "23c35f6f67ba2eaf051d2a9f00259deffde95593121b51ed2bf2dc5b9aa7528165b0fe0bb6ae15cee4cdb03e377c6b83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834613, "uuid": "12c5c54b-fc0d-452f-922c-7702e72e0410", "value": "T199434C11A9392B1BC4D0E8BA22F74729F1F16B9E16E4CA0E3D721D4FFF2195056076B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834613, "uuid": "5e4be4dd-e91e-4ca8-beca-530913af168d", "value": "768:ppZoO6u9Vm2VPzs1N/elFeuiEZKgCqu3LEsQjSO+i3XCWj:pDAuVm2VPzI/oFeuiCKgCq8EsQjQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710834613, "uuid": "13fd28f2-2409-4b3f-b01c-7fe80857a96a", "value": 58840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710834613, "uuid": "2237095c-ba0c-46c3-aa5a-9b73e321ae64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710834613, "uuid": "6758a7d5-fab2-4813-be4d-a1869bc4cb23", "value": "bc2c783f8447d47c538c31bc38aaca74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3b8bd3-e60d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710865712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865712, "uuid": "54bea0a9-fefe-479d-a7df-b0c8060cba2c", "comment": "Malware payload (Mirai)", "value": "d20b54f33b898e6872da9984d564cf29", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865712, "uuid": "588601e5-3f85-4778-87ef-2980383351b9", "comment": "Malware payload (Mirai)", "value": "f05a60d108c53b4ffaa98dda6c05a58b57848f4368bf7fac1097198c52336272", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865712, "uuid": "5c1711b7-00f7-4109-9602-8227da6b1a23", "comment": "Malware payload (Mirai)", "value": "a499d18877b42c37f52c0e46912b61a6040fdda8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865712, "uuid": "5829085b-6f7d-42da-be33-7f904cd43137", "comment": "Malware payload (Mirai)", "value": "4212218fe4262e27f8a64d3be38501086d23af80bcf29d4a5c716e69d6c8d40dc078c75bbc7e17e36fd14cfaa2d0838a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865712, "uuid": "51ee05e0-ebe4-43ed-b49d-ba19e9fe3ae0", "value": "T16182D07DBE797052EE59C4BCD830285EA72F709D1F099E6AE6D423C22846C047037FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865712, "uuid": "17150012-cf11-4d82-9c64-6db0d16ce6a7", "value": "384:yLrq11WrutJe/YpNvqmNT1phlwGzjBOFp5xAhidzUYm4rqL2EcciFqcJu:yLrq1TeiRqO5byPxAhYm4r8Flss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710865712, "uuid": "252080bb-b23f-40f4-b0fc-f8bfe2b8ebba", "value": 19020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710865712, "uuid": "ce974801-90fe-4d18-bb44-1ce293e7d097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865712, "uuid": "ce9c4753-bc85-45c5-8f32-bb76e3dd2b0b", "value": "d20b54f33b898e6872da9984d564cf29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c6cb4a-e5f1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710853570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853570, "uuid": "817cd594-d18f-4fbd-b568-71c296a6835c", "comment": "Malware payload (AgentTesla)", "value": "4fd6756acb9f84b34ee590148f098225", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853570, "uuid": "b3233519-f55a-427a-931e-257f863b244a", "comment": "Malware payload (AgentTesla)", "value": "f12cd92d2811fb7f6d16364cd434540c2ee93544426c55e60960b1eb59608627", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853570, "uuid": "13e29aa1-3b11-4bbb-930a-5ce8d4caf63f", "comment": "Malware payload (AgentTesla)", "value": "4e9c3e413db19c1ee4d57d2075744b7c2e93fb06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710853570, "uuid": "e3606f4d-95f2-4a29-9f1d-e9c1f21b3616", "comment": "Malware payload (AgentTesla)", "value": "13e86a0a3bce2f405f819768db8027e654f95f4c5d6afd7e0538aba62c3680b6e6629bd88b633efdd06fd50f5ffc0949", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853570, "uuid": "66f408c0-3855-4abc-94f4-a7721ffd867c", "value": "T1B045235477FC8B3AD0BD27B15A61810027BA3247A092FB5C3F8EA1C55F96B40CA61F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853570, "uuid": "112f0177-3080-42f1-8308-9edf7004cc83", "value": "12288:gvgRhtm2pxsjUR50UOpqLG2CNmSko+FkvGQ6mfcL94GJNSC4f:gYwD20rpqVfhkvGQWuGHSC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710853570, "uuid": "0c385ef3-3e1d-4942-a444-ebd0ba79b9b6", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710853570, "uuid": "42fc3d95-3fa0-4a9e-a426-bb8c11aac3a7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710853570, "uuid": "672d1f5e-9684-428c-a15a-857478e2c6c8", "value": "nnaredbe br. 20241803-70611 od 03.18.2024. - C.E.F. doo.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52413b7-e60d-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710865731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865731, "uuid": "e875bd64-145f-4705-bf80-23c803553af8", "comment": "Malware payload (Mirai)", "value": "26a1c7d03adc9adc5f0bc242e23e1469", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865731, "uuid": "e3f3d0b2-eefe-4196-a440-ad9f648805c0", "comment": "Malware payload (Mirai)", "value": "f137f92ff148d7d9673d718b481319dea1e3f8667472fbef75b2fc6acf18913c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865731, "uuid": "7c9cd7fa-e6d1-438b-9967-21212a353436", "comment": "Malware payload (Mirai)", "value": "bac36998579e071eec8bed1108f8f8727e7b2bff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710865731, "uuid": "59b8ff7d-d035-45c5-b67f-1bc8559c5af1", "comment": "Malware payload (Mirai)", "value": "ca63b3dba1d2f091bde97dcf88d3ebaecbe8cc57ab1fc0a993d0ad197746e0530da7c12d9642e5d136257f1daa3df957", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865731, "uuid": "afda4f3f-63c0-4d86-9c67-43020ab193ee", "value": "T116133920AA792E17C1D4987AA3F7472E71B6120F54B89B1D7E770F8EFB604C4A9171B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865731, "uuid": "1f9f5d1b-7730-40ea-8bb6-285f3fc71da9", "value": "768:MTvoB/5fwgHYwRWnw+Y5ZcraWKWC28+WEwQ1CO+F+Aj2g:MTvu/5fwgHJZcrayCdQ1gUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710865731, "uuid": "7ce51069-0c97-4146-b415-2fdbede1b208", "value": 41804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710865731, "uuid": "cc5a73b2-1480-4bb4-850a-40f20f33a092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710865731, "uuid": "fd19e871-15d9-4133-8e65-c6e38054a86d", "value": "26a1c7d03adc9adc5f0bc242e23e1469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689181e9-e60f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866434, "uuid": "aee5bfca-a699-4cf0-b63c-fd99a118c10e", "comment": "Malware payload (Mirai)", "value": "a958ca1550b83578689efc55886b6307", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866434, "uuid": "5979410f-1aee-4035-8a70-5f4b4faacf26", "comment": "Malware payload (Mirai)", "value": "f1b6dbe37484323cc33a939ce65c9d5b68abbb4fbe0124abffbfd8ee562d560d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866434, "uuid": "d6217b4e-233c-4173-8edb-0f50e7e94e45", "comment": "Malware payload (Mirai)", "value": "e7b637e6da6727e781435a0fae15feb2cfed25e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866434, "uuid": "f4d1eea4-004d-4d0b-aadf-db7f9543aa8a", "comment": "Malware payload (Mirai)", "value": "01a8624e8715e64f1ad7a1e92eb80be77b6ecb0d6810024e66454fe8a8703d716aa266634451f13d7105f452d4a9315f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866434, "uuid": "0f78dd41-6a5c-4dc1-911d-b8c1b440fec0", "value": "T190C36B72E8256F68D695D170B0B08F791B93998181576FBA29B7C3B08083CDEF6057F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866434, "uuid": "e2af7147-a093-4087-934f-b0e623674f53", "value": "1536:TabDDLIJyTA5pTJq/TzQkUCyAM1LCmKDPxba45QyPkjFWxgDnFa5j6s8:TEcJ5Wsk8AM1LADt5QyaFWqDnEjl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866434, "uuid": "3eeca5c5-16bb-40f1-bf33-8324b2b7cc2e", "value": 129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866434, "uuid": "3c0958b1-b68d-4db0-a9ac-bfaa4778f8aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866434, "uuid": "132520f3-c186-475b-9fc5-92a16c0e694a", "value": "a958ca1550b83578689efc55886b6307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a139c33-e622-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710874517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874517, "uuid": "323aabc5-71bc-4f07-badc-2930c4c969f5", "comment": "Malware payload (Mirai)", "value": "195b155cbb9c9ef98819143f9f555b9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874517, "uuid": "d20eec46-cf92-4060-9941-6483ede62823", "comment": "Malware payload (Mirai)", "value": "f358f3194eb6fcf2fd3ec16fd461848bdaba4d8d4c963e8202df19b8ff175076", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874517, "uuid": "6c566c37-e803-4fa2-977d-b0ef52e52657", "comment": "Malware payload (Mirai)", "value": "a016eec2ee1b76d9c899e3d97e0cacd84d122da9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874517, "uuid": "d0af2ce9-4214-4682-8ff3-f6018a103108", "comment": "Malware payload (Mirai)", "value": "cbc6845cff5a8f071ccfeb29350a385757badcea516dd6cfe72bdedd225d8fce008f390ebe25fe60806a4a23d6f7eda5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874517, "uuid": "9a18ed8e-0110-4f5f-9f7d-acb0865b1626", "value": "T1C1534B55FC819712C6D122BBFB5E428D372A43A8D2FF32039E266F11778782B0E6B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874517, "uuid": "2725c8fd-f008-4f39-9dda-0d6adad5a76c", "value": "1536:mZjFoQnZQjgjHXHceHBKLLqFfVbWXH9+uwHdeaJcI:KjzOUDMqULLqpVs9+TtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710874517, "uuid": "40ff16f1-482a-48be-b9b4-c95ef2b52d5a", "value": 64184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710874517, "uuid": "c4f39312-e91e-4daa-ae4a-93d642b57594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874517, "uuid": "1c4b679f-fda1-4e87-b72e-cd3ecae61e2f", "value": "arm5.hh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb5069e-e5b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710826015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826015, "uuid": "5665bd1f-7033-41df-9f90-370af0e0666b", "comment": "Malware payload (Mirai)", "value": "c31d752fd902f8eec0419be232db3aa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826015, "uuid": "f0e0c21a-cc1b-4190-8706-35724bf045e2", "comment": "Malware payload (Mirai)", "value": "f36bb4aeef1c89ff941b1e7ab73c4a5692ff639794330e8a129ceb374fc530bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826015, "uuid": "9e71f4a8-a252-4b58-8a2f-e1b041480a44", "comment": "Malware payload (Mirai)", "value": "a0e2bbc0ad61a45bb5426519397999c4f94f0b53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710826015, "uuid": "c8b9f3f0-14ca-4797-921e-0c2609d6f38f", "comment": "Malware payload (Mirai)", "value": "226c68b2776e0890e3b0fb6b0273de80e100d9cbd49d1f95357520ac6f96dc4c594741094f9f7093f93ce422aad65772", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826015, "uuid": "d1b45b84-c13f-4970-8b26-02bc26571040", "value": "T185B35A77CC696F68C259D1B0B0B09F792F63A58182871FBA54B6C2B54083DCDF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826015, "uuid": "c7ccb443-add2-4405-8cb4-9a1d72aad7de", "value": "1536:1a97/6/q0AmnCfLL9KklcCRfKIKRnLvW4PKafz8pWks7ty8kL/zm:1y6HCfLZn+MCISxPKO8WL7t4Lbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710826015, "uuid": "0b521269-1d62-48fe-bb94-19917969a096", "value": 116544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710826015, "uuid": "edd36bd9-8a44-400a-8e16-57c4a367e607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710826015, "uuid": "bef5e28d-1021-460e-922a-a63da29f8c38", "value": "c31d752fd902f8eec0419be232db3aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e64614-e5d5-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710841591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841591, "uuid": "acdfe88c-fe64-4268-b37c-0d04f3f8104e", "comment": "Malware payload (PureLogStealer)", "value": "baab4bf1a995f1710bce0605d1d97092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841591, "uuid": "fe93a44b-cb93-4869-aa80-db001fd36872", "comment": "Malware payload (PureLogStealer)", "value": "f37e99213bc26db677fc5ddef9a8449834c55475651f83e9af7c143fcfeff9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841591, "uuid": "0e47d609-3986-49e7-9b07-915e7ed8f685", "comment": "Malware payload (PureLogStealer)", "value": "c8053a50d36d91f4119706dc01089e0d48f724b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841591, "uuid": "778864e4-96b5-4ce5-9caa-1383d009080a", "comment": "Malware payload (PureLogStealer)", "value": "7e3291b9fd5099f1dd096b00c7c87132a0dbbc9d2f5f48deda8b5569c9ddec41a3ac0a854059351661999d2027cb415c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841591, "uuid": "75418fb6-9d42-4142-87cd-e5944cffeb4f", "value": "T183A4234453948142D4F8DF7DA44BFA5C22B2E5394A3ACB4E63A23151FD32B06F23DD66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841591, "uuid": "8827e5ae-6db2-44d5-9328-9a0032f4cac2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841591, "uuid": "78f7e8e6-a2ce-4a51-9cb4-a64ace02f317", "value": "12288:+MRQnLSiYdWe9TOStxa6XvUOkYbymBgQ5rXOLTu0/Q:eeiYdJTdtxaGvUOkDmBgQ5XOLC0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710841591, "uuid": "18e6f44a-f8d5-414a-86b8-7e9d3026b3ac", "value": 480080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710841591, "uuid": "87a4d5e5-b24a-47a4-8735-eb1b0750f4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841591, "uuid": "48ead2cd-75f9-4b83-959e-69b4752dbd7a", "value": "baab4bf1a995f1710bce0605d1d97092.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703b807b-e613-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1710868165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868165, "uuid": "cfe04e67-8f9d-4763-a636-d47dcf4799e2", "comment": "Malware payload (Stealc)", "value": "d978d56dcddec5fa6d3ae023abc1ee36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868165, "uuid": "3c17d72a-4906-40d6-9ada-bfde01df4cee", "comment": "Malware payload (Stealc)", "value": "f5339d5fe41950b4888962e6617fd0f7a570e450620b461a123a3d11c9beb74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868165, "uuid": "cf0b71a9-5b93-4de4-8c8e-19b0cc86af3c", "comment": "Malware payload (Stealc)", "value": "2aef04f707c384780e4648d2273c5eaa3b0b720f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710868165, "uuid": "49f6e6df-fc38-4837-8754-dc328a6650c6", "comment": "Malware payload (Stealc)", "value": "45be1f9d36f7f513381b0d742c38a3679a4622beb5c4e1489285773e3d0534325f7754db90ccf5f480c11c1f3d3ce3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868165, "uuid": "f682bb40-3197-441f-8387-266d59bbb5ce", "value": "T13844BF51F6E29875D1625A3C9E65C7F00B3AF9717E34E25B3344E53F2AF02D08A52B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868165, "uuid": "58e4a79f-4947-4fc9-8f5a-6c6cd8eb3d95", "value": "f78bbdf2183136107a24fb7ff4b7990f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868165, "uuid": "8103d085-4994-4adc-b395-be3ed1d4589b", "value": "6144:/pPKEvWHMzGZxxFw0Kn0TOK3jkjZoB+033zHBOK:xPBvSMzyxxChQZ3Ajg33zhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710868165, "uuid": "ca1f7eb9-b30f-4588-945b-2b5a0e1ab22f", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710868165, "uuid": "f11d9110-2f5c-4907-80ba-6eeffa8b9bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710868165, "uuid": "e01177aa-f54a-4a1e-a8ba-0ee7e664d0be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fb19ea-e5d5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710841434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841434, "uuid": "d5fa50dc-f7ac-4d43-a863-e6e16c718bb9", "comment": "Malware payload (AgentTesla)", "value": "d5fda8517a450948764da4b1618f831e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841434, "uuid": "fcd1f6bf-cae5-4af7-a751-4e46cfde80d5", "comment": "Malware payload (AgentTesla)", "value": "f80634354eaa11b9bd3c8cc13f1dbd03b4b3b73de43bc6101ce99b05ffab4660", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841434, "uuid": "7ddc3684-2d7d-4fed-a4aa-acc9bf5f5608", "comment": "Malware payload (AgentTesla)", "value": "fe469fa291b9650d44eb331857ba206fb26f18b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710841434, "uuid": "4e90db6f-d3f5-424b-bbf6-49a23c25d07b", "comment": "Malware payload (AgentTesla)", "value": "f4350c3b3f97a2015bda6be4f9b3d6e83f787875cc9a1181a46c78529093a2a8b96e629929e6774fb5c70821cde21cd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841434, "uuid": "11a4ca0b-b323-4e11-88c8-3d736e7684fa", "value": "T17CE4238A71B8A3D3EFA768F419641517937316AE2EA5C8FC5CC064CEBDC4FC2458291B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841434, "uuid": "a8cb2562-1efb-4915-a53f-99243e65333f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841434, "uuid": "ada9cc48-3c12-448f-b54e-1c6257e03323", "value": "12288:llPloOJRYWqKpyxVTEVY4j5ChbyoZT1fNfhsPetrFPehIPf5OoGhV1FnmxmrS3tN:H9oOJbNedEVd8hy85sOPehgO9hV1p0tN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710841434, "uuid": "1508ceab-dc47-47c3-8f9d-8bdbb8d74399", "value": 664072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710841434, "uuid": "25e3a746-b7fe-4878-b164-fb20a04be4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710841434, "uuid": "87f243a4-da22-43a6-b45c-753f8d0b928e", "value": "lee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f5e871-e5ac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710823890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823890, "uuid": "b04309f4-3650-401d-a094-39b75767c0b9", "comment": "Malware payload (Mirai)", "value": "b8757f524f04ef37917832cf849df6c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823890, "uuid": "c66d5b47-60af-44f2-9e2a-98bef32f65c0", "comment": "Malware payload (Mirai)", "value": "fb1f8d45ddfb5e5ce37cbe560ea5c0acd0c1d20345dd3d1d2425a17a6de76940", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823890, "uuid": "f9e58b41-1c6e-4490-9c1b-93e5d96b91e4", "comment": "Malware payload (Mirai)", "value": "144129e406c8a897397192c090b754a389a86276", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710823890, "uuid": "0448bf22-778f-4d2f-beae-abaa5440e212", "comment": "Malware payload (Mirai)", "value": "c7cf1653e255fa857c8c1fc9e14a49e73f84e5bed06ce6a3ffa79d354d9392697a0a0752835d6399d1bcbacee9f749ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823890, "uuid": "1a21159b-5bb4-47f1-8ae3-b9752a0bf434", "value": "T1DAC31A55FC405B13C6D212B7FB5E428D3B2A17A8D3EE72039D256F60378B96B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823890, "uuid": "fe58bf96-1ffb-4565-b131-184c58f61896", "value": "1536:J9v+s43G5bUWkkRATSh71QAFMxK4VIGUT2yNKtO/G8A46nztplk2wyw1FrR7TVI+:Dv+XQnRQg71QNE43UqyNKtO+46zdtbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710823890, "uuid": "5a33c0be-e105-46fd-950d-e148a9c2b35a", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710823890, "uuid": "85fb9c23-a7f8-4d48-9787-60f32d536a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710823890, "uuid": "bdaf64c2-fcb3-44e0-9317-4635a37852b8", "value": "bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad81ab5a-e5d3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1710840780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840780, "uuid": "2daa4b5d-6168-4668-a688-8541a6c3827d", "comment": "Malware payload", "value": "1101f1db4c0b1b7e0001db306481bfb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840780, "uuid": "cb62fe21-a63c-4967-a021-9b78a6cfd958", "comment": "Malware payload", "value": "fbce90d91153be2fbd4ccf3eeb9f8487551576ddda841378ca9cca6d0207770a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840780, "uuid": "0199efb0-4925-4cec-b4c3-309871107dcb", "comment": "Malware payload", "value": "b52e3c8069e685f5994f775c5e322fdf92f6cb06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710840780, "uuid": "9c6e0c98-64e3-4929-a8cc-4f8dde94a598", "comment": "Malware payload", "value": "edb9cb4e03b06d35361dfcf197335c1fe50ddf93c7f7b99d5636fcc06f5be5c333250024d5082c377dcda7652a33f029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840780, "uuid": "e78f8cdb-d55d-4348-af5a-3571e4104a71", "value": "T16DA533193B738744F76C6376D12E61348C0D96E861BC8F9E6CC7225AD31E20E1EB61E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840780, "uuid": "b8a5935e-98f5-4eee-9762-a434186f99e7", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840780, "uuid": "c5f78272-d1ec-495f-a85a-57e2271ffc42", "value": "49152:CuPUqcDpB73bZUwfZUwXR/umzI4k7jHl5ZYobnQ3FI2lR:CuMdBpxZUwXM4k7jF5vjQ3FI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710840780, "uuid": "9cf71922-66cf-4bed-832b-4bc438ff430d", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710840780, "uuid": "ed5001ae-9c18-4bd5-b0db-7d9d9ef48ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710840780, "uuid": "c5b032f6-b634-4a0c-ae1d-0dec79b736b6", "value": "SecuriteInfo.com.Trojan.GenericKD.71880805.1838.5367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5078f0-e5c6-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1710835007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835007, "uuid": "55a23f9d-e051-428a-9b38-7198715de001", "comment": "Malware payload (Gafgyt)", "value": "37b4735f93be01ac06c8db69708919a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835007, "uuid": "74c1b0ca-8a61-4432-ab25-d3a6ec4be2cb", "comment": "Malware payload (Gafgyt)", "value": "fc0a3dec35e5421f377e56461bd85812e2e64bc0b3fc76d3a3ea462fbd16ee9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835007, "uuid": "ef190b4a-d1be-4b26-880f-2cdee32db6a6", "comment": "Malware payload (Gafgyt)", "value": "5e00f50a01bc259fa005212bde151b49fd34c4b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710835007, "uuid": "6560aea3-bac6-4ac1-a975-f664c42fca2c", "comment": "Malware payload (Gafgyt)", "value": "08be070fdfcc68b78b087f4848256df5e2daa7e47fb1ecf37927a5c6a2b90567db6ac16238b8702cdb383e2771c97cd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835007, "uuid": "1fd8bd65-0353-4cd2-8b3d-b79b865994e5", "value": "T1B1249479B7611EB7D81ECE7301DA4912188CC28653D97FABB2B8C618EB9794F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835007, "uuid": "6b5f96aa-d2cb-4829-aff0-3bd4e200dd8c", "value": "3072:T4mSFGv/kuidcX1qRdcE5hfH3TwpCMtmrpy6n9Nn:pn/ZmbRCE5hfXJMtmrpy6n9Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710835007, "uuid": "143b7f3f-44c5-4b04-982e-9aad58f60ea7", "value": 214648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710835007, "uuid": "7b5b249d-2e82-4269-acf0-24def62bd5a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710835007, "uuid": "8a1d9ab4-d969-4f05-a420-5fea7bd4953f", "value": "37b4735f93be01ac06c8db69708919a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771aeb17-e60e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710866029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866029, "uuid": "b8809a4c-892a-4457-8e13-d55770f5afde", "comment": "Malware payload (Mirai)", "value": "07b7005c575a05fa2eb1a84547881387", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866029, "uuid": "f68ae08c-d15e-4efc-a4c9-63f4350dbd96", "comment": "Malware payload (Mirai)", "value": "fd41ec063cbd50f453ae932a73b145d8eaea05891892655ff5a6182b23adf96b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866029, "uuid": "e0ef8752-b635-45fb-a2e4-f6c7f6903b7e", "comment": "Malware payload (Mirai)", "value": "0321cab741ecf229fd0b4c128d701a256c23b592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710866029, "uuid": "1e64ad38-08ad-4a65-b1d5-b12df44d79b7", "comment": "Malware payload (Mirai)", "value": "39e15ca9728bb282c7fe09485cfdc2da71c932a5fc0d9ff98e1d39033e71ce8f6faf08bd02e9419387818b99d9d8af8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866029, "uuid": "98ffde65-8462-4a80-adfe-fefa950cadff", "value": "T12CE33B06B31C0A47D1A32EF43A3F6BD093EF9AC121E4F640255FAA8A91B1D375546ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866029, "uuid": "7739ae1d-a3fb-4304-b828-bfbfff15462b", "value": "1536:LHd2Xu4Jf1CPbnGxWiJel42yxp6vTRvUMGwZoX4zyrehvA0W7kmKy3kqrVp43K6D:L4XtNwY72yx87JGXJrx073Klpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710866029, "uuid": "7b73b3fd-1c89-4082-a7a6-ef226865c743", "value": 146396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710866029, "uuid": "09f30869-0d78-4629-bf43-b81ab788b314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710866029, "uuid": "7164c52c-e961-4f7b-a3eb-5fd88a56d61f", "value": "07b7005c575a05fa2eb1a84547881387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b20175d-e622-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1710874519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874519, "uuid": "1699ec0b-1f02-4664-8c4e-2b736790f812", "comment": "Malware payload (Mirai)", "value": "3d587bed210cab32b89df82382155e04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874519, "uuid": "be742fa3-8b5d-4640-a226-2e8bd7948a83", "comment": "Malware payload (Mirai)", "value": "fd9d4c5217dcbac4f67654072dc8c407158c36cfea146bc3c6ef89717597eabe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874519, "uuid": "fcddd859-361c-4899-a012-29a35956b048", "comment": "Malware payload (Mirai)", "value": "5c8081503fa9d2479e59fa4b8c42b59e5156ffdc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710874519, "uuid": "b0841ec8-65a2-4472-9548-3bc5a17cb9cf", "comment": "Malware payload (Mirai)", "value": "beb2f3d0d45b2102298dab451b18b2b8e454ebfaa42b0c6f21f2746ce6fcbc90ee9123a56c37a83955fa5e41eafe055e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874519, "uuid": "d259ba07-69bb-4172-af5c-cea7f491307d", "value": "T13E632A51F8819612C6C112BBFB6E428D372B53A8D3EF32039E25AF2177C785B0E6B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874519, "uuid": "138bf254-c813-4887-a1f0-e1126a1ec624", "value": "1536:BrBHwycqZfYrdJ/ooBSWrrFRODlnHGCwZ55HvQcI:BrB0AwJhvUWrrfORGCiQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710874519, "uuid": "d4130bc1-2c13-4440-ad21-af583b985df5", "value": 67712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710874519, "uuid": "cd108246-1df0-45c7-a316-4983755ba445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710874519, "uuid": "7c66f29c-5cc9-4e5a-817b-d81da7ee18d2", "value": "arm.hh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fc8111-e5cb-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1710837092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837092, "uuid": "75b9cb77-e7f2-4909-bb35-dbe5c52fb70a", "comment": "Malware payload (AgentTesla)", "value": "5a6992bec908b7e1e33c8a3fa4737cd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837092, "uuid": "07e35da2-4737-4502-bb97-a2027ef8402d", "comment": "Malware payload (AgentTesla)", "value": "ffd8881c0f42c9d269430cd6ea2b9523be726a688a13a346389b1f4eebab68e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837092, "uuid": "223e67a1-6119-459a-a02a-598d2f6d523e", "comment": "Malware payload (AgentTesla)", "value": "e3c2f0effdf2074ff385f9de8a2001070c07c5f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710837092, "uuid": "b950cd35-27d4-4952-941e-30e8d6bd7cda", "comment": "Malware payload (AgentTesla)", "value": "ba2b79e9c1ce59e158651ab6cea42d3cbf1ebc1dca7e9fb84cff5ade3f48edf49e2e4978eacc034afdd5f33496473037", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837092, "uuid": "2258b0e2-cce8-40ec-8c94-22badf80eaa2", "value": "T12415E33C48BE2237D6B5C2B5CBEC8827F01CA86F3150AD6594DBD3A653D694274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837092, "uuid": "0e4a7bd9-aece-4416-b70b-8a811216fb22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837092, "uuid": "cb28e9ca-8eb2-40b0-98eb-3fb65ff77093", "value": "12288:vywEx2iNSpEInzAcwMRjpRUgvIlgN1THBc1NSQ2ziDHfsZ8wl4ciG:6wk1wSIzAcwMxUgv6gLhc1NSLYH5wGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710837092, "uuid": "04ef8242-3fad-4b40-aefe-b63be1c96f81", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710837092, "uuid": "439b0b4f-0307-489c-a407-d2ae069bbc62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710837092, "uuid": "96e0fa28-493c-4be7-a3e7-8a35c4ca59af", "value": "Teklif Talebi Hk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }