{ "Event": { "published": true, "date": "2024-04-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-05", "timestamp": 1712361781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e875d0fb-ea90-40f0-a09b-239441efc10a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19022c2e-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344199, "uuid": "78d8817a-7d6c-45c5-aaa9-32243baf587a", "comment": "Malware payload", "value": "8fc025286e16668496f0968b7ac7e51e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344199, "uuid": "00a4997b-63e9-4212-a044-8c6ee4c98cc8", "comment": "Malware payload", "value": "0053d382d8827098225d5d4b1411e0f07b3735e66479ae277632e76dc85a88e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344199, "uuid": "0cfb1d56-9f7d-4dfd-abe9-a4e647130796", "comment": "Malware payload", "value": "2c739824548d18c03f1bcebf1336905135a3ca30", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344199, "uuid": "a970d7a8-2646-45d9-9871-2f67fd8bea12", "comment": "Malware payload", "value": "c6fad2d2191d0bf630d8d54516aa50a42f11b99e479e74e1281426e117d6001f7520ecc1ebd5928e2b4180aca5ea6ca2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344199, "uuid": "f07af0ef-44d4-449e-acae-927cb95869ad", "value": "T1DA836C96F6E1C872D0341EFC9C259268D43B7A317D2A2AB2BAF51E4DDC6D3D12D0C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344199, "uuid": "973842ba-f07c-47c3-9ead-afe8692ed465", "value": "768:3DyxqjQl/EMQt4Oei7RwsHxyP7nbN0yxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJPi:32xqjQ+P04wsm1zxqjQ+P04wsmJCcBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344199, "uuid": "55cf7153-2632-46ab-9d5c-48103a2604d1", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344199, "uuid": "4e01f44f-cb03-49c3-8d47-f6d952c92a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344199, "uuid": "5cb52f29-a15c-4a7c-bbfc-d5d27cedb7a3", "value": "0053d382d8827098225d5d4b1411e0f07b3735e66479ae277632e76dc85a88e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ac246a-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343892, "uuid": "6a924463-ade7-4b25-a186-49b1dc5c3d0e", "comment": "Malware payload (Socks5Systemz)", "value": "5db68790fb7a67c47b6734459fed6c7f", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343892, "uuid": "8730569d-ffb7-4051-83c0-c26cd4832cd2", "comment": "Malware payload (Socks5Systemz)", "value": "007aa5c752c0ac6e6cb2f84e473a3071141ff947d6dd6a099fd83a48fc2c2641", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343892, "uuid": "379e10b1-4713-4a51-8f5d-5b8299bee3d2", "comment": "Malware payload (Socks5Systemz)", "value": "39eed52ae6d987037e7399f722f5b943f50d9659", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343892, "uuid": "8c98420e-9690-46a1-86b3-57c427e640dc", "comment": "Malware payload (Socks5Systemz)", "value": "8b99879bbdfca60f302a40292566f8b08d493d4f13b533fa709932613fa4e6b5c578c85f533876ebc738e0f531c59aad", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343892, "uuid": "049bde0b-86ba-4a78-9756-8a3d55e0c52d", "value": "T10EE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343892, "uuid": "69c4ff28-2d9a-4b2c-8e9b-8b7f63aee982", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343892, "uuid": "c9373e36-bf5d-4c9c-a3bd-bada5a632482", "value": "12288:HjsgiZdvAeRwM+a0HL50cCt4BqeccvpWw/+mzRKLiTOkARpfHpIkkiIjcBDQg5E2:DsgwdvARnr50cCt4Bqe9vpf/+mzR+iTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343892, "uuid": "35fdb861-7e4e-4804-9465-ebd510e9fc3b", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343892, "uuid": "248b6a63-3578-4fe3-9203-f73be33f9def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343892, "uuid": "f9cf6994-051c-44ee-89a8-7fe96f83b122", "value": "007aa5c752c0ac6e6cb2f84e473a3071141ff947d6dd6a099fd83a48fc2c2641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6283565d-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343893, "uuid": "93401389-3325-4ac2-aa6c-48b72f6e9d93", "comment": "Malware payload (Socks5Systemz)", "value": "81b11a6fa9c8019f0d1e37363c8c0d32", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343893, "uuid": "691d6580-7008-4ef8-b701-5064bb3e9c18", "comment": "Malware payload (Socks5Systemz)", "value": "018866232b24bdbc08ee14ea95d322675e11debab0ca353d4079cb23a101e5ed", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343893, "uuid": "63516bf7-af8b-4cd5-82aa-403afbdb235a", "comment": "Malware payload (Socks5Systemz)", "value": "2369c31d78876b1ccc749fa384eed1f486fa0c6b", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343893, "uuid": "97b3fc5f-01fe-47d8-b97a-6f2e7cad3dd1", "comment": "Malware payload (Socks5Systemz)", "value": "bb3f409283a62e6771c29ebb159b7351c5915d46b56d6f1ce942b78591a5b3b52b322fa77d74a29ab43cc8f0496128f2", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343893, "uuid": "197d1383-d3e3-4114-8e59-0294fce9cca8", "value": "T12AE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343893, "uuid": "87b78ffa-2b8d-48b0-b32d-123f754e1e6e", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343893, "uuid": "64238b24-874c-4e2b-8f06-fd7b8d5ee503", "value": "12288:sjsgiZdvAeRwT+a/Hp50cCl/BqIfcvpWwZ9m9RKLiTOkIRpuHSGkXiIjcBDQg5Ey:6sgwdvAqYJ50cCl/BqI0vpfZ9m9R+iTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343893, "uuid": "09696413-5a56-43bc-acb2-5258f3a1208e", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343893, "uuid": "4e515b6a-2ae3-463e-8f86-c518721abe59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343893, "uuid": "54819f64-1991-48cc-a550-11e6fb1b245b", "value": "018866232b24bdbc08ee14ea95d322675e11debab0ca353d4079cb23a101e5ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636bd142-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343894, "uuid": "7c071be3-f6da-4151-bdc6-9aa18325282c", "comment": "Malware payload (Socks5Systemz)", "value": "537c4b9d082754e5eb92b2cd73fcaca5", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343894, "uuid": "5f57b46c-2873-4c50-91f1-296eb6cf2e66", "comment": "Malware payload (Socks5Systemz)", "value": "018a14ee4f2a19433a3a35fda534085a55ff51f3288de80605f8fc8b965de49b", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343894, "uuid": "488a1ef4-4a84-496a-8e81-796c7ffdf6ad", "comment": "Malware payload (Socks5Systemz)", "value": "8253f47696d3a5aa72b9aadf9a6e2c8d0ab89a76", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343894, "uuid": "f8db8e51-0536-40d1-9225-2776e38a4528", "comment": "Malware payload (Socks5Systemz)", "value": "520e75b7ae2a43808399aa7f45a6acf2ad4f5dea1229d0f9c02b26c40ef19e845b385f52f774bdbe809b32f53cb5aa26", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343894, "uuid": "cd68f71b-c48f-49ca-ab2a-7613165a8127", "value": "T19EE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D9789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343894, "uuid": "3491494e-a441-414c-add5-d080e427e39e", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343894, "uuid": "5ba295cd-78c0-45c5-8938-fecb62d110e5", "value": "12288:HjsgiZdvAeRwo+a4Hp50cCZjBqUTcvpWw9hmxRKLiTOkkRp2Ha+kHiIjcBDQg5EK:DsgwdvAN3J50cCZjBqUovpf9hmxR+iTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343894, "uuid": "020a8d52-0579-4e4b-b44d-2260c40c32c6", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343894, "uuid": "8ccbe66a-6b2c-48e3-acfa-19839d2d15a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343894, "uuid": "5744d4b6-d926-4476-af91-65651b215faf", "value": "018a14ee4f2a19433a3a35fda534085a55ff51f3288de80605f8fc8b965de49b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65e639c-f312-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1712297272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297272, "uuid": "b87879f1-8ac3-4205-8d65-21698cc6cafe", "comment": "Malware payload (zgRAT)", "value": "f5ae4fdb7579db408cc119c7df5ba699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297272, "uuid": "d35c57ff-3f14-4b36-8f3f-0642dca9fff7", "comment": "Malware payload (zgRAT)", "value": "026855ec0e8786cfb946a1c5f858190afc566b6f14d310fe37780c0ebe1e8608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297272, "uuid": "123afa3f-81e8-4b48-ac41-445ae9ae5f25", "comment": "Malware payload (zgRAT)", "value": "7119c29754409ab879eae0548c3c24395c27e16e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297272, "uuid": "6312ca2e-6d9f-4a47-b65a-26993495ef37", "comment": "Malware payload (zgRAT)", "value": "3ae5c0edec2c66023027935d61454cadcbc1fddbd42d9a1e91618bb1b23b649e8990c8a810b0fdda502a20d9a3b09994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297272, "uuid": "47b08a8b-95a2-4eac-a550-39e38f9bcffe", "value": "T177B53322DCB2E86EF9D6713BF48DA16936DECB882F49DD8772A1C23543C56CE42B4510", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297272, "uuid": "15aeec6c-c3ad-4070-b933-21523aaed022", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297272, "uuid": "d8d66d9f-216e-4095-bed4-e89843ba7a3f", "value": "49152:MajGm3M0mm2dUE5qMsS5SeBtvGz68gNR0T3vRs+1FXclTbVzi:Maj1vmm0fsSQm8OA3vRLbclTbVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712297272, "uuid": "dc2d1d39-2463-45f8-bffd-5d38437d06a3", "value": 2483248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712297272, "uuid": "b8bad72e-1759-49d6-91ec-096da2237318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297272, "uuid": "dc479934-2cb7-421e-adef-0ccc9d8c18da", "value": "CMLite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b47ddd-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283906, "uuid": "c881e909-b59e-4712-92eb-df54ab1e50d2", "comment": "Malware payload (Mirai)", "value": "82ee7785540b03a7f19a97d156c51c5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283906, "uuid": "bc13f1c3-6b4b-4c1f-a9e3-918316d96cbb", "comment": "Malware payload (Mirai)", "value": "03389a3b12ffc09d3cab46ddf6ec99491c486f591d1673fc10af51d339c4c4a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283906, "uuid": "222e25a9-d87a-402f-93dc-02d73df88ebc", "comment": "Malware payload (Mirai)", "value": "f3abe73b2126eaac37b303351ded9a6c3700c8d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283906, "uuid": "7e96a2ac-cf2b-4639-845b-15c4ac6741f6", "comment": "Malware payload (Mirai)", "value": "e2715a72d7876663b8411bfa454fb4a4b087c9e0e76008a2a384cfe6eee4bad3e96ad07aeae8c28a1cdf2d9ff601e05d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283906, "uuid": "fedfd944-b6d9-411b-827b-2a1086bd8540", "value": "T155832A41BD825A12CAC513BBFA2E01CD372613E8D2EF7217CD116F11B78696F0EA7562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283906, "uuid": "4a3f3710-8e98-4fcd-85a8-c3daab697ae0", "value": "1536:Tzpzj9mEs5yCwpMYPwbc4pjxQ/oT/0aIC1NYa7vFXVJvKwbZnN:T9zj9mlLLbjlxf/0aIC1NY8fKwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283906, "uuid": "374e8764-a90e-4ffc-a953-6a1595b2c396", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283906, "uuid": "dd567862-d726-49fb-a478-1a14ee4eb97a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283906, "uuid": "b44a1aac-142f-4cf0-a79b-05b92b8b6610", "value": "82ee7785540b03a7f19a97d156c51c5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3afd5c8-f30f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712295979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295979, "uuid": "d75424f1-2f86-4ec7-a9b0-0eb202e81504", "comment": "Malware payload", "value": "3cad350f5408872d89b3a8a1d3513747", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295979, "uuid": "7b2af796-735f-4ba4-9aa1-f0123f4a0a78", "comment": "Malware payload", "value": "03a97c1a84db46a3acb3f27337a4465f5b351c631c5811ad591ad4d2c6399ddf", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295979, "uuid": "fd5e08f5-768b-463d-8554-8737e03a80d4", "comment": "Malware payload", "value": "aa199d1d6860425fdf5a5fd53fe7f06019513f51", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295979, "uuid": "4cfca100-a5a6-4167-9b94-970de270e188", "comment": "Malware payload", "value": "31627caf5bc9a4c555c763baf2c7bc2a9cae216d7afa66fe419de7a154a834c803471e59d65d99dca8be0ea3ca6f1300", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295979, "uuid": "6bdea0ee-7888-466c-8016-524f04ec4e43", "value": "T1BDC47E75C6738E2A09960E6B441237C5A83CB7B6C2FC91FF749EAA93F762C51C25C601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295979, "uuid": "6f83533b-0825-4405-9263-9e50af8eb2e8", "value": "12288:BRqksbOVX+Ln++5s4R3gKptqHkjftmG9nuBiYk2trWwnll+p5:vdl4qRG6Kul+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295979, "uuid": "34c2e296-d74a-497f-b9db-c54f59fad888", "value": 596854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295979, "uuid": "0ed6699e-bff1-4370-b9f5-0238e9eed99d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295979, "uuid": "d10fd205-a859-4899-baa8-906b22812e02", "value": "Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20a6f5e-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335061, "uuid": "42b13809-7293-4fa9-8ca5-f52108dc3b2f", "comment": "Malware payload (Gafgyt)", "value": "5d1d430732e8ee57027167bc5263f8bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335061, "uuid": "bcb1cc0f-da18-4fc1-8d43-590990ba0fc1", "comment": "Malware payload (Gafgyt)", "value": "04058c2a68c1fa395a71b387b88d9d4f8760f66ef8b388ee8845b43bc5d03029", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335061, "uuid": "86978243-cacc-4a5f-aaf1-5bbac951c582", "comment": "Malware payload (Gafgyt)", "value": "ce8ef3b736329c4716a72ca6d6ad1020e67f4f92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335061, "uuid": "8ddd3e89-6b81-4ba9-8206-c912112c95c3", "comment": "Malware payload (Gafgyt)", "value": "89124d6f1606c00a2f35ccb42be03bbc3dda75750a73bccd3d1bf92f8097c21cf7c8f047347539b3336d7d5c7a13066c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335061, "uuid": "3a487101-5b0b-4010-b71e-ae2c768dd5a3", "value": "T16BB31B41F9408B27C2D327BAE78F439D7B366A5497D733116A347EB42BC27982E39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335061, "uuid": "325862bd-ef26-454e-9931-aeed41053532", "value": "3072:06OxNk7vzNh+aIEYTnof6flDtaPSb6Etyrox:Ik7vr+IYTTlDtaPSb6Etyrox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335061, "uuid": "a8081c70-c94d-49bb-a531-9f2c54cce360", "value": 111450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335061, "uuid": "b38cc766-0126-4d1e-9acb-d74244196ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335061, "uuid": "e1df85a0-8702-47c9-8588-b5761dce2a2a", "value": "5d1d430732e8ee57027167bc5263f8bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17da1881-f344-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712318427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318427, "uuid": "1f4f733b-a6c9-4c32-acb1-ab95fc9112eb", "comment": "Malware payload (Rhadamanthys)", "value": "08e5f1243ad4970745975b27b6e2f9fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318427, "uuid": "92f2216a-3779-44d3-93cb-54b3331b2f2b", "comment": "Malware payload (Rhadamanthys)", "value": "05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318427, "uuid": "b3b63f31-ca20-45fa-ae8d-3dcd5ccd629d", "comment": "Malware payload (Rhadamanthys)", "value": "83b1a8939bd4e2ea5677d8742edd1a697edd196b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318427, "uuid": "59dfc60d-be6a-40d2-b93a-fff6b565f91c", "comment": "Malware payload (Rhadamanthys)", "value": "7eb6665eec2eaa98b3cf126c0bd9ee2dd89385cfaeb445300668ea576e99fbe23f345cd952db1bc22eb2b231f729d55f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318427, "uuid": "bbaf3e7f-a308-4996-8b42-816d5faa8646", "value": "T1DDA46B62BBF59D88CD5D33F3C8506BE5065A433642F3E3885D286A52673F6698B0B13C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318427, "uuid": "aa44e7b8-5307-4732-8ee0-ca28b96f20e9", "value": "1691b1f290a2ca836b091bdcee4ba1dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318427, "uuid": "43a3c813-84a3-4bb0-8425-e16175b56307", "value": "12288:/rrb2iDiSOv4VBHMQhPDmqTCYw4oUGbjnm:/7DB/DDm1YANPnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318427, "uuid": "1a27676a-3585-471a-8b4a-9661e777a699", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318427, "uuid": "0ebcb797-7068-4b0d-8e64-62d14edcc7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318427, "uuid": "e69f8907-056b-4dfa-a9bf-72955e982b40", "value": "08e5f1243ad4970745975b27b6e2f9fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c31c26-f30f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712295897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295897, "uuid": "522fc1f6-816d-428e-90df-e0952fe790e4", "comment": "Malware payload (AgentTesla)", "value": "0851e3254acbcd481d2423e3726d23fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295897, "uuid": "72e89b25-bd88-4f36-ab1d-7fe1322a6927", "comment": "Malware payload (AgentTesla)", "value": "07058d711e3810e1d777dcd7805112e97b40c9506c657113c33b162e80b1543b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295897, "uuid": "2fef5002-7e2d-4ce9-b38a-b3297cad209d", "comment": "Malware payload (AgentTesla)", "value": "3ddc1e7d651d0206e8b4847c6f5f9e0fde23c34a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295897, "uuid": "bfc1efd9-e916-43b4-9520-0d55a7efe1fa", "comment": "Malware payload (AgentTesla)", "value": "6388292cd9b56424b4a73c4a14dfeb107eddbecbc5f499b343b13a8c885db9ab93f344189101a7d4f208069ce8bc8050", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295897, "uuid": "e4e232d1-badb-4eaa-a674-523b0957e4c8", "value": "T14774124CB7AE9136C95D47FDA0D61A3C57B04573AC13F32B5D8224EA349AF089607C9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295897, "uuid": "e4363e06-947a-4a9c-aa65-5654a6f79c34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295897, "uuid": "dee92398-16c4-4a85-a3e7-699fcad8d8ac", "value": "6144:Y8d2KtkS9qtArch6xY5K3kyZ8Hjfo/+A9oOf/:Y8AKtkSAtArh+I30oWA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295897, "uuid": "b6199592-1955-4fbb-b144-1d19d6945bfd", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295897, "uuid": "884b09ee-5fbc-485d-b60d-6e102ea4166a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295897, "uuid": "4937dbf7-dc44-4e21-9600-d4a29bdb7101", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995419ce-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343985, "uuid": "aedb7589-acfa-4ca3-97ba-4b74e7af91d0", "comment": "Malware payload (Socks5Systemz)", "value": "fe849c48cd68bf33b6f73a585d61f19c", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343985, "uuid": "7df9aab4-74c6-4225-8306-2103d0d701b8", "comment": "Malware payload (Socks5Systemz)", "value": "0d1069b42999bda264dba52a5ecf385ee53cac1f29efdaeb471ee7a51404ee70", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343985, "uuid": "c897d764-9e1c-4bc3-947f-56a87fb92282", "comment": "Malware payload (Socks5Systemz)", "value": "d083ec838f6890c2abf127b9a3625bd71aee349a", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343985, "uuid": "574ae468-9e5d-45ec-8e02-cdb4570b0ba2", "comment": "Malware payload (Socks5Systemz)", "value": "42cac0f9a24cbc991d4c2fe1df3877cd365dfc600da4dbf08e988fc56e1878c4836ffa2b089ef603d1276a6eb25daff6", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343985, "uuid": "a981143a-762c-4585-8bb0-030999d80738", "value": "T191E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343985, "uuid": "27e31398-5880-4963-9f0e-f3b69e7d048e", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343985, "uuid": "4c5aedfd-99cc-43b4-a1c4-864f5a32a559", "value": "12288:HjsgiZdvAeRwZ+aGHL50cCtoBq+McvpWwfumzRKLiTOkARpPH5Ik0iIjcBDQg5EW:DsgwdvAwdr50cCtoBq+tvpffumzR+iTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343985, "uuid": "7e26f772-3eca-4b8b-ad9a-4229ef0db635", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343985, "uuid": "1ce3e8d4-6068-407c-9654-f802961eb09a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343985, "uuid": "8ee2bb01-7006-41d4-9cfa-f5d73439c69a", "value": "0d1069b42999bda264dba52a5ecf385ee53cac1f29efdaeb471ee7a51404ee70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af86aefa-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712309662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309662, "uuid": "ffa845e8-7034-40fd-9e9a-0ccd79f00af2", "comment": "Malware payload", "value": "3cd68d32333395ed9c9a77c35f06a200", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309662, "uuid": "17c3cda6-b113-44e2-9bd7-c1d52863e81b", "comment": "Malware payload", "value": "0d65a097ebd42f4bcda1ae5f072b48f60b4b58a5b76dcc90f0f1243a2ca95e44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309662, "uuid": "71e0487b-d811-4841-8f70-d3bd9b1e58c2", "comment": "Malware payload", "value": "387d88567d2edc3fd629c1c68b7485d68b8be88b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309662, "uuid": "a4c1b3e0-bf41-471f-b603-56f47266306b", "comment": "Malware payload", "value": "e64417d1539f9ad57c1045a9991a2c0cfd856300619c88d011ad3a2d44581053e73ab0e9876a7116e39a3a35a76300ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309662, "uuid": "1c236ae4-c7b5-45f2-b0d1-bca90f10b2c1", "value": "T14523F1BBDAEBCF20C5B54874290EB80F885CC9DCB84D857BBA95781B8D4272438786D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309662, "uuid": "0aa95f83-6495-42d2-b7a4-a4b0cf2a5cbf", "value": "768:0VrlY5U0JgRHEWKogtTIvU6XLreS5QV3P+M3NPRPMpVfmlfpnbcuyD7UkWykkAQ:0VpMHJqHElTar7ra3zNPNCVGfpnouy8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309662, "uuid": "1c7916d0-eabf-4ce6-bc6f-7bb9cdaf78e6", "value": 46512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309662, "uuid": "690eb9bd-8dcd-4a8c-8761-2bbc09680360", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309662, "uuid": "2dd23a64-9002-48c8-b15f-60963ecb77ce", "value": "3cd68d32333395ed9c9a77c35f06a200", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89e9506-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "3dcdea82-a6fd-4e21-af44-189f1353b219", "comment": "Malware payload (RemcosRAT)", "value": "d64eaf4fdb118d765221f465c095ac33", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "501c9683-dc98-49d0-85c5-ecf32e05a36f", "comment": "Malware payload (RemcosRAT)", "value": "0f1d1af792a1caad8e0dc9a9057d7a3b06ed85f34672cdfec64aab4785c97383", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "4ec61998-f49c-4aa1-99bd-ffd400434ad5", "comment": "Malware payload (RemcosRAT)", "value": "f0409173db5ca3ecbda5432ed85b9454d151d25b", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "e68237d5-6a99-4b67-badb-5f53ade133f0", "comment": "Malware payload (RemcosRAT)", "value": "7d4038d923869b7be2d762427d6a99fe0709f82eb23bbbd8f114fceb8a3374b3a32d184746e028e0884fb28dce528ecf", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "9375cbc8-08e5-4cc2-9a76-ff471ee91c76", "value": "T12FB49E01BAD1C072D57514300D36F776EAB8BD2028364A7B73D61D5BFE31190B62AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "59d45f02-0560-4605-ba9c-f97feb6a99e4", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "aab09c1d-bb9c-4764-8ce0-796cf92dc9ab", "value": "6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNJ5Gv:cX7tPMK8ctGe4Dzl4h2QnuPs/Zs8cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "6643e434-551b-45ca-b55e-233ff8c1de8d", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "37e43300-c491-4f0e-ad21-74efbc3ce405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "106644d1-dc2b-4f8d-860e-59e9cb9b5546", "value": "1712325245dd14de5ce8bd608ab9ed54b1036ba8bc99d838c1ed6d3361c8ac2ed8ec3c75ba394.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e95565-f2e5-11ee-a120-42010a9c002e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1712277614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712277614, "uuid": "9086edd4-7d1d-40dc-938b-bc98ac585090", "comment": "Malware payload (RecordBreaker)", "value": "2ab36b7875f2b5a876377164b3b609f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712277614, "uuid": "e4eb1852-7712-4919-bcc8-b51179e3f354", "comment": "Malware payload (RecordBreaker)", "value": "0f8e95a2c0575292fe6b8151428013f85b645f315e2d67a927a4b0c6d26af3c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712277614, "uuid": "9d9384c4-a3c0-4183-9593-9f9fbf5012a7", "comment": "Malware payload (RecordBreaker)", "value": "0d022cf7d49015fc97c576d89a710e5aeabaeaff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712277614, "uuid": "f92c8a7d-81a7-4b78-8a30-e2273f17dc99", "comment": "Malware payload (RecordBreaker)", "value": "42ece95df22e8d0e09a0692e54e8d04d95d4ba60d0bb750e9152a26e11c4fc9ed8ba4b9ec97221c8515ae7cee4297035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712277614, "uuid": "105848b9-4da9-48d3-892b-a00364309a7c", "value": "T1CEE5BE13F783C073DD8605705129D67F9936AE200B2288C7AFD16D2E98B35D15A3AF6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712277614, "uuid": "5e1ee3ed-271d-43cb-a8fb-6ab2fd3ef319", "value": "01e6d38c489b0f7592280e79fa04d034", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712277614, "uuid": "87106ed8-595a-4398-9f0f-4750f68fb029", "value": "49152:ueG4DbBlHFAYl0R2fvjnZ1tmr5BOFGdoYNStv4Qr/0O0NAfT6ZI5I7+SPqKSM1x4:ueGUGAfT1e+hKhDPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712277614, "uuid": "2e6cb6b9-2f32-499f-9e68-8c88870f9e7f", "value": 3042816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712277614, "uuid": "169b0c00-f9f3-437f-9c65-c899e5983055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712277614, "uuid": "ba7200df-a5f3-4a5d-a8c8-0d6df56f5203", "value": "2AB36B7875F2B5A876377164B3B609F2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb5ebb9-f36e-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712336662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712336662, "uuid": "57dd470c-553d-439f-a6c7-df47a3ea4952", "comment": "Malware payload (njrat)", "value": "fe66b9f1d593f58fe20422677a1f1ca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712336662, "uuid": "a028c2cc-7893-4e3b-80b1-c07d229c119b", "comment": "Malware payload (njrat)", "value": "10594a1471f951bfdee5d264250a67a34af443bd25af12d15c0295a92ee0b44a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712336662, "uuid": "38b0be5b-6d98-4230-adb5-d032eb53f423", "comment": "Malware payload (njrat)", "value": "ce12b6a0da2d66609f3faa3bc63960a43a5cc021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712336662, "uuid": "151a687e-7534-44e6-ab8e-dc1baafb0218", "comment": "Malware payload (njrat)", "value": "2ed47a7e1e386d949a4f5870ddaba0bae8e88f776e21e4af3133411c2a2341a4260247f1e217c69b576a98a0649f4bd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712336662, "uuid": "e2554872-aac4-42d9-9d3f-16da686a1902", "value": "T1EFE207467BA68229C6BC1AFC9CB313110772E3478532EB6F5CDC88CA4B676D44641EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712336662, "uuid": "84d23405-2127-454c-a59f-cdfd83955321", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712336662, "uuid": "a310ef34-af6b-4e9a-b62d-90cca3ea2342", "value": "384:t0bUe5XB4e0XGOPCANuiEO0YaxWTOtTUFQqzFlObby:+T9BuVKguiEYyXby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712336662, "uuid": "8131f940-b283-40b5-b729-50b08ee6b018", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712336662, "uuid": "ae37033a-90fc-4c9e-a836-6e6366a6aa01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712336662, "uuid": "e10ba272-38ce-4d87-b619-2be931247fc0", "value": "xKzUfkHcU2YN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0720965-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283921, "uuid": "abbd9306-93cd-44eb-b75c-1a28472606d1", "comment": "Malware payload (Mirai)", "value": "5ad770cc51a051dde8906b384748f335", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283921, "uuid": "ccb835fe-355d-4aa5-9c16-fd95dd6ed63f", "comment": "Malware payload (Mirai)", "value": "129788e506e94d72b06bb753902b39f90c4e152f34f726120e6e4c6f8aa3bcd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283921, "uuid": "28e046a9-08c3-4328-8834-42715c9c91d4", "comment": "Malware payload (Mirai)", "value": "f6c11898fbce786c2fcaa684009e08b326fd3247", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283921, "uuid": "88e1fa5b-2a8f-427d-9ce5-dd4616d7467b", "comment": "Malware payload (Mirai)", "value": "f6e998b210836c947a727e8405e847365718d315a971b462656101d76bb7678cbcf07760410772d236fcee6a069f0152", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283921, "uuid": "4f53cb51-5438-4a91-ab9f-6d25eed06083", "value": "T185F33B46AA418F13C4D6177ABAEF424933239B54D3EB73068918BFB43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283921, "uuid": "06db9592-ecf8-4042-9b34-7f7c10a7fbc3", "value": "3072:UiIorHdKkLv9ytn1na269kP7YXb6JLW+NnbwbZn5N7ozNM/9Kq/3:UBEscslta269kP7Yr6JXbwR5N7ohM/9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283921, "uuid": "439b5c2f-253b-4ca2-8afb-ef67aedf0a60", "value": 168899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283921, "uuid": "da68f3ed-0e47-464c-8d7d-d132d2af2c26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283921, "uuid": "06c500ff-91b6-4cbd-88d7-92ff08bc0505", "value": "5ad770cc51a051dde8906b384748f335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1237c71-f369-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712334576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334576, "uuid": "920b7013-809b-4b70-8b30-8fe6cb5d1a41", "comment": "Malware payload (Adware.Generic)", "value": "9420b27869a2b7544a02a10d93afc1ba", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334576, "uuid": "6aa3639d-8d13-41fc-9d52-0f4d73ee5cf2", "comment": "Malware payload (Adware.Generic)", "value": "12d88abf48b5b5b00e2d4fa35cb549d9befad0662d9705fb9c50c62f789e9770", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334576, "uuid": "f6500118-1101-4966-80f4-831b773f7742", "comment": "Malware payload (Adware.Generic)", "value": "bdcfd468fd7f11816844d366b7cc1abea7270fa3", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334576, "uuid": "0ea4ab49-17d8-45f8-8f29-758c876ffbeb", "comment": "Malware payload (Adware.Generic)", "value": "bb33302605de0a85b13b16b3caed1c065b77c8ce2f7bfb9c4fc1641fb5bb1dac2310df420d347819c3d9d82927fff7fb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334576, "uuid": "76f9b13c-2f32-483a-bfd2-90e61aaa8800", "value": "T16CB5E03FB268753ED5AE0B314A739320997BBA61B81B8C1E47F4094CCF664601E3FA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334576, "uuid": "b503ff60-83ad-4efb-9096-91919f3ce683", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334576, "uuid": "1b09da10-5a16-4123-838b-62762c44bfee", "value": "49152:rBuZrEUgN2tOeWeJDaO5iED9PvGEB5tsu/xsSs2rDHup4UKnrIvBGpM:9kLZOe1JDFUhu5rsmDHuGUKrIv4pM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712334576, "uuid": "812bbbbb-b0de-4a9b-a1c6-7a7adbba5167", "value": 2460205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712334576, "uuid": "e7201d27-3327-42b0-8a64-d05993f93192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334576, "uuid": "78167786-3857-4f20-9da8-3d17a19201f0", "value": "SecuriteInfo.com.Trojan.Generic.35622794.136.18395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6432dc5-f342-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712317861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317861, "uuid": "a1d13617-95b2-4f3d-bf5c-7e7cf91c44ac", "comment": "Malware payload (AgentTesla)", "value": "77b7263eec00863fe3fba31f14822fb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317861, "uuid": "bb0e0fe3-6306-4fcc-9cac-09afa8563a57", "comment": "Malware payload (AgentTesla)", "value": "1477c5a22b7e441d175da26dbdb6511ee298965a149a4cdc220875399f3a9fce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317861, "uuid": "bf41e952-2e0c-4912-8e59-52740c9676c0", "comment": "Malware payload (AgentTesla)", "value": "1a4ae0d1905a4668f77bef4e7db387d836f5991a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317861, "uuid": "33359da3-86b5-42e6-87d2-a46056e0135d", "comment": "Malware payload (AgentTesla)", "value": "a3ad85de62c0c370f725ac92be68258b985928b9d3ae0c3650784a5aa3c407b2f50a0884d94ccbbdec4523a1ce8aa45e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317861, "uuid": "7cfb41c3-13e5-4caf-bf50-37ce2518e653", "value": "T125E42346264CA61BC42F22F752E3451193B748DF8EF6E3CE5E8561D98CCC3588327AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317861, "uuid": "d83e2ed4-5c09-45d2-8122-ade8f7e8dc08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317861, "uuid": "006a375b-bb89-43dd-8f90-1f4b7745d244", "value": "12288:pH2iNlw0Mh0jFkDGNdNStwmXohawf1rVbxuCqwYBRhjW11T/VEMVNQX+uOQ/:t1Xc0jFkDGNdNSnoZVbXqFHEmM3yuQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712317861, "uuid": "9ac6f3aa-b7a1-4d7d-9731-568746a836f7", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712317861, "uuid": "84130d7f-bb4b-4086-9b3f-6f996ea10193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317861, "uuid": "a54f0c4d-b27a-4703-926a-1771cb32a267", "value": "1477c5a22b7e441d175da26dbdb6511ee298965a149a4cdc220875399f3a9fce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cd6345-f314-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712298134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712298134, "uuid": "86c7d95b-7f3b-4f23-a787-e745e6200177", "comment": "Malware payload (GuLoader)", "value": "eb320f2eb8e0d41873af66ca84fd9503", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712298134, "uuid": "4233774a-5458-4b88-aa18-097bfc4ddcc4", "comment": "Malware payload (GuLoader)", "value": "15210b067df4217d231781da59071d993abce19d57228270db41cea814f3dd78", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712298134, "uuid": "95decd76-94dd-46a0-baf8-7c50bb9174dc", "comment": "Malware payload (GuLoader)", "value": "0161fbb9679d79e11f42f1f0e49b0c4b1034b77c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712298134, "uuid": "d19b30d7-0919-4fb3-88aa-f06355849b0d", "comment": "Malware payload (GuLoader)", "value": "8c6f53ac2b4e701b9d7ccb60fb40db167b35ef72dd37410a28c603e252c4ace13e5a4bd1e4d5ef0409f2df137b54a789", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712298134, "uuid": "d1aeb2b6-8136-4ab0-872f-dfe06d709ad2", "value": "T12DB30A86B6861FE86D272FB64D4A144DC4B00C22953744D0F772A3C93E138AAFF7659E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712298134, "uuid": "9e32d765-1519-4f84-a89f-4f528affa4e9", "value": "3072:W7m5h8560AY5aIFxCQCQSgX6A5dmFPIp+z7bvHfVTnydFiCuA2:W7m5660AY5aIFxCOSgX6A5dm5Ipg77Hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712298134, "uuid": "ec41da3d-e9b5-4049-8d20-ec80c1465775", "value": 110313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712298134, "uuid": "f5e7a9dc-2084-4a87-9151-e294368f2fdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712298134, "uuid": "9af417ab-4240-4d1c-90ea-feda9cac9b45", "value": "2024-APR salary payroll confirm .pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0d9833-f2ea-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712280073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280073, "uuid": "bf5e9c1d-a25f-4f2c-ad20-04253b2c8523", "comment": "Malware payload", "value": "17cbf330bd77ea7c64b2f773bfb431f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280073, "uuid": "5ac13455-3d29-4c2a-82a1-0cd7e0ddf14e", "comment": "Malware payload", "value": "15b6539b5d7bee782f040800d36f7f4a1f066f68377b8cf72be88fcf09509ddf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280073, "uuid": "19003996-e12d-43e0-99a7-9584f954716b", "comment": "Malware payload", "value": "b25c22e73f69dd4289587765e0c8547f2413cd16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280073, "uuid": "7318a118-a370-47b5-8a95-0593caa66808", "comment": "Malware payload", "value": "22435c9dd2cdcf079c4be7918e18cc39eb4d702b6f5e3c4ce008913dafc30bd11d61e75e5429f5dcb8ec66d2748c145a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280073, "uuid": "92d18b67-af4f-4859-9b29-dd03c8287254", "value": "T15223F250FD688221C1F52E357904C1C89ABD83758AFABC1FAA982C725F3345E598C7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280073, "uuid": "007de440-d3c5-4b5c-8794-75b270323b4a", "value": "1536:7k8r57Ml1CV3zefih8xpVhiL8oeQ3YcYV5:YA57r3zdh8xpTtKZYV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712280073, "uuid": "5ff5bcaf-7c35-463a-8de2-0bb97cd89d54", "value": 49836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712280073, "uuid": "d64304fa-4c1f-465e-bdc9-7f34fcfe16aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280073, "uuid": "e40ed799-d547-4c0c-8e3b-1bcf3c04407c", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.27955.24114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b064e49-f380-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712344202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344202, "uuid": "7b1a5e21-29cb-432b-a5a3-635131fb7047", "comment": "Malware payload (Neshta)", "value": "0328031b6ac94fb5853cef2dc17c46ee", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344202, "uuid": "f6ea0076-3c45-43da-b85d-5c7fc7bb0aa9", "comment": "Malware payload (Neshta)", "value": "165595f8d0fd307da75d4647b95b55d1b2e66a0e0d10f10d51cff6b6a5bd3033", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344202, "uuid": "88149db5-5a55-4343-a5de-91d70906eaff", "comment": "Malware payload (Neshta)", "value": "ef0b251e1690fcb2a81e8b490753fe440cd0aebc", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344202, "uuid": "423322ee-2285-4046-b0b1-0b793105b4c3", "comment": "Malware payload (Neshta)", "value": "f663ae9a828bed8fb9cc9cd30ba7c33bd7933769358730461721f15a51d945bab8e746a62c63b4f6cf96c60701fd9947", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344202, "uuid": "1d5f8ec0-5705-4dea-8127-3a3311cd604b", "value": "T1D2758C03F69680E5D05EC2788F364735EA71BC655F20A6EF02907A252EB7AD01B3DBD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344202, "uuid": "12ef12fe-7253-447b-a631-af0314a0c6f0", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344202, "uuid": "1ca6283f-a76d-46c5-909f-1be8c86941e8", "value": "24576:hBP8XXWeLc/EfhRjxKbHYjF9JPEI4B5+kkkkkkk7AT:hBUXXHLc/ExaHYjHtEI/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344202, "uuid": "a68e5c63-994b-4f1f-8a46-64fa837bb3bc", "value": 1681464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344202, "uuid": "8e82d8b1-79fe-4d4c-8e8c-d5ead1f0cdc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344202, "uuid": "98516b61-17f5-4341-80cf-5a1e64abc653", "value": "165595f8d0fd307da75d4647b95b55d1b2e66a0e0d10f10d51cff6b6a5bd3033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b69eb1-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "b6ef00b6-0f7b-437c-b135-d75f48d380fb", "comment": "Malware payload (PureLogStealer)", "value": "5987f9a9b5347bf14a6dfa91d6b94d96", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "2d6d6967-6bc4-41bb-adb4-9d15009452ab", "comment": "Malware payload (PureLogStealer)", "value": "16bf3678cb8445c5c35c2327052b09948b4da2d26670e43f696ab752fda1e5f6", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "0118f6ae-f0a2-471c-bc07-2b28b5079923", "comment": "Malware payload (PureLogStealer)", "value": "1c7bad793f6c896a3bbf8142c0880a107ef9520b", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "a959f68e-4c1b-4728-8068-3dfbe3e3416a", "comment": "Malware payload (PureLogStealer)", "value": "5897b51186f472ab52dce11d68f7422369a3996322078a923d4847b6ffb1b1f804dc8cf7693c123eb1b831d62812f7fe", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "0c066684-1dbe-4a5b-9ecb-73d830bcfd6d", "value": "T1FA9423F0B4AC25B6E9E709B9AD334F201BED5F9D4A4945D3123C3E47496B38CA0D16B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "c5819cdb-b02a-402d-93e0-eb60483bb75c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "1b41f96a-0a07-4a1d-9f4c-8bb918805864", "value": "12288:r36qcgCddrve5wQm3JUzXv9qFT5sAGhYvj:b6ICf71JUzXvkFtrgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "5ec2c9ff-f3b7-426d-a1d3-a30d499f3390", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "85ee3592-5407-4d19-95c1-f2003635fe24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "d899cf9f-564f-4632-9edd-5d76f13c3313", "value": "171232524542d087c4fd1eccaa2f61ace6f3c94f9a62162a5ac921a83cf295e739d4184674298.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346a6934-f33e-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1712315898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315898, "uuid": "47ed6401-88fa-43e3-9044-761330cf3511", "comment": "Malware payload (XWorm)", "value": "835b1e409a1c6bb2c9b4af67fb3b2d71", "object_relation": "md5", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315898, "uuid": "3ce1c5b3-63b9-4c35-bd8d-c38aeac63a05", "comment": "Malware payload (XWorm)", "value": "16da17a7d922a490fd554b01f0ba1f2cbc46605ac8f8417a233e68a595e24051", "object_relation": "sha256", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315898, "uuid": "9159d5d2-8120-4fd8-9f5a-32597834bda9", "comment": "Malware payload (XWorm)", "value": "f5065d35b91b9ec284cbffc85ee78e7ea8a16389", "object_relation": "sha1", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315898, "uuid": "4ad18cba-cf9d-4f05-8d25-04b0843d7cad", "comment": "Malware payload (XWorm)", "value": "5ea8549170119b2e2bf95b3300600bf4f8a780c1621424d13d0e87f6f910b57199dfc189916c37f882bc12b17d564bca", "object_relation": "sha3-384", "Tag": [ { "name": "vhd", "colour": "#219A84", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315898, "uuid": "3db6fb2f-1927-46a2-b4bc-de5fc6fafb4c", "value": "T14496CF13F39145AAD06EC2348AAB5321FBB1FC865A21A24F17A473353F72BA41F1DB15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315898, "uuid": "51c40ba2-a64b-41c5-b3c6-9f718b53ff0d", "value": "49152:Nb/WCLE4eDqB4a6imkqcvBjXIjVUgwt5Og:kCQliq0BTI5UIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712315898, "uuid": "367aef07-8649-46c7-8db5-9a8b3fcd8a9f", "value": 9437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712315898, "uuid": "8b2c154f-f61e-4ca6-8c8f-34d2f13065aa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315898, "uuid": "740853f2-75bd-4baa-8807-00c5d867f5b2", "value": "receipt_usps.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28618d12-f326-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712305570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305570, "uuid": "0b277df3-263c-4aad-94c2-b9b628144a14", "comment": "Malware payload (Formbook)", "value": "7fbd594db1c6dee5bfb38d299a4e0644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305570, "uuid": "23310a9c-d81a-4b0e-b9a4-57cf888b269b", "comment": "Malware payload (Formbook)", "value": "1711d935991cb37bd208dec08aefb47cf049baa4aa465d3188feccd8d330e72d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305570, "uuid": "6b3347a7-c916-4124-b54a-1a82b27994e0", "comment": "Malware payload (Formbook)", "value": "1cfcb7606bf22484740569b8de78f051c1acc707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305570, "uuid": "44f474cf-bdb8-46c7-8dd2-df6bf1debef2", "comment": "Malware payload (Formbook)", "value": "3cf81c08cd1e3fd8b50d675d3c5323220433eea79ac3a53c0f2908225bcfb3233742eb468372a42af99adb9a2e2c37b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305570, "uuid": "8bb9a08e-0f28-4078-99af-34d961525194", "value": "T1D1D41239BB6FEE11CAED853AC6D219590377978B2133CB473ECC12685922BE64D80F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305570, "uuid": "9c8b6e72-e525-4a6c-8f6d-05f32ca8a79f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305570, "uuid": "db760e6a-5484-4377-8430-db0a6478c824", "value": "12288:dUHlh4sZmi9+i6C/e3JfPnc+Y2TxRf2lNrhno0b/Wt/fyC3Ui:6Hlh4swul6CG3JfPnpT/2rhno08ft3Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712305570, "uuid": "64e90631-720e-4ad4-a76f-3d5c39f31696", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712305570, "uuid": "20a4c88b-e8fe-4f84-a8e3-a1aba7b5ea1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305570, "uuid": "ddcba248-92b2-4785-bb80-94fc981c5eee", "value": "Dokument-99373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b702057b-f399-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712355202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355202, "uuid": "5ead8791-547e-41a1-993b-13bfa96f3430", "comment": "Malware payload", "value": "c514474da5082a2e70e21119949b76b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355202, "uuid": "2623cdd7-6617-4ded-8044-968d5500152c", "comment": "Malware payload", "value": "17b8b16a1d4f570d7abb1decc63a1e933010caefb5023f7158d1c3dd81ed92eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355202, "uuid": "20594c0f-8469-4911-aa1c-da91c1c0598c", "comment": "Malware payload", "value": "807c5821b21c6a2cec4d300887a25a8dd972a0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355202, "uuid": "5ae7b0b5-a054-4cc3-af21-434ca03a6c23", "comment": "Malware payload", "value": "0d562493e43fdb1a25bd1632e43b9986a6aefd1b4e86a7941eb6954615f9047c6349ebc1ae7e94a41735e4aae034e714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355202, "uuid": "901eb36e-3482-4f64-866d-7aa2d695a5d4", "value": "T17C241264EB78E536ED0F6E38B06681A203D4AF33C56B842EF536618CD91F67471F6812", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355202, "uuid": "373711d6-35e2-4d47-b6fe-38eafadbe742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355202, "uuid": "fd8c3b96-dae9-41d5-b2ce-381348a37784", "value": "6144:rjqEeGQUAQ1icmcBZslhT3MAsUtwviPiP:/e5UAQ1WLlhRsUSiqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712355202, "uuid": "c16e31ba-3c04-4c59-b89e-3e82c19520fa", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712355202, "uuid": "62231a83-2e15-47b5-8c39-c32bf132dc94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355202, "uuid": "06d14a94-5eff-4cef-9313-5bd804abdecf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa76a83-f343-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1712318056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318056, "uuid": "69ac8e4d-9da3-4df3-bb68-451a34cbaeca", "comment": "Malware payload (DBatLoader)", "value": "c91063d78c15a9e57854e6aa7639dc42", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318056, "uuid": "ec630421-18c8-4500-bd30-80a565c8edbe", "comment": "Malware payload (DBatLoader)", "value": "18743594c132d86949a34f29f6532a0bf82b8e2c047924e3477b7f080603f71e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318056, "uuid": "08f857ff-7dd2-4f99-95bc-99879d26ee91", "comment": "Malware payload (DBatLoader)", "value": "2ce28afef396abe792cb85cbbc51aa9f5c171e2e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318056, "uuid": "0b552366-b9ff-4348-adfd-4a91373dfd9b", "comment": "Malware payload (DBatLoader)", "value": "827e39bd21aab9fbaac60712682aa4cabb87e06e5a204aad02458c0da4ec4aee209111caf89f610cccf60d65ec874f1d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318056, "uuid": "2cee0ee2-2445-457a-85d2-a51865d7f688", "value": "T13F36E8E339FD278617063F5B974FB5940A1FFD394BF25AE440C72588014A68B29A09EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318056, "uuid": "c94db3dc-7276-4b61-966b-25e642651505", "value": "49152:xezOW2/puR1S5LyWb55JBnZkRidEiXTqdiMTOciC1UMIrZu6zYDMJhlJ48pDug:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318056, "uuid": "4c855cb4-f91c-4d7d-b98a-3bc3fad2e6ef", "value": 4945728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318056, "uuid": "83cbf025-87cd-4661-87f8-552a214e2cf8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318056, "uuid": "47be0d86-b75d-47d1-b53b-88f411bbbffb", "value": "doc09210381705449202403.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed971b22-f331-11ee-a120-42010a9c002e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1712310626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310626, "uuid": "443b5e8a-969d-4901-bac0-1a842e2362e1", "comment": "Malware payload (SnakeKeylogger)", "value": "25a46527b42b425083fe4778768f2073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310626, "uuid": "e60c8306-d9fb-4418-b2bb-d7f06099f872", "comment": "Malware payload (SnakeKeylogger)", "value": "190504e991bb8bb608cf87db9ee7c7549999a17970251490ce85282f85cb49aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310626, "uuid": "d4f82501-fe63-4ad3-9fc9-141ca9834d9f", "comment": "Malware payload (SnakeKeylogger)", "value": "837219cc634a58cb7c10be9a5d6759562eb8d3f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310626, "uuid": "ca44ab1c-7a2a-4077-bb5b-fe561b3e31c9", "comment": "Malware payload (SnakeKeylogger)", "value": "753e32878222d8abbfaaaecc159b1157f3aa6f3d6df3e6fdeeca5dc131edeb1b4cba61f9a3fb1f23e3a9646991107da3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310626, "uuid": "81914dd0-b388-47dc-9b95-59fdbdb34a8e", "value": "T1C3B4120533A8DB27DCBC47F67016656403B2AABA39D2E1889DC2A0CB5F71F4096E5F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310626, "uuid": "a2984a6b-e804-417e-adfe-3cc8a1a10250", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310626, "uuid": "95bfeeee-a7d5-461b-9111-cd21122c5968", "value": "12288:JrLz6jG8UHRVVLHxjNFD04RUBFQG27TGS7oukJ0aSahC5ri78c5:0GTHhLB04uGTGOkGaHhCpi7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712310626, "uuid": "e056559e-0569-4de4-becf-12924bd8637e", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712310626, "uuid": "bd10c5ed-0f44-4471-a4bb-9240882a3154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310626, "uuid": "0c4885a3-ceca-466c-a369-454445166cd1", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a9555a-f371-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1712337825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337825, "uuid": "9813e053-f368-4ad9-9047-825c350534c4", "comment": "Malware payload (RustyStealer)", "value": "422ad9c53a86f687b230fde951fb5856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337825, "uuid": "53961583-f778-4ec2-a63d-bdc3cae88817", "comment": "Malware payload (RustyStealer)", "value": "1a8023c76e45b0145f1c28753efc1d5409a0ac2a1c6fdbab2022e737dcaa0ab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337825, "uuid": "827cdf46-c1a0-4228-9c66-8c1c7ed41451", "comment": "Malware payload (RustyStealer)", "value": "17eb89de5f5a21b3e83497e74145613209bc3a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337825, "uuid": "6f02ee60-650f-417c-94c8-496d6ab73c81", "comment": "Malware payload (RustyStealer)", "value": "0188c52f05ae71bddc4cd32baa61423f59eebc1b066b83a9b1fd86a5e4a0791101f81d8d5d7b549191ab6dc4fa91212e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337825, "uuid": "7097c2ce-0de6-4173-a889-938db279cf55", "value": "T18AB533FC1ED19073D8BED8FB6149D4E3448A723A5A8C82D74D7EDC4396B01A65E8C81E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337825, "uuid": "4e87bb72-fda1-4d10-8a96-be3bca613eb8", "value": "e8effc9201cf1e60acc68af88aec3bd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337825, "uuid": "56b1a2cb-4e60-47f3-8d1e-858556b6496c", "value": "49152:Tgxqu3RcnLHx7FHNwA5VRp/KQiGH+7W7WFDus/3BcSJir2Vn:EQLVFthRhiY7Cus/3F4qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712337825, "uuid": "c5afaaaf-df7c-4c7b-88b2-4df8e7053e12", "value": 2269184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712337825, "uuid": "1f00b4a4-59f0-4c2a-a533-2ccd54fa9b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337825, "uuid": "fa649a5d-cdb2-4aae-8458-802395cbcff0", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.36229.12900.12961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5e4036-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335103, "uuid": "353a2d57-4169-43c8-9d91-70cb675bb4be", "comment": "Malware payload (Gafgyt)", "value": "dfde824ebf205d1e1983308ca46fbe55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335103, "uuid": "67e6fba8-2381-4fca-a9ec-2335982b7b99", "comment": "Malware payload (Gafgyt)", "value": "1ae190e636362b0f37145c98253033c02353bed109e1971c662da047699ad8d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335103, "uuid": "5f8262d8-f8fb-4c9a-8725-ef8e208df4f5", "comment": "Malware payload (Gafgyt)", "value": "6b638359074c9bbe793c096a1d4360d720beb011", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335103, "uuid": "4c907e86-cf16-4ee7-bc01-2f4f174c1e7a", "comment": "Malware payload (Gafgyt)", "value": "4243f1a6abc0e11648b56fa306fe413e25d8c652ac263ecb954a467ef063b9ea1d8f29fd24131fc0482a5b87260713eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335103, "uuid": "a85892a8-ca49-4146-9696-04b1a00e3efc", "value": "T1CA934A47A965AFB3D146AEB526B359300713F9611F5F1A89B03CAAF4430F8CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335103, "uuid": "82ca93ed-7297-4013-badf-40d8978fc242", "value": "1536:0dBDazxSK0bEgYNSKKbx/vdSCDl1IZK1DykhRxbWjK5Yx:a5a9V0kNSKKzSeIZcDykhRxyjK5Yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335103, "uuid": "6c6f2cdc-76c3-48a0-8f6f-16c1e62c8551", "value": 91605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335103, "uuid": "9001a95a-d343-4088-b197-44eeb2999a0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335103, "uuid": "728b4a1b-dc26-4969-8a02-e8e05a7383e5", "value": "dfde824ebf205d1e1983308ca46fbe55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c515e6-f329-11ee-a120-42010a9c002e", "comment": "Malware payload (Netcat)", "timestamp": 1712307114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712307114, "uuid": "56953d39-6cc1-4c02-9f06-949c0c53fa64", "comment": "Malware payload (Netcat)", "value": "9015e71c690772e2f6a45cad1503164f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Netcat", "colour": "#B03423", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712307114, "uuid": "56001507-9d95-4e7b-a6cf-ee5426bf2260", "comment": "Malware payload (Netcat)", "value": "1b27e96a50358439915859fcae4ec6a8cd83029063613146a4f9737b8d9b92a5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Netcat", "colour": "#B03423", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712307114, "uuid": "2fc64970-450b-47f6-b57a-bf93827b546f", "comment": "Malware payload (Netcat)", "value": "a83429e98cd5b5927870ef222d50eacc2384bb52", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Netcat", "colour": "#B03423", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712307114, "uuid": "7952a781-2f73-4a58-a63a-228dd93922ab", "comment": "Malware payload (Netcat)", "value": "0125e8f600a1050ae57072afa9279745666b7fe5d74284a6d24fcbf2008acb38f045f922c0c8ad3577c8f65e6fb2cddb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Netcat", "colour": "#B03423", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712307114, "uuid": "d594ba50-a664-4e14-882c-bf375969ceff", "value": "T1A0218B29DE71FCE0436E7190CC242F4730895A97C6F09FA9E89605DE1D24104DF1E16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712307114, "uuid": "910f582b-48f9-47ce-8207-b323a27cf07a", "value": "24:00pl2ag5BE2GTnSpXS7aJUsCzdiUokcoTOvon5oW9GTBjkRQmnAK:1p4GTSNS75scxokZTOHwGAQmnAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712307114, "uuid": "61d8fc87-565c-4e5f-b359-469ee8f65dee", "value": 1137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712307114, "uuid": "15cb05e2-9f4e-4a7b-8b67-c362f292d6fb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712307114, "uuid": "5cbdf036-906c-4fad-9da2-037c0819b2ff", "value": "1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a516a8b-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712320982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320982, "uuid": "b2fcdcee-e365-46ca-a076-60c775791556", "comment": "Malware payload (Mirai)", "value": "eb060171b06ee90702a165a81248e91b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320982, "uuid": "3aa22701-bfed-452e-9cb4-a00f8cb713a3", "comment": "Malware payload (Mirai)", "value": "1b3cb07f0b8c3e1c9808ef375357ee833944f827419935f0a756bf2ef4e651d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320982, "uuid": "8a9ec236-7846-438a-85af-ead7f829f1f0", "comment": "Malware payload (Mirai)", "value": "fbdb658e4d4af64dc765d09306d46252080b18ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320982, "uuid": "9d28fb84-c500-4967-8284-ab682ab6a362", "comment": "Malware payload (Mirai)", "value": "24f407785c56b1034aa73d5a7c8e912f81f545ce692227536a9925508dcc14a983ff6146985e2709b5f15aed20504e69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320982, "uuid": "f9a89766-144c-47c9-87fa-eda2ed7b1f0a", "value": "T118A2E1257F1DE98FCC37B27886E5E9C693D07D24D2DCC9866741C12FAAA36846830E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320982, "uuid": "311c0255-59a3-4f68-a3c5-97e3702442c8", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtWDlSc:x98o08kxofBE+ZkXaT47C2Epitu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712320982, "uuid": "e89c1123-b69b-4fa0-b45d-01653425734a", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712320982, "uuid": "27fcade6-6850-4e29-b211-ed2042388253", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320982, "uuid": "ce315516-b88a-4b2f-a021-b853da4afd55", "value": "eb060171b06ee90702a165a81248e91b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a749563-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343987, "uuid": "fb5fd936-21ab-49dd-b2bb-f68e35f6acc1", "comment": "Malware payload (Socks5Systemz)", "value": "aa45aef96d201bf5e0265d3679b6afd8", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343987, "uuid": "112e5631-85e6-4e36-8c80-86c6db5aa54a", "comment": "Malware payload (Socks5Systemz)", "value": "1bf02337dcc9cb59e2ed77d96dfe79481da534ac7e3755af3d84368e3e556e46", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343987, "uuid": "d34a764b-aef5-495d-af9d-2211ae2849ad", "comment": "Malware payload (Socks5Systemz)", "value": "915694a7cca74ee13a64f78b6f24cbe8604716e2", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343987, "uuid": "db088fd7-b3f3-4ff2-965f-095afac49f60", "comment": "Malware payload (Socks5Systemz)", "value": "39fd5f65c133d712e5dd2d9fb166f532a487f1baa335ff1631a9c3085dd94f975dfdc30ae8e02d5173c17a2b6a159b70", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343987, "uuid": "6aba2538-cc80-467e-8fa2-15924f335dfa", "value": "T197E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343987, "uuid": "8becc88c-969d-409f-83f5-71cb58a399b4", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343987, "uuid": "d7d331a8-8c18-4e9e-bb20-8d83bf05ecb3", "value": "12288:HjsgiZdvAeRw3+auHP50cC5gBqKocvpWwHymDRKLiTOkoRpbHB8ksiIjcBDQg5EO:DsgwdvAOtv50cC5gBqK5vpfHymDR+iTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343987, "uuid": "5a4c52de-da84-4ece-9fd8-a2e887bd76fc", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343987, "uuid": "a35f7113-827c-434e-8456-b40258ea1221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343987, "uuid": "3d951021-227b-47cc-b6c5-53cd3e73fbc1", "value": "1bf02337dcc9cb59e2ed77d96dfe79481da534ac7e3755af3d84368e3e556e46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a74567-f340-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712316729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316729, "uuid": "8734cf68-7300-47a0-b49d-529376d630f0", "comment": "Malware payload (Adware.Generic)", "value": "44d87ee6de21ab367ff9d2c736e7871f", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316729, "uuid": "6bc4c95d-216a-4287-bd4e-f273c1b689da", "comment": "Malware payload (Adware.Generic)", "value": "1f42d349e9f118d013c4f47b0917705e46f1e92736879fd3ce03a59211479581", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316729, "uuid": "6f9ee07c-37a8-49ab-9df4-c9cc8907affb", "comment": "Malware payload (Adware.Generic)", "value": "cd45b4ff04762102d995e9b13f4aa9d408cb7963", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316729, "uuid": "2d067b3c-bd9f-4cb9-a9c5-7026c22acd16", "comment": "Malware payload (Adware.Generic)", "value": "1de8c56accaee728aa9d6aa8f5858264adf902c11d7bbbf7ea7bcd593d291c7efa91991481c15306c78e7f909a95d881", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316729, "uuid": "235e948c-1d8c-4212-a136-2d4730037e72", "value": "T17447333BF25CA53EC86A5B314573926099777A11B82B8C0F4BEC744DCF765202E3B662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316729, "uuid": "0e23baf3-5950-4094-a871-9eee4caa9194", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316729, "uuid": "af96df43-660b-4301-9524-20c9aa012da9", "value": "393216:XtdJk1IZTk9U5x4777xrPfIYM1+mJ6v0fyLc09gSeo+S0TfNPnMAmuWzg4Ug4q2Y:a1IhP347/NAYM1+mJG+Uc05B0NPbmuWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712316729, "uuid": "c28239a1-674a-498c-8adf-92eac3719de3", "value": 24955276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712316729, "uuid": "edc5f1b4-9145-4281-80cc-d8562fc73417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316729, "uuid": "943022ea-699d-4ec4-a6cb-9a7f2c9a2e24", "value": "SecuriteInfo.com.Trojan.WinGo.Agent.5974.5232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a61a9d1-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712321009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321009, "uuid": "cf2a53ac-09b8-400c-8c86-eb29203ec4c1", "comment": "Malware payload (Mirai)", "value": "dd92493fccbeac4786925f370d123bb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321009, "uuid": "63c318a1-f118-4d1e-8426-6eb43b5c1770", "comment": "Malware payload (Mirai)", "value": "2060292faec98af93a6f651fb467e616d03ad6ed1c76eefe3da3f8c4b9ffcd00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321009, "uuid": "28fe1b1a-da4a-40ae-b4e9-4dd015b19546", "comment": "Malware payload (Mirai)", "value": "882ff52730919ff02777fa22c18019802db7c26d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321009, "uuid": "89b24f5b-eb20-47ba-afd6-745d12d8aaa5", "comment": "Malware payload (Mirai)", "value": "a7e2e15301b3f9e2accec2c27cb1b712aeb11b8a656326c6e4420e970069fbe3ee144dc050be5483f8cc37d43b61d77b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321009, "uuid": "2844655c-b561-4459-9283-b9865acb5fb9", "value": "T12F82CF3061AB35E5DBF10434FAAECEC6971A0BFDD1FC32D217586B788A4510651F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321009, "uuid": "49bf33a2-d1cc-4b6c-ae6b-56acd80604e9", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMac0hymdGUop5h5li:6/V0P6+kom0tVAoNvm+to1c0s3Uoznli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321009, "uuid": "65d47873-c7ff-4989-857d-8ad6cf92202b", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321009, "uuid": "88c31302-7300-4be2-889f-3d52c6d44541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321009, "uuid": "c37b4c9d-e0df-4e6c-9919-71ed8247aa26", "value": "dd92493fccbeac4786925f370d123bb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470f296b-f347-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712319795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319795, "uuid": "04bb2983-45db-4c51-ad8a-b482b356b8da", "comment": "Malware payload", "value": "2a7aeca204405c91c925c565fe283b62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319795, "uuid": "95ed66db-37cb-4db3-8dd0-40cf60dac23d", "comment": "Malware payload", "value": "20c860e39ba1c4ec77cdb3ec3b2f4edd150602b75e36d9dcc1d7a4b3642c20da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319795, "uuid": "ca1a26c9-be0d-490d-bf0f-15b2b2f82747", "comment": "Malware payload", "value": "131e2cbe190f8265094c0a4fe875c438d97794a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319795, "uuid": "4da06f5d-002c-4879-91c7-276f01499a2e", "comment": "Malware payload", "value": "d530bf76d0f8eb4e89c7357a7f579c9541cba27f40e1dace170f436c1a0178e1dd79f3ae852bda8ea0b7b0f781223eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319795, "uuid": "90e2c289-a88f-4cb2-8539-e23fb53f6cc2", "value": "T12B648E59F3A904F9E977927CCD424946E6B2BC170364DAEF13A046563F232E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319795, "uuid": "e4f21347-70ae-42ba-a346-961fe948dd48", "value": "ed4ce560aaaf4b690237b47c3286270f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319795, "uuid": "6f41e804-6283-4206-b21b-74da17690b57", "value": "3072:9MNoKU4A/PdFN1/MM8mB1gr3rPTUFDTqH85Y135dcBcl81wBKLJoY46heu5VwIF7:NdFf/Z8mB1gr3r7UFngR1v+tohM/FHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712319795, "uuid": "66550f06-7493-4f52-ab7b-b3cfe5b74301", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712319795, "uuid": "c5ba55b1-8056-4505-9a5b-1ff9be462ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319795, "uuid": "69dccca5-b735-416a-b17a-ec7ff5021464", "value": "20c860e39ba1c4ec77cdb3ec3b2f4edd150602b75e36d9dcc1d7a4b3642c20da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93183b6a-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309615, "uuid": "a7eb203a-3b55-4ad1-af6c-4a5ce55664a0", "comment": "Malware payload (Gafgyt)", "value": "ee751389ab0c761472fbc033b1439e49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309615, "uuid": "8dadb294-25f1-43c8-be1c-43221c1bb9a3", "comment": "Malware payload (Gafgyt)", "value": "20ded9a3664a8abc4cbf12cedfc1b483704a766eed8cb07422560f89a3166018", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309615, "uuid": "f9b3a40d-7e44-4485-b2e1-92d2f225b722", "comment": "Malware payload (Gafgyt)", "value": "17f70d9d0e59af765a0c66a957b5b30074a97915", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309615, "uuid": "2223e126-1000-4aa9-868e-0e7d011bfdef", "comment": "Malware payload (Gafgyt)", "value": "fc407c8e3c2fbd973f80fd7783072df0d24eb5b5ca85bd4d253681ae47c19425e42352f4a0e210993237f2a61f891f88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309615, "uuid": "b1011079-d5c7-4775-88ce-a952c7633748", "value": "T1EAE3E876F801CFA3F40B96B104D78A226D70ABE30B532167732635679DB31D63867E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309615, "uuid": "ca391a30-7694-44d9-9a13-a75ac217ddfc", "value": "3072:ea3OyE1SweGuvIey03rcyPTUyWL+J3FepjRmzb0qDJNYyoPe:eCwcIey03rsyWCJ3FsVmzb0qDJNYyoPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309615, "uuid": "16cd4046-5595-4ede-9ff3-1e9d8a92ad04", "value": 145935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309615, "uuid": "a1ac0e2b-3887-4325-9b60-9f8195d8d022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309615, "uuid": "7dee74be-76eb-4616-932c-f053ed47d728", "value": "ee751389ab0c761472fbc033b1439e49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d30080-f369-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712334577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334577, "uuid": "803e19b4-4308-4a81-82e7-2606e9487e8e", "comment": "Malware payload (PureLogStealer)", "value": "29b7708a7f3fc2e2324e4453300bd967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334577, "uuid": "bd0b8362-cc44-4465-afe6-a2e81ace8d58", "comment": "Malware payload (PureLogStealer)", "value": "20e026719899bd4e2a5ace5a38af117ca9e7414558bcd4b6cd63be3fa02d35c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334577, "uuid": "d4c213de-ba3d-4015-a5bb-2bfe2c07520c", "comment": "Malware payload (PureLogStealer)", "value": "21ae635f6b9774d559b8c32032ebd670e7ce3449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334577, "uuid": "31ff1a6c-e4b9-4627-9264-68016a3ae7ef", "comment": "Malware payload (PureLogStealer)", "value": "c775304244f62c468b0499de31e27a60e27e0ca9feb56b3d5a3e9b6cc3fc3aef963725393e38c9cccf95c5328ec9f342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334577, "uuid": "be306dd5-0f57-4500-80e5-fcb0419503f0", "value": "T15135DF1666248D04DB282B74D093C53643B5AD927AB2E30B29E5FE773DF32E14D0AEC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334577, "uuid": "f5001567-847e-4eda-a55e-e13b8cb11b6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334577, "uuid": "4ca3bd08-88a8-49be-b86c-570b94402a72", "value": "12288:Tf7x8OyM8+lb3wjySOwfnkpK8k9MSzCRrttDmUEHkx69wRLwPINSEpEfyL:3tx8sbg7kpe9M0CRGVi2ASElL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712334577, "uuid": "8cfb9410-3320-4fd9-a2f4-c058c7ad7b17", "value": 1080168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712334577, "uuid": "250cc856-9baf-4402-b62c-837a9be5246a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334577, "uuid": "8b9f4d3b-3b34-438d-9203-405159b56783", "value": "SecuriteInfo.com.Win32.MalwareX-gen.11432.24769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7bc55c-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343989, "uuid": "10a159ad-6440-4ed3-8e11-a0e486e3d427", "comment": "Malware payload (Socks5Systemz)", "value": "25b2b91dac965a8df1d5a0fdc2b77c16", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343989, "uuid": "3b9562b3-3200-4403-87be-d75614b49128", "comment": "Malware payload (Socks5Systemz)", "value": "2106d1625ab901eaaab278593db699f43fcfd9d99c01bd6251e3deedbc247f43", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343989, "uuid": "b6da32ef-8f88-4b50-a3a8-496c0cd2b95b", "comment": "Malware payload (Socks5Systemz)", "value": "79911ec48cbafe82e4d3f399a65ca43ca7c2c975", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343989, "uuid": "f37e49f4-f894-461c-9e37-c182346bcee1", "comment": "Malware payload (Socks5Systemz)", "value": "01ca944ca7f5e85d343846588d0334f955c7b39c7b5e57ed329b64a8a5938587d9624955b7edb843740afd996259ebb4", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343989, "uuid": "71dbbfd7-de82-4749-a1db-5c81c20e0186", "value": "T185E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343989, "uuid": "92c36ad9-2921-46df-aa85-e483c5c13c6b", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343989, "uuid": "24daa757-1f63-4612-a623-d1f1370085bd", "value": "12288:sjsgiZdvAeRwC+aVHp50cCVXBqI3cvpWwJ1mtRKLiTOkoRpmHaGkPiIjcBDQg5Ei:6sgwdvA3iJ50cCVXBqIsvpfJ1mtR+iTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343989, "uuid": "97d2e2ce-81d7-408e-b100-1fee0878f798", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343989, "uuid": "4531f78a-c9ef-49dd-8e23-65647217a94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343989, "uuid": "9b520ffc-295f-4373-9473-f7cd3ab50815", "value": "2106d1625ab901eaaab278593db699f43fcfd9d99c01bd6251e3deedbc247f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbae29d6-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283913, "uuid": "8fabdef4-5a91-4af4-b84c-a8606ad72e14", "comment": "Malware payload (Mirai)", "value": "6b80704284377e4130dda95c193996ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283913, "uuid": "4c3c8854-c647-4a93-809b-0109c5606bf0", "comment": "Malware payload (Mirai)", "value": "217f1e16cb7a7513e8db37ea600e052df517eba8f4e31d89d38c4e43f3563b83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283913, "uuid": "1cea3218-8c5c-44cb-aa3f-fe1945970788", "comment": "Malware payload (Mirai)", "value": "6268a9be1c5514f2d1d2e685496510b3d6cca818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283913, "uuid": "3d5a3fd5-0822-4b5f-b75d-ec0cdc9f47bc", "comment": "Malware payload (Mirai)", "value": "7b096d63ad35417fd8f7839852473c261b0db0d2a938a1d5ddb23aaa7df1d7b05527e4951324998b36ccded83b7a05dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283913, "uuid": "952ffdc1-0ee6-4c30-9d4f-9134c5cbe487", "value": "T12C63ADA3CB5A2C40C14C827470A88D3D7763F65581A72FBA19E6D2AAD447EDCF1097F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283913, "uuid": "c5bbcc43-0289-45f1-a379-a4c4cae45b3b", "value": "1536:m/RsT2BYFatLjMI0wUzJbSpnkTkBwf+KkHLscPyICNmBVwbZnN:m5p+KjMI0rtSkqGxk1PyI3VwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283913, "uuid": "620e8c2e-7cc8-4295-84f8-c5ff9aca205c", "value": 71768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283913, "uuid": "a38f594b-4c6a-4af2-af80-9c7fa2dbae04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283913, "uuid": "0e5679d7-8aa4-449c-ade5-a3e08abc26a2", "value": "6b80704284377e4130dda95c193996ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ac474e-f344-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712318471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318471, "uuid": "b8449f8e-cee0-4cbe-8b42-f0b5c619d4e1", "comment": "Malware payload (Formbook)", "value": "221a213c2028369875efee2658550a14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318471, "uuid": "04d4a765-5fe0-44b2-9234-45548b057a43", "comment": "Malware payload (Formbook)", "value": "21e28d2ae74d303a4d013aa13867dab25bdf38622f17ff83694321fa12509d62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318471, "uuid": "f213ab12-105b-4300-8e81-8b71ec398e4e", "comment": "Malware payload (Formbook)", "value": "0700f310b1e0a731aac36c17a972739dbf91a3a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318471, "uuid": "09af1d63-5b00-4a1f-9e4d-73dd14d99068", "comment": "Malware payload (Formbook)", "value": "6a704b6615039783ad9642ba7ecda094c243fb65bc91d012efad18499ad002b4659630be76f568d7f2162eb865e7e9f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318471, "uuid": "9bb39cea-e56c-444c-9c1b-1729d9472750", "value": "T173E423B47A8C6A1FC83B1FF950E304604776489703BAD7DEAF9122429CC57A4235F69B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318471, "uuid": "7ffd26e1-ff50-44b1-8647-98abecb08b8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318471, "uuid": "20b789cf-0561-4d2a-95fc-840d29b46fb3", "value": "12288:SH2iNlw0E0k6DEMLU2bgr0WH3SLcI/liAHEJQVuuVMGWFX2fFHwiH6pXKTTwBbcj:81XsqE+kNgcGoAHEs0J2fFH2cQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318471, "uuid": "978bb1ff-212a-4e2c-814e-148f44e9faec", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318471, "uuid": "5ebcc79e-71cb-423e-833e-cb5262e44bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318471, "uuid": "037d8aa0-fb69-460f-81e7-e9db8f13c40d", "value": "21e28d2ae74d303a4d013aa13867dab25bdf38622f17ff83694321fa12509d62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a633d4-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335112, "uuid": "d50fa1c0-2e1b-4c53-81f6-a0a012ff5fa4", "comment": "Malware payload (Gafgyt)", "value": "ebf8775bfd576bd76542bc6390fe567f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335112, "uuid": "069c410b-18ca-4243-a326-91568344bf0f", "comment": "Malware payload (Gafgyt)", "value": "2222fafc9063378552f66c299254e04888dccb8a99cf3e5f0804d98c4f1182d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335112, "uuid": "1ee31833-342e-4ebe-ab6c-5df258f1009d", "comment": "Malware payload (Gafgyt)", "value": "65a3f5cddd6c10ab42c0905b2b34fd757e4773fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335112, "uuid": "ba7a09b7-e0a0-46ed-8ef2-b9d6b1240f66", "comment": "Malware payload (Gafgyt)", "value": "549ede6065478fc6b03311b608baea27ddae3663020b43525c93c6aa99896eada239764c4320bf442189f31375d1c13c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335112, "uuid": "38d4be08-8803-4c3c-bdc4-fbb45f23ea61", "value": "T107A30993B801EFB7F40ED77604D34B20B270BBA24E531666721779A6AE722D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335112, "uuid": "c9929968-bb6d-49a3-b059-68c31ea87ea8", "value": "3072:0CrEaDLyLqqEJD73auykSMNFZ7ijDIkhRK6NK5tx:0CVCLqqEJDxykF1ijDIkhRK6NK5tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335112, "uuid": "99c35251-6588-4bb9-b3a7-6121d1c67fce", "value": 102255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335112, "uuid": "f211c94c-6767-48fc-96aa-b33d8ea467a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335112, "uuid": "38d5008e-2b64-4bcf-95cf-1c6d2444852a", "value": "ebf8775bfd576bd76542bc6390fe567f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7695bc5a-f347-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712319875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319875, "uuid": "c2da0163-a178-40e0-a53f-e3ee92c6fd8b", "comment": "Malware payload (Socks5Systemz)", "value": "ce940226f7474d08c76e33eb90fbe1c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319875, "uuid": "da93acb2-844d-41d6-a4cb-e5ac3559812b", "comment": "Malware payload (Socks5Systemz)", "value": "224d54592663f9d211560fb295f3d21bb1297476a8d8df637a57a3abf7202e41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319875, "uuid": "e93f2bf3-2d40-44d4-9cc8-2fd4912cae1a", "comment": "Malware payload (Socks5Systemz)", "value": "9d8048b354fe35928f1644417ddf10e07f324730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319875, "uuid": "420dd1e5-c657-48e3-a358-af6e543fc7f0", "comment": "Malware payload (Socks5Systemz)", "value": "b7419f62b23659c5a3323444187777b6268460c1c1f5afcca53bd0faabc4c432e5a725eaa1f88dfaa1070ff34d2fd1de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319875, "uuid": "5d73ec20-4118-4973-8fb8-22b9828b1d51", "value": "T17926126479E8E213C77FDAF2B94588F968751CE73792013D2E66B3258074221BCDEC29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319875, "uuid": "6e1e017e-f05d-46bb-9f4a-6cf7d52ad08a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319875, "uuid": "072b3caf-da92-4a08-b49c-80bdc1e6a61d", "value": "98304:0SI4rYV6G4uk6xZl8HgL2bzAUWs9FrytU151wOxj4Qxu:6xVv42lYNJ9FrydOxUQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712319875, "uuid": "757ea868-913c-46cd-b778-952aad0b31e6", "value": 4495940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712319875, "uuid": "21c71f84-cb5c-40c2-bdab-59d312a14abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319875, "uuid": "86a79336-bb66-4e87-9e2d-b84f50b7e957", "value": "SecuriteInfo.com.Win32.AdwareX-gen.1086.7459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d86a90-f31a-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712300711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712300711, "uuid": "9adb287c-9078-4e5f-be07-123f512dbd4a", "comment": "Malware payload (DCRat)", "value": "80f06c00d25085998f27d18e82934b12", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712300711, "uuid": "5db08b62-341b-4d8f-909b-3213dd5a14b1", "comment": "Malware payload (DCRat)", "value": "22f35d966047a62dc20a69adec57097091324dc0b2a6a433e056fb837422f626", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712300711, "uuid": "dbb1601b-ecbd-4ec6-b155-69eeb895f38f", "comment": "Malware payload (DCRat)", "value": "100c370ba02bbe3b9a19554d1179b1af1c5d4fe2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712300711, "uuid": "f60b1b94-b455-4974-b95f-23608e751af8", "comment": "Malware payload (DCRat)", "value": "b9c588a25f6e4b7107068873a335332c688eae7a6273fe26933cffdf05d977e6c301256a8df0d8cd3a6ff886405d63ce", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712300711, "uuid": "00eded47-633d-43bf-93bf-230cf6d93ef2", "value": "T12405D5027E44CA11F01D1233C2EF454887B0A9516AE6E36B7DBA376E59123A73E1D9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712300711, "uuid": "87fe7bc6-83e8-4af3-aa3d-d5a94a38d545", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712300711, "uuid": "2f2f9d9c-7e1b-4e07-a184-3f9ffca67337", "value": "12288:R4dkdOh0oS8EkLY3psh6bG9TA1nx3ZLaZBniE:RxOh02EkLY5sQqAjQZBnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712300711, "uuid": "e4e35ae9-5146-4c6e-96ec-0163adce8431", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712300711, "uuid": "616eeabd-6bc6-4f83-a0e3-af30c5551572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712300711, "uuid": "8703cb6a-565f-44fa-81c2-3575eecb8679", "value": "80F06C00D25085998F27D18E82934B12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8970f0-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343990, "uuid": "6be3c225-cc05-48d8-a4bf-993023197155", "comment": "Malware payload (Socks5Systemz)", "value": "cab09f807cbc57eb1f033f156ccb85ec", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343990, "uuid": "ef9317d0-7bdd-416f-864f-59eb64515f91", "comment": "Malware payload (Socks5Systemz)", "value": "245c68913e0db38315f9e38144006b88bad8352ddfc7edebe8728873e37fdd92", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343990, "uuid": "4246f609-a341-4bab-a653-0e24ca89130a", "comment": "Malware payload (Socks5Systemz)", "value": "1190df27c133691904cb573a8f8686759da3d86f", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343990, "uuid": "997f1ce8-3102-4361-8d26-3a7a719ccb10", "comment": "Malware payload (Socks5Systemz)", "value": "b478a7c96927c0216f9d7f238174d8270089b82044890a69670a1c03997ff1aaed7152f8d8d0f322f5bb5e79709cc9a4", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343990, "uuid": "f441811a-cb3d-43d4-86a8-ec3875ddf50d", "value": "T1BFE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343990, "uuid": "aa085186-b604-4da4-b363-208cb5935722", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343990, "uuid": "231637cf-6933-4a86-985c-5dc3220557f8", "value": "12288:HjsgiZdvAeRw9+aIHr50cCt8BqewcvpWwnimjRKLiTOkIRpbHdYkgiIjcBDQg5E+:DsgwdvAEPL50cCt8BqeBvpfnimjR+iTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343990, "uuid": "fb28ffa0-35ba-4d13-85bf-452b1440e799", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343990, "uuid": "f3eb7ad3-91c3-492a-ae71-517a5d8bdfcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343990, "uuid": "0e7c1750-911e-412e-8039-b9c693d47eb4", "value": "245c68913e0db38315f9e38144006b88bad8352ddfc7edebe8728873e37fdd92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4218cf2-f370-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712337614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337614, "uuid": "e67de310-5999-420b-9ab6-9c487aa01646", "comment": "Malware payload (njrat)", "value": "2fb7fc0949aa14070e5e5d1ec37d48e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337614, "uuid": "9eb1d321-e118-4626-b105-fd293d7c1059", "comment": "Malware payload (njrat)", "value": "246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337614, "uuid": "3e5195e4-742a-497c-b5c5-872c50fd19df", "comment": "Malware payload (njrat)", "value": "9b0043790d9881f690e11086004d3218648d9c22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337614, "uuid": "5223e48b-2b95-4f49-8978-b9dd7c111fa4", "comment": "Malware payload (njrat)", "value": "189e7aeb7b71cf8acdb01543157f0761a2848d5d4725589be3a6b3f674f7bcbbb30235d121367afe4af9113ac87c997a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337614, "uuid": "e4040bd7-5e49-485d-a026-98bd0add453e", "value": "T111634B4877958A55D2BD2E7844F296518730E50B6D03F72E4CD120FBABB3EC44A82BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337614, "uuid": "892d301d-1365-4436-8a1e-bb7cc2e5cd31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337614, "uuid": "f9c41488-6128-45cc-9aec-0a6c8093e9c7", "value": "1536:FIkoUoN36tSQviFw1gnRuBnvbLfLteF3nLrB9z3nNaF9bIS9vM:FIkoUoN36tSQviFC08BnHfWl9zdaF9bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712337614, "uuid": "c51cd667-781e-454f-bf77-dde77078161e", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712337614, "uuid": "bac6ed1c-6072-4a5a-a42a-ea624022ad60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337614, "uuid": "d92f2b99-13ee-4462-9abd-e1e7a314fc8c", "value": "2fb7fc0949aa14070e5e5d1ec37d48e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbfac7a-f346-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1712319269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319269, "uuid": "2b0b0dda-8aeb-4be8-9302-5a3d16e8aeca", "comment": "Malware payload (Smoke Loader)", "value": "7b09acb6cc6425fade98408ec43bfcd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319269, "uuid": "b35f66c3-28fc-455c-b388-310b6a6d1113", "comment": "Malware payload (Smoke Loader)", "value": "261fdc86bd8ccc62299a6f57194d59167a751f3b8b8649f8a252d39ca3a31226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319269, "uuid": "1c7a7add-f706-49ca-a705-f31e8a12d080", "comment": "Malware payload (Smoke Loader)", "value": "681ec6f05ccc78aa5e519b1fb13cab4455fb2638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319269, "uuid": "b1935f81-4a72-4ff3-bc67-cdc220d5b69c", "comment": "Malware payload (Smoke Loader)", "value": "1ea6848a9028eefc36a12c809aa175ed96ab8e67c695c8a4e3431baea25b47ed8df4c3b0eb14fe659d9914f46f8bde2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319269, "uuid": "1fdab8c4-16d7-40cf-8629-a4301f9cdc18", "value": "T1CD344B2176F5D036F3F39E305DBC96951ABBB8736A34818E26502E2E1E716C18E71723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319269, "uuid": "fbe369e4-ff35-4305-b370-dcf08afbc8e7", "value": "ffc72a0f439eb5b614c6c01a579e2049", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319269, "uuid": "855cb151-5e94-4941-889f-0b0733f61118", "value": "3072:/lWhcm24zbcZ87k2gW9YEBkWbnkxvWAhJ7MQUune3UUpS6eC2OiH:/Scm24zbcZ12gXEeWb0/n76EeEaS64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712319269, "uuid": "3a721fe5-8f0a-4d6d-9fe8-15eb701e5480", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712319269, "uuid": "04f8ac7a-b033-49aa-89e2-3279610893f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319269, "uuid": "d5cf3674-b6bd-490f-af19-3b4eba50a692", "value": "261fdc86bd8ccc62299a6f57194d59167a751f3b8b8649f8a252d39ca3a31226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a9852e-f332-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712310663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310663, "uuid": "20d88873-5ffc-4656-b81f-eb6e6837e21e", "comment": "Malware payload (RemcosRAT)", "value": "4a55080ea22461dbfd69c2165b8b2a6a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310663, "uuid": "007aca3e-a0ab-4333-922c-97e164597f99", "comment": "Malware payload (RemcosRAT)", "value": "264d6866d534205d35dcbbb2e5f031440f5580ae97d0eec657477f957039126a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310663, "uuid": "d1c9aa0f-a728-4fb0-8de3-67f99c75035a", "comment": "Malware payload (RemcosRAT)", "value": "2bfdf95aa43808a65019537d56e4d4e60320f387", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310663, "uuid": "5e81c884-9d98-4f45-8b5c-65a870bd6905", "comment": "Malware payload (RemcosRAT)", "value": "1d1d8a6a9ff133faf065e74dc8fbbf7e2b7f2b49e265a49e96dc894e23c5c17dd3f5066481cdd8de68e45e408efe51d6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310663, "uuid": "5912dd5e-cffa-4ce1-bd68-4bdb8a62f4a3", "value": "T1DB15334AE75BA9D84D75DB22E861FDA34388A7C85D530F1CDE0C4A62C3DAD989C8DB04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310663, "uuid": "b4aa1b61-017c-41a2-a6f0-3c668f8f273c", "value": "12288:X4ynNHf0BgAYUpjKwQD2Ha7VL8UmLXl8sJnmAaugU93axXdZXQZgTtzqI:X1nxIY+jPa7VYUmLCsJn5auB9atrXQMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712310663, "uuid": "a3fd7eb9-8657-404f-9cb3-05436fabd28c", "value": 882702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712310663, "uuid": "cb61222b-a8ac-4297-a701-c74c6e8b61b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310663, "uuid": "81f0fabd-c32f-4484-9195-29fa96ae3a0e", "value": "TSTS 0005A.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab589171-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309655, "uuid": "cbb582be-b425-4859-bc60-d36337d5a17e", "comment": "Malware payload (Gafgyt)", "value": "d19d2e4beba0ec92df17f4c4a1424298", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309655, "uuid": "aead1ba9-3b3c-4a81-a56a-e18408084735", "comment": "Malware payload (Gafgyt)", "value": "264e032e50776901e1e42961fc7896dd5aa675591c40ab5b0401369f0bcaa58b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309655, "uuid": "e78304cb-9265-418b-b7ba-77604c5e674d", "comment": "Malware payload (Gafgyt)", "value": "4631f2e5299bfa6fde80f7133c4570dbd0824669", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309655, "uuid": "5bd80198-1e35-4214-ab53-64e72094f072", "comment": "Malware payload (Gafgyt)", "value": "c651199058d737049d1fa7108022a38539ba2d1a46fb3ffe5588c18feb82acb4ccecb8a59b99245ea34babf9eb351f1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309655, "uuid": "36d3101a-8786-43f7-a671-f9772bdc661e", "value": "T10E14A53E7D22AB7EE268863107F66F71DB5511E333919392E13CDA149EB128D188FB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309655, "uuid": "7208d3ca-3d29-49ee-b637-ff9876ee66c7", "value": "3072:SPdRvcD35SNko5hqMDcb70hmv8Aqx1BVnKoe:eApFo5hqMM4hmv8Aqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309655, "uuid": "ac974f41-f91a-4fb0-8216-6fdc12f63186", "value": 193683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309655, "uuid": "980b43cf-d929-4508-a3d7-152560c3a35d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309655, "uuid": "9b713b63-8ccf-4fa8-819b-6bb2e938c4a9", "value": "d19d2e4beba0ec92df17f4c4a1424298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95615f8-f2ea-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712280070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280070, "uuid": "b9aeda5c-b6f3-43de-ad6e-7d9da0c50df2", "comment": "Malware payload", "value": "cce2bea605b6a3bc5305f7d7e658ae7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280070, "uuid": "3b20ed56-f3d7-4112-930c-421c9e305861", "comment": "Malware payload", "value": "27bd1b526e61d1c226e8ab83982a560acce30922245b7f20c4e2fbd60cf8c097", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280070, "uuid": "9c42d742-03da-407f-be62-fcb00c5ddf04", "comment": "Malware payload", "value": "94f073b7c34daeccb1cee41df32d9277f0853bf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280070, "uuid": "cd612e53-22fb-4fb7-85ef-8135264928c9", "comment": "Malware payload", "value": "f74315fb244bfdf769d7089c40f090898e1f896bea0b774fb759263ddc9fcb53e5c66f558d87126ac6921915cc486b6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280070, "uuid": "883baf61-8ea8-4596-8104-dc361372abbe", "value": "T15023F195FB298EB3C721BDF20B6E99332C4E3564D5864E8C5B81721697C3CC51206FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280070, "uuid": "22b41811-6f98-4aa9-bdb8-38f843855b35", "value": "768:WKqS/RCs+idKVm2iBxsC/38o1JsKJGFwVuhCQaIgO5QJAgWnOoeBIIwbROPEUGJY:WJ8RCs+idumRBxr8oDWFMJXgJgWBeBjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712280070, "uuid": "bcbc120f-89ef-491e-b6e1-3aff2f5111fe", "value": 48672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712280070, "uuid": "1a530480-a6ed-4aab-8c8d-49ebec01b9df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280070, "uuid": "08029024-a1af-4272-95fb-084c3b5dc881", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.24416.23176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83e4ab7-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712325246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "0f0f8162-f40e-4deb-b324-8c49a17566f5", "comment": "Malware payload (AsyncRAT)", "value": "a9603fc56b10d09f3940349b665cdbbc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "50dbaf7a-9fa1-4fa4-a6b4-5a5cb70f1fdd", "comment": "Malware payload (AsyncRAT)", "value": "28b981849caeac372392e0f2f9c16831142504afd8f9f7a2f24a299a37d0a1c1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "608aa379-a98e-4a71-8b78-5ff603793e5e", "comment": "Malware payload (AsyncRAT)", "value": "2e2a600c79da9680abd39550405ef262c35b506b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "cc32f254-4464-4575-a289-d6272a2d49f6", "comment": "Malware payload (AsyncRAT)", "value": "b16afa456334281ec6cda6e187898b42ec1472a2b15a00f35dbdc0c8fcfed54f5d6cdca7e8f54c43fa4266d8c4e92876", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "5e310f45-e227-4794-93d4-84ae7c09b098", "value": "T129343A143BE94894F37F8B30ABF0706E46B1F463A919E27E198658C80F72784DC51FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "25848e04-a504-4914-82bc-a4726120a53e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "3f28984e-1b6d-4618-b91d-bbcf34a348f5", "value": "6144:ll3RR2fzjGrMbyddEP1cnyZGbnZxhBI+o5+:NRxn7Eyyk35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325246, "uuid": "eb6f45d9-fa35-4f7e-8ac0-24fb70c59c28", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325246, "uuid": "ffcde546-a954-4aa0-81ac-db561e0fe25d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "40f32313-f271-4544-8398-bd3e0a0cdd0c", "value": "1712325245cf26975c853294d18539147159b303dbdff25678469a6186ada08a8ef5378408168.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91605a0-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283935, "uuid": "70eb06f2-ec81-4b8f-9098-f7d94227d041", "comment": "Malware payload (Mirai)", "value": "74e8fe06542ece9c8cdb7de7bf1a54f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283935, "uuid": "8d0623d8-b607-447b-bd30-b001a0fa3129", "comment": "Malware payload (Mirai)", "value": "28cb158a5a52017c5db160fa8e8abea602bc2959e21ee9308e54c144f6b9bd1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283935, "uuid": "7c46cecf-5994-459d-8c2d-295236eef86d", "comment": "Malware payload (Mirai)", "value": "56a96dbf0adc2c527533a73635b0b2d5fefe0e89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283935, "uuid": "203b21cc-3166-4984-8d4a-eb64758e2841", "comment": "Malware payload (Mirai)", "value": "7f12d6be28932394cb35d2c7ed0393d806fa15c8fa048d52a53eda626f70724abdf5ef6e2f4199c72c648837886c2da1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283935, "uuid": "0a2c3670-a75a-4e36-b4e2-0774b05a6694", "value": "T168930856BD819F11C5C512BBFA2E018E331357ACE2DEB223DD106F20B7CA96B0E67456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283935, "uuid": "a11f61a2-9d97-440c-9f44-9cf645e48724", "value": "1536:g+nivkMS7UIMghBa6T+uJcg/JbWcs3CXatKeoDSfM7iph2ChevpzV5oYCwbZnIx:I8rggCkjpVsSXadh2ChevpzVu3wbZnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283935, "uuid": "c8afa431-5e64-40af-a5f5-af0b0d735736", "value": 92404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283935, "uuid": "9836a311-b20a-4b24-a1eb-b807208e6633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283935, "uuid": "4126760e-0c70-41bb-b16c-79293733d638", "value": "74e8fe06542ece9c8cdb7de7bf1a54f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f62ec4-f34d-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712322635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322635, "uuid": "e73f5d0a-f25e-400e-86e6-7c8bb3b1dd66", "comment": "Malware payload (RemcosRAT)", "value": "10a4cb3233c444bcf6211100ab9bad9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322635, "uuid": "427dd33a-3a98-4ddf-b364-8ebee7d3f280", "comment": "Malware payload (RemcosRAT)", "value": "2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322635, "uuid": "5112fc7b-31a2-46cf-b561-18417f77a5b4", "comment": "Malware payload (RemcosRAT)", "value": "2f4a679479fdff9d22226676d7a7eacab84311eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322635, "uuid": "868afa1b-8598-46da-bb3a-8a511eddb731", "comment": "Malware payload (RemcosRAT)", "value": "bad8fdb3bf695299826553229c9a521cf1447ebbea5288376b143e8c7a441e1f4c114520b100b72e90abf22f70aed83c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322635, "uuid": "d4634150-f9a6-48b3-9136-ec7d57a35ffc", "value": "T1E3C4F1A2BA0BED85C49946728CA6551012325F8E54A7D60E34CD3F2B7B733D32CC9E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322635, "uuid": "51238b1d-ab0d-4755-8482-87e82b17b4ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322635, "uuid": "d14fbab0-585c-4de0-9da6-b94807f47f02", "value": "12288:FUH8UsiMHGMZY/QZsg4rvpvK9+uH2OG/4RY+ajkrSyxPln+07bSsEAmD:yH8XvHFA6sgyvxK4uHBLRPaArSuPl19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712322635, "uuid": "ab200128-25a2-4939-8fe9-46134b4cf5c1", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712322635, "uuid": "2643148d-3b3a-4634-ba3e-095df40bb148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322635, "uuid": "17fd3e39-b8da-4544-86da-a455e060d8c6", "value": "GST e-Payment Challan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db2a1bf-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343992, "uuid": "6de28800-5533-429c-bee3-95829175586d", "comment": "Malware payload (Socks5Systemz)", "value": "93ed6c98fa3e838dea63f606296ee928", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343992, "uuid": "d7876394-a89b-4059-922a-5926c2197128", "comment": "Malware payload (Socks5Systemz)", "value": "2a15b7e64354d568dcef6e9878a27e62b301b7850966a18160dc1b3193dd4fa1", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343992, "uuid": "add4587e-3377-4b37-848b-7936588c7398", "comment": "Malware payload (Socks5Systemz)", "value": "6933065ad5864a4faca163c698ded932963fab71", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343992, "uuid": "41e66c5e-31ec-458e-941c-b77cc1361153", "comment": "Malware payload (Socks5Systemz)", "value": "4af3a242f668b63caa37627f201d7b1525b571bf959f7f07d6a0b39afc82bf66d2c64993af8937c46013d66868541f25", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343992, "uuid": "9c045dfe-c51e-462b-9174-c77ecde84a60", "value": "T1D8E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343992, "uuid": "6b46f55d-3c55-4f26-8e4d-d1ffc6f95038", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343992, "uuid": "b9efb935-64c2-448f-b107-b3f1cc71e6d8", "value": "12288:sjsgiZdvAeRw3+aHHX50cCdOBqqecvpWwvomvRKLiTOkkRpxHTUkWiIjcBDQg5EK:6sgwdvAOw350cCdOBqq7vpfvomvR+iTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343992, "uuid": "6d8a59bb-60d3-45c4-9242-376dd57a5e11", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343992, "uuid": "4dfd3d18-785b-48e5-a2f1-56ad39afd26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343992, "uuid": "39829079-def6-42e1-aa8d-cbf3f6f720b3", "value": "2a15b7e64354d568dcef6e9878a27e62b301b7850966a18160dc1b3193dd4fa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f939a7d3-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712325248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325248, "uuid": "55e2bd9c-5900-4ad7-a6a0-e9e73b6d0c1a", "comment": "Malware payload (RemcosRAT)", "value": "8a8291aa1f1744763e496b5a609d766b", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325248, "uuid": "148c9dab-e173-4198-84ab-0641b8e09c8a", "comment": "Malware payload (RemcosRAT)", "value": "2d35feecb9b427d2f48f6fd0dd5ef71eb7ba75fe024d7c6f9067490bbabc3c17", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325248, "uuid": "7b79a0e9-cb37-4d54-8e25-706b021d7a95", "comment": "Malware payload (RemcosRAT)", "value": "4dc953163aafdba67a39d42e22ba82d55d729561", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325248, "uuid": "fe933f02-9943-48b4-9f27-14f9ce63953f", "comment": "Malware payload (RemcosRAT)", "value": "df4d9b1fdecba0ef2694469c781e5087ab26c3262a2e02f77e2eae0a55455f7ec725122d43f970462c21fc89f4e2bc07", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325248, "uuid": "0ff39739-2761-498b-8acf-e6075fe91baf", "value": "T142B49E01BAD2C072D57514300D36F776EABCBD202826497BB3DA1D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325248, "uuid": "6e7ac62e-07c7-4199-9fee-bea15ba65e32", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325248, "uuid": "1336972f-f714-4656-a3fd-0e2847f7c299", "value": "6144:m/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7W7ov:m/uPq3AfK496Gw0lwGXN3pvs/ZuL8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325248, "uuid": "e77271f8-6e2d-45a9-8063-5e261052d814", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325248, "uuid": "09b4be03-fb51-4f59-866b-d44256a18c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325248, "uuid": "b3ba44da-8566-4574-bfad-dbb22d198285", "value": "1712325246e9ef467ca10a8bb47cc22f360faab318b2059a09a5a7d0c76937a79cfb2a74b2831.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e52dfca-f31c-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712301285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712301285, "uuid": "736a14ee-a997-44e2-87f8-a6fa3175dcf9", "comment": "Malware payload (RemcosRAT)", "value": "0c1eb2f8168941dc911360995e8b200c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712301285, "uuid": "bf09aebe-cdf0-49d7-a19c-391a7de287de", "comment": "Malware payload (RemcosRAT)", "value": "2e7aa640b2da6d9350afba1b8ad0b65bc85ac335dde42f08cd540da8580e2a78", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712301285, "uuid": "06b34e26-b6d9-4abe-bee6-03a7ff5b6160", "comment": "Malware payload (RemcosRAT)", "value": "cf7debc68f2fb503b92089b3dd1c065b93352854", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712301285, "uuid": "a1c6529a-6241-45f0-a90a-376c4624c776", "comment": "Malware payload (RemcosRAT)", "value": "fdbda9b85b2f2e2c8a6afea602de4bddfa0ebf852e49e3178b5fa8a5b3bd448be3dd24dac110d9188053d8a5816b5064", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "UAC-0050", "colour": "#DFA6F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712301285, "uuid": "40468feb-283a-4089-bd69-69c908740d08", "value": "T1EFA2BE154BF60F14E6F7AA7C58F6D7018FA2B5C2DE224F8D03550A296C2D610BC24F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712301285, "uuid": "d9aea51b-904b-44ec-9bed-0785d6e45053", "value": "24:8znbWJoDyRu6Knk1WTjA+PWaKBxKV67wTyn68A07aYVFab/Bne8m:8wnR0kogCKBMVtTynw07LFabBne8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712301285, "uuid": "9814b159-b6ab-43bb-b201-53bddcbddf30", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712301285, "uuid": "127f2716-f735-4166-bc66-516d61d59696", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712301285, "uuid": "192e166e-8df1-4a21-ae7b-85b1e95891e7", "value": "\u0424\u043e\u0440\u043c\u0430 \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0456\u0457.chm.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c619dfd3-f34c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712322156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322156, "uuid": "83ace584-e385-42a4-b06f-c16f09cb162a", "comment": "Malware payload (AgentTesla)", "value": "2a20889a43dc03fbe3e2ff083fb57284", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322156, "uuid": "ee59fe02-f76c-4b53-8a97-4b5d6ebd4505", "comment": "Malware payload (AgentTesla)", "value": "2fdefe874a54576e8a4f4566b328120a7163a47b1000af443683af41698b6b2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322156, "uuid": "424b8487-0197-40f7-8b4f-4f26883fe857", "comment": "Malware payload (AgentTesla)", "value": "0c115591d0b900f3bcfa7914865157ce3b5e8487", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322156, "uuid": "6de846e3-d5a6-4aa1-8f4c-131378b39f71", "comment": "Malware payload (AgentTesla)", "value": "5f59a4bdcef705d192883709ca711cbe3d141f20ef8b8f652f84094c982c30c6b7a6e1f1bbbd4adda5cbc5c35708e3e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322156, "uuid": "31e4d224-f1af-4c4f-87e5-221497e326ce", "value": "T15D259D0273D1C036FFABA2739B6AF2455AB878254133852F13981D79BD701B2273E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322156, "uuid": "07729fad-3165-4e20-b786-64b9a61a7d4a", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322156, "uuid": "9f5c8b8f-fda0-45e1-8b3f-ddc6b8d85c8d", "value": "24576:JAHnh+eWsN3skA4RV1Hom2KXcmtcfGdSe9:Qh+ZkldoPKsacfGdSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712322156, "uuid": "a608f9f1-9bfe-455e-9bf7-c2e34eefa99e", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712322156, "uuid": "13c74ce3-604d-41b8-b4c1-001820288c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322156, "uuid": "adbb5f04-af0d-41ea-bc7c-a795ad53eb86", "value": "2fdefe874a54576e8a4f4566b328120a7163a47b1000af443683af41698b6b2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700fcee2-f340-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712316857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316857, "uuid": "6f693e20-90e4-4b0f-b3bd-890a841fa31c", "comment": "Malware payload (AgentTesla)", "value": "662450158332fa0f59d7c02ab287f238", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316857, "uuid": "448f6bc4-af8f-46b4-8e4a-71b535c3d532", "comment": "Malware payload (AgentTesla)", "value": "30c6714b8a8c33b84499233e04217c71dbd512653e356cafe2004dc9a9e8f4eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316857, "uuid": "bfd38deb-3395-4d9c-859f-3ffda388afe1", "comment": "Malware payload (AgentTesla)", "value": "901e46a8bd27e0afdc51db09ec950a66f9ca2455", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316857, "uuid": "7a6ce3a8-65ae-4ef5-8d2e-6f9927e6a9cc", "comment": "Malware payload (AgentTesla)", "value": "40b69aac32d2b380fdfbb2eaff17854d206b5ef9858782d8a6c07930a2420263eb2daf8aa7ad99673d22b40a8f32592e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316857, "uuid": "adc2eed7-20e9-4c7d-a56c-739f086f616f", "value": "T15E45CF0273C1D062FF9B92334B5AE6115ABC79260123E61F13A81D7AFE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316857, "uuid": "05e50646-112d-48c9-9624-55f1fb2895ba", "value": "cc2b3e63a50ba98c3412285dee7a8f0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316857, "uuid": "79b435ac-c553-44f4-b1c3-dc59d7db477c", "value": "24576:3qDEvCTbMWu7rQYlBQcBiT6rpFd+z0dfhMbDq/p+MlNqbFuUc:3TvC/MTQYxsWPkz0D/pTfqbFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712316857, "uuid": "dd549391-6261-4caa-abc4-75988fb4c43d", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712316857, "uuid": "bb1fa2e7-6b13-4c5f-823b-e387dc59d54c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316857, "uuid": "0c15c704-7997-426a-87fe-ecb8dcbef6b5", "value": "30c6714b8a8c33b84499233e04217c71dbd512653e356cafe2004dc9a9e8f4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bc3e7a-f343-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712317971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317971, "uuid": "5f13e1f6-7aae-4acc-b4a3-84bcaff1f093", "comment": "Malware payload (Formbook)", "value": "bcf98f6539e74de83fa0bc3e484cb393", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317971, "uuid": "c2c2fdbb-b59a-4878-9c85-a96657427a99", "comment": "Malware payload (Formbook)", "value": "3119184e0f7f16ea722815664c03b4158467a4593d303811bb788d44d16cd475", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317971, "uuid": "934eb015-7348-4cbd-a95a-18787ffa68b5", "comment": "Malware payload (Formbook)", "value": "47c4ed520a10a20d1e67146952e44a40d6e73ed7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317971, "uuid": "422e1a1c-40dc-4496-aa6a-4c413dfdea35", "comment": "Malware payload (Formbook)", "value": "802cfc719c44768369b6cf8d6f511bc9be37caf7cb5abefc767cd85518ca59f220e3e45db76b901c67714b15d908ab5a", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317971, "uuid": "1e9a2f45-1b06-4e74-a09b-25efc1db0457", "value": "T19336E8E339FD278617053F5B974FB5940A1FFD394BF26AE440C72588014A68B29A09EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317971, "uuid": "2a6fc0ea-e731-49e6-8454-4e2bcd25f3ec", "value": "49152:9ezOW2/puR1S5LyWb55JBnZkRidEiXTqdiMTOciC1UMIrVu6zYDMJhlJ48pDug:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712317971, "uuid": "192ffd48-f981-4358-964a-9acf276e0a7c", "value": 4945728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712317971, "uuid": "c56a0cd6-8089-4e5d-a531-9f2a10fb7177", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317971, "uuid": "6a553ce9-617d-4fe1-b9c3-4b992cb73d6f", "value": "CONFIRMATION ORDER0.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1838ac3-f35f-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712330362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330362, "uuid": "4b44006e-39f4-4cd7-bf7d-3a12ca3880c3", "comment": "Malware payload (njrat)", "value": "4e957eb61227f3df7ec272c3c9633f09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330362, "uuid": "672d889b-2ae4-4e36-9808-b86d73d399c0", "comment": "Malware payload (njrat)", "value": "323b929dfecc1ad83c951e2ade801749abeebca666e77ec11672930a6e44d4d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330362, "uuid": "57de9e75-a631-4394-8205-702175c3ddd2", "comment": "Malware payload (njrat)", "value": "d20faa895b5828f60567acd9736cca5d54d4fdb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330362, "uuid": "8615577b-07c6-43b4-ad78-14171b75a4df", "comment": "Malware payload (njrat)", "value": "223c0146da4ba97e9584cdb1ba1a29ff9b807554e081af58c3c3e22c3360adcda905d90229c49e7bc490397f358356e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330362, "uuid": "1791aad6-1dd9-4b11-bd7d-59dc837a7585", "value": "T149E2084A77F54215C6BC1AFC8CB313214672E3878472EB6F9CDC88CA5B676D04251EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330362, "uuid": "b90e93d9-9ff8-4545-8339-f04757e2d879", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330362, "uuid": "838fb668-77f1-4104-b858-fd29ab786a7c", "value": "384:d0bUe5XB4e0X+OJwQq1pvmufCsIsrWTDtTUFQqz9DcObbN:OT9BudOQqvvmu6JabN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712330362, "uuid": "e62e9f9a-14fa-4706-9eb9-9e6e675bd5a3", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712330362, "uuid": "48eb4725-ffd8-4c54-af61-396c2c02c1de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330362, "uuid": "bedffaa4-191d-4bcf-b836-64a74ccb8e97", "value": "xHEumhtjdfiG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2091d780-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712321019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321019, "uuid": "f81a3140-6773-4fbf-9647-9f44309d4fbb", "comment": "Malware payload (Mirai)", "value": "c1b12fc2212bc4d4191a2d4f89255ee5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321019, "uuid": "1a9e5fcd-43d5-4a3f-83d9-8b2f7918e795", "comment": "Malware payload (Mirai)", "value": "32698c1b81b6358025aea891b5d204b75029986b0fe5fb04856b0c51e57e6739", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321019, "uuid": "c9d3c294-9585-4deb-a524-d9c4964d22f7", "comment": "Malware payload (Mirai)", "value": "4e40752f589593cb4f2de84ca811c3a44205f93a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321019, "uuid": "f655ec15-7d57-4de2-932e-cbc6181936f6", "comment": "Malware payload (Mirai)", "value": "49e1eb05cb495a3260e299b633102e5cc4492d5baebddfae485affe2495b670b7225742d167ba51f81b400964427f528", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321019, "uuid": "4737b2a0-8266-4231-9f88-4d3fa84bc59b", "value": "T168B2C0CD60943084C98D7C7C5B8D4A664F6CA0D0BAED9B26E354CD98B3BEA4B385D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321019, "uuid": "095599ff-49ca-4abc-9d34-bc06926eda71", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpWZqSWvK:4QlS07FUXqIYSXQKqu6qS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321019, "uuid": "e8d84396-40b2-4e0e-bee7-f1edc9d1f225", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321019, "uuid": "e169069a-88c0-40d2-bc17-8b83d2ab4efb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321019, "uuid": "80921736-94da-4730-a3e2-3395623cd5aa", "value": "c1b12fc2212bc4d4191a2d4f89255ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05d26bc-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712323488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323488, "uuid": "a655cb51-f7e4-4bbd-99ff-62fb75ba256e", "comment": "Malware payload (Socks5Systemz)", "value": "9e45eb13dbf6923fcfe9cf240c55062a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323488, "uuid": "c0ad0bab-6f54-4d07-9e21-0a9371aad689", "comment": "Malware payload (Socks5Systemz)", "value": "32c17a77987a902148db02445c13fde9f55a4df1d669cf1b071f41d2c2aaa348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323488, "uuid": "544b32b2-9336-487f-bc51-c25f055bda4d", "comment": "Malware payload (Socks5Systemz)", "value": "085aa9c84d5b53738dfd13be9c1e32e879253a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323488, "uuid": "b8dddb87-8dde-4d8c-849b-cf7e3410ed1c", "comment": "Malware payload (Socks5Systemz)", "value": "8d907f23e4652c5ef93965473a314afa3f950fb2aadf357b375153d583d65deee5bb5e2e9f6b2b686099304e5e03b939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323488, "uuid": "9bab89c0-bb7b-4493-b9a3-acea1a742511", "value": "T1B5360214B66E414BE6366DB6A82E44B031652D7436ABF00D14E2B72E45F337808EF76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323488, "uuid": "4254d885-2628-4cc2-9af2-409b881fd917", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323488, "uuid": "112e167e-2b3a-408c-ba5b-457e0ffbb07d", "value": "98304:KAfe/foB9Xsp6ou7fPJ5Eu0cpa32gH/THwZ+DkO5UQrHC+ESj1QxU:6/foB9X0i15EBcpHgHLidO5TC+X1Q6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323488, "uuid": "b4837493-3175-4128-8892-0d2949c2a8cc", "value": 5132786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323488, "uuid": "0b6162e8-fadf-40f6-9d7e-26c1862411d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323488, "uuid": "3981dda7-c71b-4b9f-9406-467069906748", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.9416.12906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98ba6f2-f35e-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712329866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712329866, "uuid": "bbf3a3dd-5cb5-4c89-b08d-e6a13b0105cf", "comment": "Malware payload (RedLineStealer)", "value": "642edae675919da74bc135af133467a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712329866, "uuid": "37b5a513-e383-46de-8c09-19f3d407f524", "comment": "Malware payload (RedLineStealer)", "value": "35feec04d26790253e1ad9417d19018bc888dc9275f46f80d5ac95050640ba02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712329866, "uuid": "6e1183ac-5c28-4ecb-8aff-6c63c1547775", "comment": "Malware payload (RedLineStealer)", "value": "2560c68a54a347f888b3975857946328bd01833b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712329866, "uuid": "3ed8b07b-2dc1-425f-8542-c45696af46a6", "comment": "Malware payload (RedLineStealer)", "value": "45fa2a00168caeb8a1c694a524a550b36c9d05a42c5c7d20eda30456312cf9b48293e279480e1a85f41fb8187397ef2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712329866, "uuid": "af487feb-14e2-4725-bfc4-451b6ea7550b", "value": "T1C6642321D57FEEF8FDB00DB7D6223A38AAE17988A5C6CF9041721761B54677DCC26220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712329866, "uuid": "c0d73d11-63c2-4cbd-bf79-b3654464703a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712329866, "uuid": "1a9d89dc-ca80-4836-bb1e-d0f8844969fa", "value": "6144:/wL1Vv5XavvDlEVgeYKbNEYctcTvLNxkzhvyFg9yOpU6UXEiDzo/B8q47SGmcDm:a1uvkxbOTtcTvQHsOpU6YXA/47SGmcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712329866, "uuid": "6c14301f-3bc4-4a7a-8ac3-91639443b8e1", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712329866, "uuid": "0060423d-8b48-4b51-b589-b5220abc719e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712329866, "uuid": "b5bc6c39-83ed-418d-a2f4-962839e9be72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e4c4c4-f314-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712297969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297969, "uuid": "00f394e5-7d03-4ca6-a52e-423b67f06f78", "comment": "Malware payload", "value": "a12ad9819c41d45f7972421acb3adc6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297969, "uuid": "41039d60-98a7-45e5-8321-6249e03156d8", "comment": "Malware payload", "value": "36a797f391c0783883a1f2b1228fe668295247847f0949bf951dac72d9f2462a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297969, "uuid": "5b74dd9d-1ec0-4ca8-a70c-6756911f1259", "comment": "Malware payload", "value": "396a6734568dae7d107a476e0af0a9a86c323ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297969, "uuid": "9e7b2ea6-e458-4186-b2d0-a67506b18a4b", "comment": "Malware payload", "value": "cc1ca805785de5f5e799205075cb569e6baec438fc8f5a5216d047ddea18eba0a85144482e4433a644482f5cbd9b9c6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297969, "uuid": "d6e9e7fd-1888-4791-87f3-245ad1d313bc", "value": "T18C759E42F79184B2E642177911B7937A4E3A9E214329D9C7C7A03D719D312E2AA3F3CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297969, "uuid": "19d0ba39-66ed-4a85-876c-76132fe5af38", "value": "c96e0233459c080036bc796c54d51781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297969, "uuid": "b64e25a4-7839-4475-abb5-7a5408106c25", "value": "24576:2+4BD0Dv3z1UOFfPa3W40dIUOCIGxBkO4H/N7Q4p/Dt5cxSmku:Xkm71dfiGqUOCI6aO4y4p/bc8mku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712297969, "uuid": "ab0d8eaf-84c6-4451-bc8f-c1f231feca17", "value": 1572728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712297969, "uuid": "d66d3c42-6850-4da9-b574-707e80765bc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297969, "uuid": "69f1c5b8-2662-4846-ae5b-ce00b0560da5", "value": "SecuriteInfo.com.Trojan.Siggen13.11902.1474.19881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12856572-f344-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712318418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318418, "uuid": "5ad86929-879b-4ab8-9851-8ff72e8dc562", "comment": "Malware payload", "value": "0ba49c973a1fe57a0dbc1100d29a3901", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318418, "uuid": "0337ba84-b98b-4ff9-9927-3d6b8d63f045", "comment": "Malware payload", "value": "39aed1f4767684bacb251ed07618c5b80e33d4e8f297328bbe141eccf3ebf17a", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318418, "uuid": "5c51f016-00d7-4e40-a80e-695203ae46c4", "comment": "Malware payload", "value": "b72bba5e63ab3075eb664f617f14bdb72f715a90", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318418, "uuid": "02f6f9df-9d8f-4933-90e8-5033ace16714", "comment": "Malware payload", "value": "a5a6df6cabb5cb08634c3971fb38dacc0b9ec9ad78ff05170f2cb032233f8df167eef55122eb83a650c8f2e8c214282c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318418, "uuid": "86719564-4906-4a52-ba0e-bbf53ba14ba2", "value": "T14D727C16EA6DE4A9C36BE47D900E04E2760FA191DF546F4B3C10F64F0B845AF178B2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318418, "uuid": "fa50e0a1-ffc1-4004-bdd9-837314168db1", "value": "384:YD4wOpkXwHUlM9z6po4Eki1P4Qj8NRaM2xUK:o4wO/HxWpozki1PfwB2xJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318418, "uuid": "0d282aa2-f64f-43e6-851e-fce711c75980", "value": 16509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318418, "uuid": "5a276648-2245-4ce7-b994-c14fdf72c296", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318418, "uuid": "cf50d1ff-fe2b-4a65-8f24-4308a6ef2a97", "value": "Murat-Text.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bee0922-f380-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712344204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344204, "uuid": "ba531715-9235-4e13-9e7b-c9b508a5eab8", "comment": "Malware payload (Neshta)", "value": "56d9c5f6edfb5899453510d4024a3fb8", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344204, "uuid": "03f397ba-ae02-48c8-bd66-93d7dfa7103c", "comment": "Malware payload (Neshta)", "value": "3a4ef130d8ed109e53627e85e8f931c3f822933d4fa82921ae66191b99ab4812", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344204, "uuid": "d72b1249-bc3d-44c2-b99f-28b919fb4ffa", "comment": "Malware payload (Neshta)", "value": "54268878df40bd0b68f26253377628b3bf514bf9", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344204, "uuid": "646ca652-93cb-40e0-80a8-0e004f59d1d5", "comment": "Malware payload (Neshta)", "value": "6be217845c38d1ebaa9fc43727a7f52a5f0333907bbc826ebd70eae771412f6b98055f6d623df36228e351bc69674974", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344204, "uuid": "96ff27fd-3bd9-4bb9-858d-1a64ec2fc709", "value": "T145245B0BB3A521F9E1779A7CC8524502E77678350B319ADF03A0467A2F677D0AE3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344204, "uuid": "19010548-d81c-456e-b5df-c39b92d22dee", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344204, "uuid": "01c9cbcf-fc64-4481-ba9f-a26da7185a83", "value": "3072:sr85CXsD1fNIUzYMloo1SN6ATFaFPe5gadUgyBNnNAQesjk5FFmCQ:k9cD1f9zBloCSN6FgUgejf4kCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344204, "uuid": "7c6b6a6f-0c6f-41c8-884c-c58a49740173", "value": 218512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344204, "uuid": "c6094d35-5478-4005-8257-d4451db1d486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344204, "uuid": "f8787852-a0f1-4686-bf3b-cf84af644186", "value": "3a4ef130d8ed109e53627e85e8f931c3f822933d4fa82921ae66191b99ab4812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86ab835-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "a5e27a66-32b5-47cf-adb4-59535df9731a", "comment": "Malware payload (RemcosRAT)", "value": "10bdf4a0ad2aca2cc323434b00d89958", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "0a2a5bd5-5008-490b-87b5-59d52ed12df6", "comment": "Malware payload (RemcosRAT)", "value": "3ae2a8fcc969ec131e6ea2387dbdbdc6dd9ef216fc4a04990a403b7a38494778", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "76833d95-97f8-44da-bf27-00d022f4456d", "comment": "Malware payload (RemcosRAT)", "value": "784b8df8a32c7c08dbbb9116ada2f702e7abeb34", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "5fa5fe22-3e93-45bb-adec-4a86d52c370f", "comment": "Malware payload (RemcosRAT)", "value": "3f2043df1f6551749b98f3e5b28a10fac3a78a75984f4d058992df4e9efe8cff9b0602ef24ecf154be9fe131a1f587db", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "8954d772-0db7-4a42-b986-2d2b043920f6", "value": "T123B49E01BAD2C072D57514300D36F776EABCBD202826497BB3DA1D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "ce660ace-d44f-4419-aa9f-a8f9efb293bd", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "69b0d61a-215b-45a4-8e70-49cf7b892f49", "value": "6144:+/7iPrcL3ArwhBq7Kjsn9iHGXg0lwGS9MNNhdFvPxps9gsAOZZuAXec7Y7ov:+/uPq3AfK496Gw0lwGXN3pvs/Zu98v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "0dde3be6-3f65-4947-b056-588f532e5dda", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "b8a54924-391f-436a-ba05-708ca8b9c475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "ba7b7db0-50ab-4c81-bddf-c8f4bf7bfae5", "value": "1712325245c1981ac1f5c06e3e617f5748a4bb434927215c5320c0a22e2bb4bf1467044137929.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d64fbf3-f33d-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712315484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315484, "uuid": "3fcaa484-d750-4741-920c-af5d50087fd1", "comment": "Malware payload (Rhadamanthys)", "value": "d00d0e67c7d35c9a4abebf6de8313e94", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315484, "uuid": "bbd19c16-688a-4ea3-81a1-c04a2b070733", "comment": "Malware payload (Rhadamanthys)", "value": "3b9db9baa7abb0f6648f2ee6147486a9432e4c635d47a4b8e0202fb922106aef", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315484, "uuid": "5f13a2e5-c1d7-4940-bd79-9cad48a49f0b", "comment": "Malware payload (Rhadamanthys)", "value": "8647078e528e3cc30726b81c4a44e6f2e76598e2", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315484, "uuid": "7b61e5d0-a438-463e-80e3-ca0f8a4acdbc", "comment": "Malware payload (Rhadamanthys)", "value": "1c00f5a6fa86ce511a52a282cb21babb9cd878a48f6f812ad991165c4d500de2e88d4aee8316ad618a85aa163e8ae1cd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315484, "uuid": "8fd860d3-83b3-4b96-839b-668e229409e0", "value": "T1B7C2F14ED585D3969B87FBFC5DCD226464BC71382289241E6E11C9E01E60BCA2238E97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315484, "uuid": "6cfe0111-2702-45e8-9ec0-8caa86fbd840", "value": "768:un4Uy2i97Q/ZpkF5AkIEwdXNp5FH9VVatc+T:unorVQZOPAkWhN/FdfQc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712315484, "uuid": "7bf55310-5507-4bc3-a466-bc04a58475fb", "value": 26652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712315484, "uuid": "3f80315d-6aa3-409f-837a-d204100ded15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315484, "uuid": "c8c4336d-77bf-4080-959b-8c8a59df8002", "value": "DOC692-692692.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d619ee55-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712323471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323471, "uuid": "d68187b1-6150-427c-a0b3-3094424a4381", "comment": "Malware payload", "value": "9cf2da5e9633426dde8d0e352724e900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323471, "uuid": "0a9890cd-9290-48d0-bae9-e7b8999c2ade", "comment": "Malware payload", "value": "3c54ecbe78589837b81ad415d007f7c6f6f9a9a67ddc5a47b78e92e3700bfdbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323471, "uuid": "209e02f2-4d71-4ee2-af4b-2d809d861271", "comment": "Malware payload", "value": "114a529fc7224d7d1e58cac722b677187b0ce105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323471, "uuid": "96988b75-7c29-4440-b436-17c58f8d6458", "comment": "Malware payload", "value": "a6eec35bcb77c7f63036566e669436e895139bbc8cd818a68d0d856f643b5810d914d3e607fc78997f970bc971f34a03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323471, "uuid": "dcb6c13f-b3b0-415e-a80d-76375428fe80", "value": "T162152712E382C8A6EFF116B28664D7321929BD25973C85CB72D03D2EF9B06D1DE39315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323471, "uuid": "1d4a717f-7af6-4a49-b9a9-32850fce0e70", "value": "8d813561e4ad07e9f8918a83e16f95c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323471, "uuid": "94787358-cad8-4f28-907a-36772baa909a", "value": "12288:8o/S1H+npapwHMdeT0mWQGR6DeXXYZPCC+pjpfbdN5cXIWPf/:88w41MYT0mWFR6DeLC+pjJT5cXIWPf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323471, "uuid": "cec3dbe5-c819-41ac-a4f8-7f2d733758b4", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323471, "uuid": "692183cd-2293-49cf-933a-8f57e023d390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323471, "uuid": "743bcc65-3da1-4260-90ce-e699f564351b", "value": "SecuriteInfo.com.FileRepMalware.19133.7219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85291e8e-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712309591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309591, "uuid": "b34ba261-d6a4-4896-b008-b100b86b68cd", "comment": "Malware payload (Mirai)", "value": "b47dd44bb52a05fc30a87dcbf87f9535", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309591, "uuid": "824b0ccd-24cc-416c-bdab-61363db407e1", "comment": "Malware payload (Mirai)", "value": "3daa7c9df01161a5e7481250b94e0972c673b8d16c8467e1e318b11a950df342", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309591, "uuid": "46412c3a-123a-42bd-8716-29a3924c0c6c", "comment": "Malware payload (Mirai)", "value": "919b5af26d8c184adafbe1e7a68b2b8337d2bfd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309591, "uuid": "b4bb2cb1-9628-462d-97c2-fd73962d7b46", "comment": "Malware payload (Mirai)", "value": "0f755faf3201252b3c6a871893963036ca85d55a94d45225b390bcc9353d4b5dd8d99e69a7d8cb88bfd8e18988fb332e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309591, "uuid": "5e1dc645-8f34-44f8-a695-ebe4373228e0", "value": "T17223F1539BEC8E4EE5BE513A00BB7E57B500D09DF02CC0543F9272918D8A27E7669763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309591, "uuid": "64d2e335-b929-4552-8c02-387722dfff22", "value": "768:HLT3VzAEeKDeQf0AeDVIlHfxu9DBjhrgl2p/CJe48QLBnbcuyD7UHQRj9:rT9rSQf0rDumhYkSlBnouy8Hyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309591, "uuid": "149fe992-865e-490a-88ba-e6d60d93bfa4", "value": 45632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309591, "uuid": "05f19492-59f8-4fcd-bb3f-e7b274ccaf91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309591, "uuid": "b5c22e45-3ebe-46e4-b934-a61dfa60f265", "value": "b47dd44bb52a05fc30a87dcbf87f9535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228fe676-f344-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712318445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318445, "uuid": "473b7948-4573-4990-82a7-818865fb4dfd", "comment": "Malware payload", "value": "4213dc9e0afce94d7f805291b4557452", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318445, "uuid": "4a4c381e-2867-4cf0-bb31-640734a8eb2f", "comment": "Malware payload", "value": "407123b35bf08e7b25a87f9dfc65bd831472852206c3e2927073786e6c5c606b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318445, "uuid": "43f2d0f7-f3d7-4145-87eb-e2aaa2c2c9ff", "comment": "Malware payload", "value": "343f0f11293edcb294614d8a9e13dca0a4d8f208", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318445, "uuid": "839379e9-ed0f-4696-aedd-0bfab1e88ee1", "comment": "Malware payload", "value": "2538680032f17c7967e86d553cc6646d01a0069a657dc7a8897660ba401f889830b41277755be90b5ffc0ab578ac3cf2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318445, "uuid": "d8551bb0-7fdc-4477-b8d9-df433ba21153", "value": "T194B2BF64D079E82AC62799BE500D00F6725D9290C734B74F3810F9EF0796A7B139B1EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318445, "uuid": "af5eafda-8097-4a7d-8800-222a64306e83", "value": "384:zFMr9UlM9z6po1QM3mxKvBSpJaICnIzmLxtY+NFx3mv:z69xWpoR3cOSnpMI6Lf33W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318445, "uuid": "0c78d49e-9d67-4301-b7e2-e43589bafb4c", "value": 24322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318445, "uuid": "264ec780-4284-438c-9090-4ab3e17f007b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318445, "uuid": "ff76f402-1e64-44e7-b332-4c2aa126fb32", "value": "Murat-HelloWorld.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec91b14-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343994, "uuid": "08e0fa4a-207f-405a-8351-b8aedad7d4b8", "comment": "Malware payload (Socks5Systemz)", "value": "4fa64973cd96160ca255342486fe8b9a", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343994, "uuid": "8b310ef2-e892-4c9f-bc16-ceafc9de4b89", "comment": "Malware payload (Socks5Systemz)", "value": "41d2ca3ce40c8f4eb6f123b413c4093a35c2c4803e689c10f409f0fa16b3ffa3", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343994, "uuid": "1ca3f5ca-9d03-42e5-833d-cd28daf050cd", "comment": "Malware payload (Socks5Systemz)", "value": "47cde91ebc24abc6649c0d87415b95b5bdc05be6", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343994, "uuid": "8b6eba11-4990-40e5-978f-2ea2a4c5a57f", "comment": "Malware payload (Socks5Systemz)", "value": "e46525c6c0452303ea5a4a18823b21b8820319c72ca90e17e1af9ab24146dc65af96708ad0f030fc2ac8b1e8c1d8fa9f", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343994, "uuid": "697cf437-f81f-4186-addb-01f9f5bf42d2", "value": "T1ABE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343994, "uuid": "c65e0345-4c68-4345-92f1-0c042cfb8e77", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343994, "uuid": "5c78f753-8cf3-4f1a-8e0a-aa0eab166ff5", "value": "12288:sjsgiZdvAeRw8+alH/50cCtKBqi6cvpWw3EmXRKLiTOkERp1H/skaiIjcBDQg5Ea:6sgwdvAhCf50cCtKBqinvpf3EmXR+iTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343994, "uuid": "3b825dbf-e668-4c7f-88a6-5de9eb277bc6", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343994, "uuid": "b853489b-7d91-4cb7-8379-601867b41250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343994, "uuid": "ec9cdd9c-384f-4122-86de-75b47a8bde5d", "value": "41d2ca3ce40c8f4eb6f123b413c4093a35c2c4803e689c10f409f0fa16b3ffa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ba6ddc-f3a6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712360642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712360642, "uuid": "34edec9a-d842-4883-9a79-da32b71ce264", "comment": "Malware payload (AgentTesla)", "value": "953a0892d5b57742d1be0034bd544dbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712360642, "uuid": "4df871b2-c32b-4897-9620-6bdd518a8127", "comment": "Malware payload (AgentTesla)", "value": "425dc2ebd5eb497fb4afaef6471ec30ef3ec4bb69586653b0b92209eb06e5fb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712360642, "uuid": "20981270-4fd2-4719-94f4-a498e948cabf", "comment": "Malware payload (AgentTesla)", "value": "0812e42f1adb12ed1dfdc0603a8ecdc73edaf53f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712360642, "uuid": "b0fa0ce0-3bb0-4ecc-8193-b46343cf0db2", "comment": "Malware payload (AgentTesla)", "value": "761a959e5f7234a822affdd95e59bc8c81e0b9bdc66cf9aaa73d05079a05c1b63bf6b362f3677e5bddbf2877d548bfd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712360642, "uuid": "deb63c26-3f97-4f14-836b-7e28b94531b6", "value": "T183560944B289FC86F02F177258BFA420123CBB258136C61E2A92A56E75F7352355FF4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712360642, "uuid": "5c0b6bd2-c23e-40d1-9270-845df74e0857", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712360642, "uuid": "eaf7a700-3a7d-4c59-bd36-66307b35f48a", "value": "6144:v97Z/8TfUXs7BGlVbAtUngiZuwumMCiP/ZDkc2cvDBMTiv:FQ2SC0Ux2ZCiP/Lveg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712360642, "uuid": "54277268-e566-4f44-9318-cdc1665bc99c", "value": 6187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712360642, "uuid": "b434719e-2f4f-4a8d-9390-6ff48c8ee1b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712360642, "uuid": "0e5c3883-1d22-442b-90e2-ca961962fd2c", "value": "request-2.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170ba73c-f30e-11ee-a120-42010a9c002e", "comment": "Malware payload (Meduza)", "timestamp": 1712295233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295233, "uuid": "5270450e-edf6-41ad-ae53-6d4741ceb7b8", "comment": "Malware payload (Meduza)", "value": "21967bfb7cd7b9091946ed7cbe908f06", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295233, "uuid": "12a05ba6-1276-40ec-9b61-ee2ae88681e4", "comment": "Malware payload (Meduza)", "value": "43b9b71ba6767fda9748590734a94d570fa2553f8f056ca60e8d96a925de30e4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295233, "uuid": "08c126ff-2657-42fd-b911-e929adca1fe7", "comment": "Malware payload (Meduza)", "value": "69255b072edd48b464ac92e71934e74f8da6df49", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295233, "uuid": "04c2fc8b-767b-4a67-a1c6-112cc5e00894", "comment": "Malware payload (Meduza)", "value": "bbcf763bad1a5b7daba1a4e348b3f705ec44361d104fa16176b1a5dc7f0e2bdc70ddf95cec677deb63d4e5b90a6436b6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295233, "uuid": "fc9c6171-81a4-4fb0-bfc6-77b8618b0eb0", "value": "T1DD45334054F449A1E2EEEB32CE4AE313427CE3FB0B689B1351456E1F266565F8B3D263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295233, "uuid": "140db242-f83e-478c-9146-32f00841e362", "value": "24576:ESCz7V96jSYOdQyUbjN5HABgRmvL/7mOhdbY7bDPq7aGsl0:EttXPEKgY3bYfDWjS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295233, "uuid": "e69efebe-e24f-4aad-93a6-0dd72395d908", "value": 1216112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295233, "uuid": "e8677c20-3945-4e53-92e6-0fabd244e701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295233, "uuid": "21ab4719-9f1f-4528-ab71-a7cf1725e056", "value": "21967bfb7cd7b9091946ed7cbe908f06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5de176c-f358-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712327390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327390, "uuid": "30695da1-bab9-4bbb-a396-5d939d2e39b8", "comment": "Malware payload (Socks5Systemz)", "value": "1b3322b13e301d137ccb9627655cc637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327390, "uuid": "2b3da9b0-a78e-44ab-b30d-0a354f132bf8", "comment": "Malware payload (Socks5Systemz)", "value": "44a806d2a1986c2751af875e9f95fe6092ff7defd3a41475d2bda32b8762d2eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327390, "uuid": "0ebe410b-7e30-494d-bd08-c0f78220b095", "comment": "Malware payload (Socks5Systemz)", "value": "92583f21f59fd94a62d1c43d0873e25110a86375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327390, "uuid": "99cedc8c-b78c-456b-a6e0-fc56c05df4ee", "comment": "Malware payload (Socks5Systemz)", "value": "144119c8256b25995e289de74f15dfc19b84a9914bab75faf1effaeb1f58fc4369e4f4abcd02d0189f29e81f4ae586ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327390, "uuid": "39495dcf-1872-4c00-ac46-34dafe4763a1", "value": "T1541633A316B65733DE1114B39E89185B8DBFB987103C36E3B8FE869C1F7685A1E05306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327390, "uuid": "85816f66-a835-4374-853b-7313b4566ef8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327390, "uuid": "97e40a1b-aa4e-4719-a9fc-0da83066ebd2", "value": "98304:CPPIWkbJ4K3XgvM3qPf9VQ29dhIcOdlLfeqQ0kUFD3rxQxU:x7XL34f02XhIcS1TQ0D3rxQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712327390, "uuid": "7135b38d-e30d-465e-8d3e-96c455f352d7", "value": 4410248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712327390, "uuid": "8e104151-ca71-4135-9b11-1e3b689008ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327390, "uuid": "2de7896b-d7dc-4fa3-b79f-9eca1a381356", "value": "SecuriteInfo.com.Trojan.Win32.Crypt.22353.9204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9cc3b1-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283943, "uuid": "0773e9b3-cd87-4b87-890f-4a9692bd1d1e", "comment": "Malware payload (Mirai)", "value": "bbb7eb06375bf274369af201145cdac5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283943, "uuid": "3393603e-2648-48f2-823f-42abfe3e712e", "comment": "Malware payload (Mirai)", "value": "4506cead63ba15dfc1ccf8bc450c57f85d3caa1b307828c7c1c115d5a35ef8fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283943, "uuid": "dc172343-a981-4aa7-ada1-f9d2b0523ac7", "comment": "Malware payload (Mirai)", "value": "ee31179900e4a4e7b1a826ae474c8ba55ed46b61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283943, "uuid": "2241db21-8559-4b69-8688-31e2f2eaf195", "comment": "Malware payload (Mirai)", "value": "6a52877efbaa5f47a1d31d3681ee48ea052c2414db9712a2e3f4a26d8c8c69fc4dcdbc2ea64b1f0baa4cc1efed830649", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283943, "uuid": "bb2721fc-2124-4327-a6a1-d384bb49bf0a", "value": "T15B732982BD815A12C9C463B7FA2E01CD332563E8D2EF7213DD126F11B786D6B0E67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283943, "uuid": "f00277e1-5d31-4f97-ba99-0d383a2242fa", "value": "1536:Ewx6JlCsn5rG5UQE7rcGahR/ozwLNvWosP5EXrPUUuiNcwbZnN:Eg6JlTWMk3hIwLYosP5EXJu1wbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283943, "uuid": "b7ecd535-c0d8-4c36-9422-e71965c880e4", "value": 79440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283943, "uuid": "b36d8886-7a8c-4e4b-b237-84829e8d9ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283943, "uuid": "3e5327e6-e987-41ab-b978-bf5ff9474e52", "value": "bbb7eb06375bf274369af201145cdac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9a566e-f326-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712305871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305871, "uuid": "67c72b74-3133-45ed-a5da-48ad56197d50", "comment": "Malware payload (AgentTesla)", "value": "4b29ebcc6b27f24d7616f6a395e7e2ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305871, "uuid": "630cd908-d92e-4bfa-a3f8-4e6b506a3030", "comment": "Malware payload (AgentTesla)", "value": "457d65c46b6ec0e1c18facc26249fee45324d7e2c0781546546c3074afa9da0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305871, "uuid": "7c763a41-a23e-4654-895c-8576d4c9198b", "comment": "Malware payload (AgentTesla)", "value": "e9b8e5434565e42ea45cdc7498f5deb96be8beeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305871, "uuid": "43b30bf6-329d-44b5-8c48-54ecfb71e792", "comment": "Malware payload (AgentTesla)", "value": "8ec24807e7dc270b3e07e577f60ec791fb4f1b721391b9b67fe7f1c3ec928beeda05eba595878afa12b407e1fa2a0c42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305871, "uuid": "296dc9d2-f551-4a1b-b521-2ac1bbbb94cd", "value": "T1D6D4237C9AF5D3DCC27A11B1A530486C46BA4FD32111207E798E924377E5BB2811FE63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305871, "uuid": "3b62a886-86d6-4121-aec8-578a0527e51e", "value": "12288:vLYG2FAUPdGVFVc7s7hRQ30nyxwU2N0erFj8xpw6+C9Z2R42XWN8H8:5BFVc+i3LLUChGWNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712305871, "uuid": "2b09ef76-ce95-4b49-a730-dc7e6dffbebd", "value": 623216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712305871, "uuid": "95a08011-c3d3-4afe-b435-0391ac75e518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305871, "uuid": "2c8dda0d-69c9-4a70-bb79-444641ab9a3e", "value": "DHL G\u00d6NDER\u0130 B\u0130LD\u0130R\u0130M\u0130 VE BELGELER\u0130_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49b8c47-f358-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712327388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327388, "uuid": "cf362adf-f81f-4116-9a81-5316ff98bb19", "comment": "Malware payload", "value": "efccf2fe08566ed86f146143506fbc74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327388, "uuid": "0c8e9629-868d-4f5b-89fd-c7324b0f1a3b", "comment": "Malware payload", "value": "465bc56a68338f289e4d5331d4c96dc97e9ea66b0d6394d4424e454d255ef4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327388, "uuid": "2ca454f1-6a80-42e1-9b3e-7b1f55d5b585", "comment": "Malware payload", "value": "cd74df7b9d4eadf8d1a9ce4e7da29796eeb8bffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327388, "uuid": "f8ec581f-4d5b-4c24-b521-00ed32c10ff0", "comment": "Malware payload", "value": "4600e248085b1de578e30ce055bacc64284ae04c3d89f6dee9be4735831c766b6aa6756d05f8ae7d55cccb1646f181ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327388, "uuid": "48ea614b-a1ef-44bf-8cf3-e5474a531f46", "value": "T15567333914E40DD5E5A76C379192C53DCE53B8D29B95DA9F8F3042203A97B68A83FF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327388, "uuid": "8e7f01fc-aee7-4d38-9fa9-6b938a6908d1", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327388, "uuid": "cfdccb05-8aea-4504-a59d-a341f7b73f22", "value": "786432:UODpquV8DS6jOtklB6h3hhOOF1lIb6QI1MyLZ4gBcvq:UOlquV+tK6G1hhv+K1xLSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712327388, "uuid": "dead52c4-1cd9-4ae4-9256-3b7cadca5cbd", "value": 30282965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712327388, "uuid": "0aecee6e-16be-4022-b371-90e091a02336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327388, "uuid": "dd99b3a6-61b6-4330-9107-35e1c4ccc1a4", "value": "SecuriteInfo.com.Trojan.MulDrop26.47172.19490.20786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0b1a0e-f380-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712344206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344206, "uuid": "48a22ad8-e3ea-42fa-86bd-e30dac55fb15", "comment": "Malware payload (Neshta)", "value": "2b7bcae67d481f675bca707071772b69", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344206, "uuid": "e87164da-fe73-4692-8bf7-16ec9e30c36c", "comment": "Malware payload (Neshta)", "value": "46f4adb2f42b7f4d73cd531f0290d90f2f1b07b5293862c711237e714b0c4eeb", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344206, "uuid": "f5f757e5-e60b-4e10-8aea-42a16cda9462", "comment": "Malware payload (Neshta)", "value": "d55ee6932adae0c5d4259826c94729249a2ef482", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344206, "uuid": "b1534a18-a20f-44c6-86b1-1a5c6916c540", "comment": "Malware payload (Neshta)", "value": "aeaa92ca1520d93627f6de7593ac71cc007b84c665ec9baa1e8d512f2ec9a6718616c6a2097232353f41738dff1dd44a", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344206, "uuid": "fb4a759f-db38-4d33-b530-80b658c9c01d", "value": "T119549D3DB7E048F9EC26867CCD62C115EA3278610B64DADB13A4452A5F333D06E3EB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344206, "uuid": "e6e5ceae-2b83-430b-b2ea-36c46bb63c75", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344206, "uuid": "a3122d84-0c0a-4eb1-bf60-8cd3ff2a0595", "value": "6144:k9T9IfVxyCme5QspSejJKQl+vn/e5+XdH5lZ:gqVwCzlmu+XeUtZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344206, "uuid": "48073d1a-3095-46f4-b8a5-81ccfc0921c8", "value": 282528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344206, "uuid": "4fd56fa6-0dbf-4431-9353-142138970f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344206, "uuid": "974125bf-c9b9-464b-9796-8ac20f22dc2e", "value": "46f4adb2f42b7f4d73cd531f0290d90f2f1b07b5293862c711237e714b0c4eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9853188-f30b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712294217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712294217, "uuid": "b7d37235-1727-4fd3-bd96-e454ce2c9dcc", "comment": "Malware payload", "value": "c718e0f24cb13c66e4cef3b3b722a9f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712294217, "uuid": "0814abc8-c739-4682-8437-318c1a5d2770", "comment": "Malware payload", "value": "472dac820d34629a7e20a93ff1c31ce5b42c337238e7b090ee91f27e1b1088d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712294217, "uuid": "d7113142-adbd-4224-a7d0-a995d626f24d", "comment": "Malware payload", "value": "9cf87a2736f0fe9c641fcfb59e5b5c180bb8a590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712294217, "uuid": "a7d47504-d602-448a-8211-297f09a02c51", "comment": "Malware payload", "value": "c96a907ab12e068b8b75af6043ceac1ad391b1c432f4dd7a01499a17b78cdf1ecbbd0770afe55fab6afa23a22f08328d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712294217, "uuid": "6960b438-7099-4495-90bc-dfb4763612f0", "value": "T1AC1412471A9EFA14CF25047A1FCC66C8474BA36C0FBF921ABEEA7DC081A0B5D9873515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712294217, "uuid": "766a24b3-f82d-47b7-81fa-bd84d133daac", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712294217, "uuid": "6d1a0cc9-81fd-45f3-9811-311690a933a2", "value": "3072:2YNmE02Lt8aW7ufx+x8zLfhFeDt+s7vFIA8kEl3OW01G7HyghjsWVfClMHPAejsZ:BNnTLt8Mcx8XJFM1CAlEl3hOG7SYwWVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712294217, "uuid": "af389dea-028b-47f1-bd07-3732f09de598", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712294217, "uuid": "5cd91260-d00a-4c24-b54b-0ad650c10882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712294217, "uuid": "19d79d7e-0298-48ef-91e9-5ce356229187", "value": "SecuriteInfo.com.Win64.MalwareX-gen.87.8614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8be66ae-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "f9526c6d-edc7-4af0-b2a6-8bb4ea0b16b9", "comment": "Malware payload (RiseProStealer)", "value": "9f6c9d28b4958e56231ed0137acaccea", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "9f66042e-c448-40ee-8279-7afcca916e4a", "comment": "Malware payload (RiseProStealer)", "value": "476947dfe72d4e8ce02a93b8e8ec1e9f443b8d8a84dd128dd928a14dba318633", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "6fad450d-e035-477e-aac7-03b05e0d02ac", "comment": "Malware payload (RiseProStealer)", "value": "708528eb517f921b0bbfef2817a1a39b3e70ffd8", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "73c53d0b-866d-461a-9b6a-38f482ff2c2d", "comment": "Malware payload (RiseProStealer)", "value": "0fc70687f315e431e84137c5bf2a6d0e5e95deffecf04187d1ba5e3454cb449fa4712c1b2edd0b6e71524777533f0a00", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "128d5695-f733-4c81-af1c-a6356d16f419", "value": "T1CD459E71B402C137E1A111F19A7D5BA621A8BB310BAB08DBB7C45E3E94F1DC26635F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "ec864a79-4ca5-4994-ab98-d28f89e244e7", "value": "b625b0422748e8ddd8a2e69ebe413b45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "cc462aec-797f-4d27-a7d3-7bfca47b4447", "value": "24576:G1vuE03HfGvF4TLt7oj7v0zvr3974W1PbijMT6YFbs7pmqBTxVk1GFbwzFVc+:+6XfGvW17iWbijMeYFbs70qBTk1GFbwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "8aca62b4-52c1-4bd3-80b3-27aa8aa8f065", "value": 1279488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "27225673-22cf-47b3-a477-5b3f3ce65a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "6364933a-78c7-4f60-b3c0-6e670ef9935b", "value": "17123252454cee8f5bbeea28bef775c962baa7b486704978d6564a4b4c25e4f526d316c953208.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afed0a3a-f346-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712319541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319541, "uuid": "aac2d693-ccb6-4ea8-8b73-48e1e9fdb982", "comment": "Malware payload", "value": "5fe43657d379c42cb3e04bc7a04a5c7a", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319541, "uuid": "b55a034d-538a-43f1-9c4a-6340c9cb7f50", "comment": "Malware payload", "value": "48298f9f72c270607a79867d6b945a4677b673e1318910399137b0fd55e13710", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319541, "uuid": "61c4aa85-569d-43d9-893d-d6d30079ce0b", "comment": "Malware payload", "value": "5206310f5dcc5415d8a5ec211b3a57b89ee03844", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319541, "uuid": "f84b93ee-5feb-4cbc-bae8-5732b2e1273e", "comment": "Malware payload", "value": "323879e3a5c6d81ee8590bb756940d2497fb3c879d95f0e5848e3b47ce2fb37643c788ad4ed175de1d1bcfa7352eac54", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319541, "uuid": "9d63ff6e-8588-4de5-a73b-0e139d266c3a", "value": "T124A29E36E56EE476D36BAEBD444E04F1306A1181D7D0AB5B2811E18F0B816EF43AF6CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319541, "uuid": "b9636da2-6c49-4bd7-8b42-5348e463586f", "value": "384:zF0fgaGUlM9z6pzA8ETocRsiFbGPjpZEki1P49MaM2xq:zOfYxWpL2hsGAjUki1P8MB2xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712319541, "uuid": "060f2c4b-90d2-4fa8-aba1-f9b2f2d864a6", "value": 22116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712319541, "uuid": "5fd279ab-3b8a-458e-b9ae-5c32ffb18174", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319541, "uuid": "59d27b6a-063f-4aa5-8c6d-6ed074f16832", "value": "Murat-TextAutoAttack.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0231fef4-f334-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712311519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712311519, "uuid": "2c0c5763-cfab-49e3-a872-9eaf6dabd2b9", "comment": "Malware payload (DCRat)", "value": "03185509fd3c2049319609ea04a32859", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712311519, "uuid": "a91588b5-4c5d-45af-8e6d-7f53baf71bde", "comment": "Malware payload (DCRat)", "value": "4a180d200a509fa5ef28f8465ff04b2b7352ce06597e34e130c0b8ec7124fa8d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712311519, "uuid": "1d6f7154-0be4-45b5-924a-282cc3c9b45e", "comment": "Malware payload (DCRat)", "value": "d79c2a63515e585ec0703a5a1deab11a3b20a93d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712311519, "uuid": "7d160260-fd3b-417f-ad1e-2bad92f12210", "comment": "Malware payload (DCRat)", "value": "9f7665517c5ab816f399948844a405b3e11d1510ac0319b0c2bc6a55a4ebc5592958742d16ebbbc389d12d4afc815d68", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712311519, "uuid": "2c832454-f90e-4b2c-b8bd-612e52e607e2", "value": "T1D22529027E44CE61F0091633C2EF454C87B4995166A6E32B7DBA377E59123A73C0DAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712311519, "uuid": "c541a5aa-0e13-4e53-b922-d42c07480b97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712311519, "uuid": "b292c2c7-c3be-439f-94f4-571e6fca6e6c", "value": "12288:qwQkjCV8R/y+6rn2iQvnFLlgczs4O7niEJ1oEsjOHoyOUeAmHl1QoB:qkjCV8orn2ieSD7npqNjvyOlUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712311519, "uuid": "c3cabf86-247c-406b-b38b-1e6a838a36a6", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712311519, "uuid": "7a4b0ab6-2b41-41df-a774-a750b9b70bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712311519, "uuid": "2a4a3a2b-b8fe-435e-a021-2f7be32300a5", "value": "03185509fd3c2049319609ea04a32859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf69672-f31a-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1712300770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712300770, "uuid": "3018ff2d-05c0-403f-a7a7-009992ac82de", "comment": "Malware payload (Vidar)", "value": "ba4ad2da9d3dfec01cf95c3c51f34d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712300770, "uuid": "65b5e544-2cbd-4dd5-9795-b45699eb96e6", "comment": "Malware payload (Vidar)", "value": "4aac282607d576a91a2b347d22f9d06c33107bf56adf48059cd014978479d04d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712300770, "uuid": "17281e57-2824-49fe-9bf8-af050738a535", "comment": "Malware payload (Vidar)", "value": "21319d44520ae6eeb67ac511c7a4b22b0bc3c729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712300770, "uuid": "f5015aab-2d41-4b65-9d3f-feb51e6a6de8", "comment": "Malware payload (Vidar)", "value": "6200d48b9acfa56bc98856637840ade35f333804994b49a1e7383b763bd400879e2bef4ba1865efa0fe08b7b913246a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712300770, "uuid": "0388c0c6-4ba0-44af-af9d-2a6da94e4d27", "value": "T12C24130557FAC008DC03D1BEFA62B210C3E3D2ED7692A1DD942E6FAE7E2D3389565815", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712300770, "uuid": "1b33792c-bf6c-41da-a76a-5e75e22c6f48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712300770, "uuid": "2ea0dd95-d777-4798-8310-9069c5b25324", "value": "6144:QWcwLoxJGWjctQZFm2JKlleu67kC6gWqY+t:QwlWjc8F3c3PgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712300770, "uuid": "0b3e9a7a-6bfd-4ccb-97e5-580e55b95934", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712300770, "uuid": "979e2d27-b09c-40be-b2ae-7762ec031de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712300770, "uuid": "b27d6509-8205-4a4f-ac4f-55abcfaeb7a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e6285f-f2fb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712287156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287156, "uuid": "11e9a836-da1e-4151-9d04-6928c89ee332", "comment": "Malware payload", "value": "325de91cf9fa8e50ed65401534137824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287156, "uuid": "0470b770-0648-4aff-91c9-3c3cc19a94d6", "comment": "Malware payload", "value": "4aaf7d9d0d881762cf326a2482bcf41152c313a402e075c630a0059b192cef39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287156, "uuid": "fd4571cb-3e49-4c3a-903e-851cda033d64", "comment": "Malware payload", "value": "45b8664e12cf11efbaa04365ad8507ef34dac368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287156, "uuid": "4f6931a6-23d7-4261-9e5b-ed5a91bdbbad", "comment": "Malware payload", "value": "0090845ead385959d3c755d6ceadff44b51ad6bdcdfc39ae2d452471e6bf03e8d132875d7e04a7e98896e3394714cce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287156, "uuid": "976e79e9-4a35-4116-9a1c-50a92798f257", "value": "T1B3A6233FB268653EC49F2B7144B39210993BBE61681A8C1E07F4291DCF3A5615F3F61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287156, "uuid": "341ec123-8543-455c-be2d-35dd47293f4e", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287156, "uuid": "b651b2e7-93a9-4b96-8082-bfec53addab2", "value": "196608:8Bx/+SUbtftA+by05jkfhNO07VJy7EOh0tkPN6Dx3u:8BZY1A+2ZjVJSEPkPIN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712287156, "uuid": "b1754c0a-e0a2-4da6-89aa-aef569b3d363", "value": 10115920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712287156, "uuid": "2dd837af-25d7-41c6-8c82-48f99cdec047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287156, "uuid": "c6e63f87-e01e-40be-af24-0d5e25fe64b7", "value": "SecuriteInfo.com.FileRepPup.3838.25967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4af75cc-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283928, "uuid": "73a6e453-f904-4db2-96d4-b35053accfd4", "comment": "Malware payload (Mirai)", "value": "d1a934440fa9d0470c68eaebc27a315d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283928, "uuid": "63a8a760-188d-4bc9-9884-8457e604b04c", "comment": "Malware payload (Mirai)", "value": "4da9cf2a1778868d0a2cd153338543d1259abd91c8bbebc64e7e45a75f463f04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283928, "uuid": "46892d7e-b09c-49c6-91f5-b9e357ba41d7", "comment": "Malware payload (Mirai)", "value": "2e8954ad2b7cc56614ef28af04ec7125e49c0fd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283928, "uuid": "82fd32e3-abdc-409b-ae7e-4d8751367162", "comment": "Malware payload (Mirai)", "value": "6b0c8a6acf917b009f3dd2a9f2f5036afad3529408c63ef543b94cd72f3b11844a7ad11b830c640723e3408f3b2ca089", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283928, "uuid": "e551f669-2dbc-45c2-975b-b1f8872448b4", "value": "T1B1833AD6B800DD7CF81BD7BB8023090AF171B2510BA31F3AA367BD63AD261A54D56D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283928, "uuid": "a99a8689-0d84-45a7-a992-69158db8caff", "value": "1536:E/rLr2axwfkhYVKY9u36YdNqmq88ncePQC6m89J4X7f6N1sBeTBnbG:QwfkhkKiubfqmqeOlGJ6zBeTBnbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283928, "uuid": "343d3dae-2bda-46de-a539-a76badebd299", "value": 84516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283928, "uuid": "7a2d0696-ef1e-4d86-a25f-95ba401257cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283928, "uuid": "80f1c831-1342-409e-96a9-ad25e3ef4edd", "value": "d1a934440fa9d0470c68eaebc27a315d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b3e71c-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283950, "uuid": "036a6ea1-f3de-478b-bb2c-74412c1bfa47", "comment": "Malware payload (Mirai)", "value": "90b071d680567254762801d3dedcf04e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283950, "uuid": "a125c198-34e1-4a5e-81ae-0b0c2098f6d7", "comment": "Malware payload (Mirai)", "value": "4eaf163741e588f7227d8a9e84bc8db65a2ec90ab110da58b9ab251881bf092e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283950, "uuid": "f6c9b9c8-ba2e-4839-a64f-01c8e89f6a98", "comment": "Malware payload (Mirai)", "value": "24da2e5905746f850d5637d3587ae3082142b90b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283950, "uuid": "be9ca728-7344-4b54-8891-30b58cd27b50", "comment": "Malware payload (Mirai)", "value": "a3a535514d5d4b55361d9b4ced47a399178ebbed4383e515d75f58dd12c245b4667323c9853993cfb777fca5abe0e902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283950, "uuid": "1e976649-da02-472e-8de9-3718e365252c", "value": "T12F734A0273180E03D1661EB12A3F1BE1B3EEE9D021F4F688694FEA46C175E375585EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283950, "uuid": "eb9e00ae-948e-492f-9c2d-8ffdb24e2f2a", "value": "1536:T9aBb6uTAhibd6VRx4ZhASSck0VrZ8wbZnlN:T9aBHdaiPSc5V98wbZnlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283950, "uuid": "8958fa29-8145-419a-83d6-02a36dfb8ab9", "value": 79264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283950, "uuid": "ef15b6be-61a4-4ae2-802a-45f361aaf059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283950, "uuid": "9603fb86-0d54-4cbd-b230-02cea55e67c5", "value": "90b071d680567254762801d3dedcf04e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862b7f0f-f342-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712317753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317753, "uuid": "4268c184-cacc-47ba-a473-a9b56d1aa14f", "comment": "Malware payload (Rhadamanthys)", "value": "fe36f2fda53c21f8f7e06629cdcc377b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317753, "uuid": "66b73f0b-9be3-4c7c-8bf5-a39d159084e2", "comment": "Malware payload (Rhadamanthys)", "value": "4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317753, "uuid": "3ee819de-f985-41d0-95a5-ee1478383bbf", "comment": "Malware payload (Rhadamanthys)", "value": "3988d1e0628299d29ef39bbb7f24ee347933ab9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317753, "uuid": "5c3c35b5-ad36-4a04-85a1-cb4247582f24", "comment": "Malware payload (Rhadamanthys)", "value": "c8514c6ca83c95341e71545a44398858194ccfc47bca7b1c5e8234bb3a1de077c0a1aa8b04a7df1a8ce3f047af61c6a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317753, "uuid": "7e5c5368-57e7-4d12-b51c-5296c7302fc1", "value": "T12C740290AA405865E31D0F308B06E5E885A8EF3D51D1E18FE4BC3E36AD761975BB318F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317753, "uuid": "de4ad571-7ce9-4168-84f6-cea0fcc615df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317753, "uuid": "d42568b9-4da1-4c02-aab4-c17df821659c", "value": "6144:IM4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ix2p:IM1t/6+6pWG8aRna9RYSQTXtV8s98E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712317753, "uuid": "4a13403d-001e-4fb9-bde2-184865936c60", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712317753, "uuid": "a046bf40-9761-4fac-bafb-0be732713c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317753, "uuid": "c4ca5ee4-f34a-4492-8c4d-d5998abbd20b", "value": "open.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46ada90-f321-11ee-a120-42010a9c002e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1712303711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303711, "uuid": "6583fb24-cfbc-4188-8259-e1a50a583170", "comment": "Malware payload (Gh0stRAT)", "value": "8c40214c2137653a260823bf8ad74e5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303711, "uuid": "95af5ce4-80ac-4d67-a8a5-124f7c470f16", "comment": "Malware payload (Gh0stRAT)", "value": "56ad5b559409177e38c8f8e25ce9d34c360f6acc4e3e5142b9a23f4bdb2ead1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303711, "uuid": "d8736d30-ef68-4a21-aa67-6f31a0b42364", "comment": "Malware payload (Gh0stRAT)", "value": "38b38c52c86707532b7113ae17410b531ae4db19", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303711, "uuid": "dd24a523-df23-4c5e-b0a3-c7b6b8c31acf", "comment": "Malware payload (Gh0stRAT)", "value": "2fe2de2aa630b0cbdd929eda9e2e64312af284afb2fbd14259555941a84f5ed276ed99235d9d0542fee83f136a1a4627", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303711, "uuid": "7ae02787-0753-49ef-8e83-a8014ea0f8e5", "value": "T16555CF03E581C0F2C24C1A3514F7773A9B799A564E24CBC7A794EDBE1D332A1963A21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303711, "uuid": "56cd92fd-a479-4ed6-bdbe-064b55ce87f6", "value": "e76491cdb55097ec828f71f474a24f41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303711, "uuid": "c0f884b5-6051-411b-a1f2-a4bf30f3d45c", "value": "24576:hfub4yrezoJ0BKv7OVO6WnHpOd/NRbGKLbjA/uuIn0m:hYefKv56WnGK/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712303711, "uuid": "8bb2c937-548d-41a1-b03c-5ab7e1b937b0", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712303711, "uuid": "56688de5-b7ec-4276-8f67-f84554c0d326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303711, "uuid": "f0152f28-e6b3-480d-b7c9-52c7abc09ee3", "value": "8C40214C2137653A260823BF8AD74E5B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50ca3ec-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712335066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335066, "uuid": "60b4745b-611e-4eec-b56c-b448309d8e49", "comment": "Malware payload (Mirai)", "value": "60361b773a2d0c0957d1a3a9f84d43bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335066, "uuid": "0d6cf73c-7b96-42cd-84ec-11507a935883", "comment": "Malware payload (Mirai)", "value": "599b807a692fe833b7182f6d8d11018b3164055a6b954f6b8413d7f20c4c71d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335066, "uuid": "7322e010-6a00-4bb8-8931-e0e00381c57f", "comment": "Malware payload (Mirai)", "value": "57362e870a4dbcca2ba8db193197bd652071745c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335066, "uuid": "6aa1af5b-a531-4845-b05f-37230c471042", "comment": "Malware payload (Mirai)", "value": "a1e3fa20c57c538a06251b035ca0d4a8f00bbc0922a33c2f7c8659af6a86f96df65868511a6a350e3b8cabb569ac2448", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335066, "uuid": "e9d5a4aa-9128-468e-a653-ac8ca25db061", "value": "T130637C22E5265D51D84321F8B2E2DEB40752BCF106F50D35A9BEEFD40163ACCB6C9365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335066, "uuid": "f3266582-a1c3-4770-9f85-0653bee43f57", "value": "768:MYeMCioC7A3LgbegNcOZFRerDUDJ7grUlxSHKF9AyDTBcFyArtmRB5umPIErQ:MR9iJ7Ake5DUDJ73lxSHmTauHumXrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335066, "uuid": "0e0ccbf5-981c-4611-bfdd-026071dcaa78", "value": 69644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335066, "uuid": "f7806b8f-d23e-42c6-a970-94f142b67a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335066, "uuid": "cb95cc56-cf20-449c-a2b7-e44e07d84626", "value": "60361b773a2d0c0957d1a3a9f84d43bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a7cd65-f370-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712337436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337436, "uuid": "a134c01f-60e0-498c-9651-bbc61faddbe0", "comment": "Malware payload", "value": "e32c9a8877746bf738473692148dfef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337436, "uuid": "91054fa8-cc8e-4291-b940-9cd10ce6851a", "comment": "Malware payload", "value": "59afed534da45694cff575bcbd13b6059dc0e28e29fb0f9527d9e14592d7b1c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337436, "uuid": "f94f46d7-1b3f-46cf-bd0c-f7066d05ea8b", "comment": "Malware payload", "value": "f5f9ff833dc799db207f348081b7ac231ba8d10d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712337436, "uuid": "abbeb1f5-168b-4cf7-8673-0e71a6c9ba14", "comment": "Malware payload", "value": "56c56772c23ced6fa48f5c1fe2ca1170413ddd95719d23082c521b68e95815df84da037886a8c0abb1a6ff92b8d563a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337436, "uuid": "5395959a-52a9-4a69-8866-f18d7ef042ac", "value": "T117038D377CD145B7C98286F090F58F26AB3F52A503A294C38754699A2E71DE0EE3B347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337436, "uuid": "c0705cc7-ea8d-40c1-a3fe-6ab5787c8c88", "value": "1fa56eefdb5bf13a420e54879ef24ea9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337436, "uuid": "b4cd3eca-b660-448d-8800-a401a1902b1b", "value": "384:1GK9LGVgXoreYZHebZCQNtVF8wpdtbWLEcP9yPG1Rngre9EokX:bM24reY96gHwqEEr1RnGeiok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712337436, "uuid": "3d46e66d-02ca-4113-bf2a-626808a09436", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712337436, "uuid": "f678696e-07ec-4cb1-82e8-b5726f657e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712337436, "uuid": "43cfd9a6-e07a-4882-be1b-28e249d2b582", "value": "CA3_Sample_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb98a1e-f380-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712344209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344209, "uuid": "c0b821dc-3fbe-4dc7-a91c-b20690b908de", "comment": "Malware payload (Neshta)", "value": "6bf3907931679a0d89d9eaa1f8d275f9", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344209, "uuid": "98892500-b946-49ac-8501-6eccb35e7551", "comment": "Malware payload (Neshta)", "value": "5a945890f31cf1b341ad7993e3060ea9c0564bb0491a4802b3544eecf440aefc", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344209, "uuid": "b591c364-6839-4014-b9ce-ac93c5dc9824", "comment": "Malware payload (Neshta)", "value": "150974c79ca36659cfe8190193527d9c21831f95", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344209, "uuid": "d048e8d3-0a15-4028-bbea-0ac2baa82947", "comment": "Malware payload (Neshta)", "value": "554e176a4e1df30bb5a5668bf30642661aaa0742a18eb92d406f2e468a3355875fc1f76dd886c0ed6559671814327a67", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344209, "uuid": "31d9b3a9-731e-41ac-b75c-9fd31e7cbdcf", "value": "T1F3756B12B7D88A27E5AE16B9B431012517F7E686B372F74F6A8CA1791FC37804C46363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344209, "uuid": "504ec57f-211e-469a-8ba3-28273caa1c49", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344209, "uuid": "48781989-b54a-4ad0-91d0-8ad4022a95a6", "value": "12288:6LEgR0ro/0EhcXAHjRYSN9bUlOr/oJfT9Pu0XejfQ1JRQ3Tzvx+nDIpnU0T6CC:8EgRN/th3VelBPu0XUfWJms0pnbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344209, "uuid": "c937f6c0-24c8-4379-ac2a-cc98f4df242e", "value": 1566496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344209, "uuid": "ff621ec1-c841-4ee2-a09e-c99210790768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344209, "uuid": "104019f0-8082-4f39-bb5a-6d047bd7530e", "value": "5a945890f31cf1b341ad7993e3060ea9c0564bb0491a4802b3544eecf440aefc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143ff143-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283632, "uuid": "7b03d589-f112-4da6-9e1c-b1c174e293d9", "comment": "Malware payload (Mirai)", "value": "508a0aa18af636e79e4d5800d2a028af", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283632, "uuid": "9073980e-dede-46cd-85da-9512751bf11c", "comment": "Malware payload (Mirai)", "value": "5c25610e54446846dc46fe87e3b69b80b9719627e71133bc14ac077e1f32bdf3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283632, "uuid": "416eeb4f-fee2-46f3-91d7-759159fda598", "comment": "Malware payload (Mirai)", "value": "469e5b16fe3761c1d06716304b9844dc7c2eb4a1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283632, "uuid": "a1683e02-1912-4aaf-a257-c21f7862c550", "comment": "Malware payload (Mirai)", "value": "e50dc547611ecc5309a81769de794893c3b23d177cc564a3b87ffacac48f1ee0035ef0d95e99c9be2433c4b802d3208e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283632, "uuid": "7f7659f5-f21b-42cf-9e26-fefd75b5a305", "value": "T1A4734A03698184FCC08AD5741B7F6536F062B1BD0238B2E627C4FF26AD49E711FAE995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283632, "uuid": "1e25f934-8143-4a7b-8c0f-caaf5d9abb7d", "value": "1536:ZjgsvSghV/ILgCcvpNSdHRxxt4L+8r2ea+vvKkWwbZnR:ZjHvLbEgDUXxxe/r24vvKkWwbZnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283632, "uuid": "8fd60f5a-52bd-4457-8674-ccb4ed6ae900", "value": 78144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283632, "uuid": "d68f62df-3ea6-44e1-bf39-833fd0cbea38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283632, "uuid": "937ec690-28e4-4f36-9134-d53686c24de3", "value": "508a0aa18af636e79e4d5800d2a028af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240e128c-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712321025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321025, "uuid": "b53d32ce-8895-4d06-a6f3-cec4e0895a6e", "comment": "Malware payload (Mirai)", "value": "f5dad2f608cbd0bf6010cc8a4698ab22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321025, "uuid": "3603e92e-c3ff-41bf-84ef-54803e8997d4", "comment": "Malware payload (Mirai)", "value": "5f26857bcae7e008ed21c22184170d97c23cccaf1453c37bb6213479c3b3fdbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321025, "uuid": "b37fb867-883c-4486-bf98-9f4be18b4154", "comment": "Malware payload (Mirai)", "value": "4888d68acbdea72b381626eccd26cdfe8f7065ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321025, "uuid": "a27e2824-0a9c-40a8-b693-f75945c68c02", "comment": "Malware payload (Mirai)", "value": "e3221b5a37d5cf624180b4b93bef515fc2e02d2cc377cf2d3e6b88bc8ca9390c80de81e39c3c2450c56f4e33ab2cfe25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321025, "uuid": "2ac5faef-7112-4d5d-86c5-20ae7269d35f", "value": "T167C2D1E07726FA31C420AC3DE52A4D8A3A91167C91FF393664258D358EC265B63F84E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321025, "uuid": "8b22246b-6edc-47e0-b44a-2a64e4e584d5", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwr6C9q3UELuN:NKy4qfqoeJdXWg63Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321025, "uuid": "a2c9c081-7009-4b3e-acb1-69302258d1e8", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321025, "uuid": "a4bc229f-57c2-4026-bda2-da886e53a53f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321025, "uuid": "1722b7bb-f0fa-47fc-8b5b-6c3484868704", "value": "f5dad2f608cbd0bf6010cc8a4698ab22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996327f2-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309625, "uuid": "8f85dd92-8a0e-4340-a58c-d57f40b24ccc", "comment": "Malware payload (Gafgyt)", "value": "140c241d6236e21bc1840859402035e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309625, "uuid": "74d23911-0843-4d11-9295-b5c2295b1a54", "comment": "Malware payload (Gafgyt)", "value": "5f62670f5d45b92d6237e7c313a74a97c305048cc385bfa67281f2cf6284f2e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309625, "uuid": "c202742d-038e-4a43-904b-f2ccfc5a4d3c", "comment": "Malware payload (Gafgyt)", "value": "8eb932b92c837e19de6435167dbfee7c6025aea8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309625, "uuid": "c7c22267-fa7f-42d0-b920-2682c9bdc266", "comment": "Malware payload (Gafgyt)", "value": "07f8db3771da10e12cf4e6711cda4d1444b60b04ad23f179ed0676acd9ccfcc67e984ef9b562fde8c918b1967a50d6e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309625, "uuid": "ba9e636b-129e-48a2-acbc-34a9bc3b05ef", "value": "T1F2E32A3BE4944FB7C082A5F1186EAD311F15E5D7076F268622385BB08B9F4CA744FE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309625, "uuid": "69b9d8c4-29e3-4dba-a139-dcb2d96bcf83", "value": "3072:WAc50opN0nV8Br3SQNXDw5h98+mAO0qW6MyoQ6:Zc50KN0n6BrCYDw5h98+mAO0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309625, "uuid": "e2043056-3348-4b4e-8418-ec70cbbcadc4", "value": 148212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309625, "uuid": "718d4e36-5042-419d-addb-b361da6bb863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309625, "uuid": "e8eb72ce-93d4-4ee7-b724-3e347974228c", "value": "140c241d6236e21bc1840859402035e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b522e93-f322-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712303965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303965, "uuid": "bdce9a58-91a7-4da6-820c-ff6e8254ff28", "comment": "Malware payload (Socks5Systemz)", "value": "c1eff3689daf9190061421fb035524f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303965, "uuid": "fc8f1567-8088-4287-a4d4-9baa195469cd", "comment": "Malware payload (Socks5Systemz)", "value": "60185ad4f1d262dca113cdfcc63ff8eeeb576782adbe31d9aa4b10dc73c34109", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303965, "uuid": "5a99da8a-0d0b-47a3-8a0b-74f2565aff45", "comment": "Malware payload (Socks5Systemz)", "value": "ac5efa73953901ea5f4098fbf4be9ac97cc27e9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303965, "uuid": "e8d6421b-0dea-4774-abba-5a91ae8422b3", "comment": "Malware payload (Socks5Systemz)", "value": "8d186c461ad0f4c4e10a75929d8e7b13e445b16f3ca6599a633383915d065f8353ae77a01e783f7685ff1fa5aba783fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303965, "uuid": "73f1bbf0-104e-4dae-b8a4-b8d66db4427f", "value": "T1E42601A4B9D8E203D77EDBF2B54548F8A9715CE737A2013D2E66B7158034612BCCEC29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303965, "uuid": "154d16e8-0097-4489-a456-c2d0b9a89980", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303965, "uuid": "3067c305-e417-4aa0-a09d-3935d57032f1", "value": "98304:0nVYRi5VeBzdPpVKaqSdhF4I9NbjehrrsA510z43h9sonEQxu:KVY2Vetdu0hF4s3qrrzf3hyoEQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712303965, "uuid": "24e9ca7f-8489-4b1e-87d8-e056a5b07852", "value": 4505664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712303965, "uuid": "b0a35da3-c403-4015-91b0-e4e7271d9239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303965, "uuid": "1c216523-7382-40d3-be28-1fd4ed8a6c76", "value": "c1eff3689daf9190061421fb035524f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa12bb0-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344210, "uuid": "126791d5-95cc-4e6a-8061-a381ea6da395", "comment": "Malware payload", "value": "0a9a377c1858b14dd9e1548e40de4af9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344210, "uuid": "c07929e4-7a30-47a4-af58-e61b364ad09d", "comment": "Malware payload", "value": "6190b2a091ca018436741e53de962ba535c0ea8cd14f17fc9eaeeeea835feba8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344210, "uuid": "845c51cf-5e92-44ed-9d5c-0084cda7e06b", "comment": "Malware payload", "value": "90a4062958b63bb1754c51be0fe1cb08a223d886", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344210, "uuid": "7df85bd9-6073-4c8e-b593-f7f8af4262b8", "comment": "Malware payload", "value": "76dd05c7e47deaff90aa57077cf1073ebbc2d6084cce6f5b041918cae5f7114759cd12766975527059621128f0b57ca6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344210, "uuid": "93bb40a3-cb74-4f97-b1c8-19bf336e3134", "value": "T1C8D38D23B5E0C8B1E1714C3448A0D971993FBD221B745EA733C41BAD4F36BD1DE29A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344210, "uuid": "399a6988-bc50-47d7-8f0f-f9beac96b4e4", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344210, "uuid": "d63c6805-4db4-4937-93b1-c58290ae50f3", "value": "3072:Ir85CYwWEhPK4zB+6VFJJhUBf8Bo/mu+YDfYz8KrR+:o9YGzB+wF9G7/fYfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344210, "uuid": "ca22be50-7848-4c07-9cbb-695fd9b5a6dd", "value": 142392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344210, "uuid": "4b6d985d-5d98-462d-9277-592c8dd957f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344210, "uuid": "100c9bff-5aa5-4be7-910e-4ba8bfa291f6", "value": "6190b2a091ca018436741e53de962ba535c0ea8cd14f17fc9eaeeeea835feba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef07080-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283892, "uuid": "e6c893d4-b398-4b9a-8dc0-8478fb0db90d", "comment": "Malware payload (Mirai)", "value": "03a168fe28a43c48bb1b485f75ad5940", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283892, "uuid": "291f32f7-3a49-4a94-b305-4377eccaf548", "comment": "Malware payload (Mirai)", "value": "6276df33aa3aab9bf5b159f986b6283a03db7959b96d02ca904fd266503a7ec1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283892, "uuid": "02501eee-5696-40df-bab4-a56c4a1755b6", "comment": "Malware payload (Mirai)", "value": "322e08949375908afc1257274c1fcc41058e2dab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283892, "uuid": "ac01dc96-a475-499c-8389-52b849bf30c2", "comment": "Malware payload (Mirai)", "value": "b82f710c9a9574371fb19e58c7327aa85544add9534c1078b5bdde4a1701b595dce87285a002fb15dd11ed8c4c607b01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283892, "uuid": "f2058fd9-c588-44eb-aa7d-e34b32d5039d", "value": "T106A3D80E3E119FACF7A9C23447F74A21B29833D62BE1D585D19CEA015E7024E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283892, "uuid": "d1e2caf4-97c4-448e-a20b-22dbc902b000", "value": "1536:hLqrPwu2/T/dBZQUmoqOm+pTh4SgNZaMPXwpxNen8bwbZnjN:NZT/HZQFDSTh4SgNZaMPXwpHbwbZnjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283892, "uuid": "caf7999a-9b2c-41b5-a8d8-66a222c9977c", "value": 105360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283892, "uuid": "bc3ee784-9f53-472e-9f0a-b5d3c31e41ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283892, "uuid": "ec561e51-4f26-4c40-a3b5-53dbb4963c6c", "value": "03a168fe28a43c48bb1b485f75ad5940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8173b1e6-f383-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712345663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712345663, "uuid": "6e320b45-09a9-4929-a58d-645ed3fe3c38", "comment": "Malware payload (njrat)", "value": "e4e13db50a7cfb8b5eb6a6381d81cc46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712345663, "uuid": "0ef19e25-2b30-4364-b590-ec535a2572c3", "comment": "Malware payload (njrat)", "value": "637c1636d88db6b9786d9789f7ab4011d00cb0b99c2439c8c4ef7f9a2bfe2ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712345663, "uuid": "b0811d60-28b2-47c6-9614-b4bed7104958", "comment": "Malware payload (njrat)", "value": "d7943bc20758fcf08caf74a2e6a8a6fc30643022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712345663, "uuid": "b89baa5e-57fa-4f78-bdce-aa81944e5d5e", "comment": "Malware payload (njrat)", "value": "89f5038a2ba0f96e2bd96657ec85a89ee048d4ed1be1f59c810fe13d32a3091b48ea3ce82a67bb8ef60631eaad1f2da0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712345663, "uuid": "809bbae7-6c0b-41ae-b19f-b7280d042320", "value": "T1C3E2F74A7BB94125C6BC1AFC8CB313210772E3438532EB6F5CDC88CA4F676D04255AE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712345663, "uuid": "ec3cf80a-1566-45ff-9696-cf39620ce183", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712345663, "uuid": "c6f9645b-fe8c-45c6-a3ad-628857c378be", "value": "384:q0bUe5XB4e0X+OJiixBr/Q/WTEtTUFQqzFbObby:zT9BudMifrYbpby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712345663, "uuid": "f9f699ec-234b-4a20-b994-aa08b2ea42d3", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712345663, "uuid": "33b5ae66-fbec-4d85-bf5e-3b8ec7a37e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712345663, "uuid": "405bddc6-681c-4ba0-be7b-9080943454e7", "value": "xc4FpSS7g129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207861ee-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344212, "uuid": "817a8567-de2e-46cb-afb7-2569611df301", "comment": "Malware payload", "value": "416ddb46fb0bb3e7514390b2545c5449", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344212, "uuid": "14bfa99f-e82f-41da-bbac-d3598be83a1f", "comment": "Malware payload", "value": "64fc66042f6f41d3aac49e7224162f441cb4bfd7425d42f893b744dc7cd02182", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344212, "uuid": "2e103721-03df-4fff-a11f-42411ff29d33", "comment": "Malware payload", "value": "c92261fa0904e3390d5b00ecc01ade947afb02ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344212, "uuid": "823e2c54-0446-44da-a2c7-859088bbffef", "comment": "Malware payload", "value": "e3900d344cf245aa0b64c4f22f0d646d9fe8181e35c2152a875a82d604cb33edec9cc35cdccd40ff487d69b673447375", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344212, "uuid": "3e186ed9-a319-4b38-9080-998700e2c44a", "value": "T1F8836C56F5E18871D0342EBC8C259268D63B7A313D7A2ABEBAF52D4DDC7D3C1290C44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344212, "uuid": "963298e1-f70e-4fd1-bc3d-35bdb9bf21bb", "value": "1536:32xqjQ+P04wsm1LxqjQ+P04wsmJCcBUN5Ay/y:3Xr8lyr85CcBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344212, "uuid": "cea8c7ea-5d62-41cc-866e-a4ebf5cd9bbb", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344212, "uuid": "34843e16-7a55-4f29-964d-836ffc33ecfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344212, "uuid": "5f197104-8ffd-48b7-b6e2-8c68d90a62fd", "value": "64fc66042f6f41d3aac49e7224162f441cb4bfd7425d42f893b744dc7cd02182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d13ad6a-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712323241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323241, "uuid": "ca0834af-7f7e-4dc2-9175-b975797f2fde", "comment": "Malware payload (RemcosRAT)", "value": "8ecf2c490c81dfc195a95d51033f2e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323241, "uuid": "c4080951-8cec-436b-8a37-9f93fc26179e", "comment": "Malware payload (RemcosRAT)", "value": "669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323241, "uuid": "67167074-e338-42c5-968f-a01c226fd226", "comment": "Malware payload (RemcosRAT)", "value": "555dcc02731ea5df031260a9f94141a6e8301b17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323241, "uuid": "e8541c55-a1f9-4120-b201-fb442b715785", "comment": "Malware payload (RemcosRAT)", "value": "8e78d3c261ff2f8fa91895ba9038ecf7407188e8312184b9c50e5ed3d6610fa2e3aca365933496bb98b2532aaefc2940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323241, "uuid": "34648f25-9ad7-4290-b3c4-028ccd58e559", "value": "T12165D0027381C062FF9B92334F9AF65157BC69260123E61F13A81DBABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323241, "uuid": "5fdbe7c0-eefc-4ddc-967a-64250a45c488", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323241, "uuid": "b2abe4f7-d189-4e15-bcee-b02f64a135f1", "value": "24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8aDSMUB220ZTSVspjHPYnczgFh8OhdQcK:ITvC/MTQYxsWR7aDSjB2hTSu5WLr8OvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323241, "uuid": "615ce6a2-fe3e-4845-9066-692a84d033a9", "value": 1449984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323241, "uuid": "6ba1067c-52eb-4f07-919d-783bd10c6123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323241, "uuid": "44b7cdde-d8eb-4348-b54a-b35b73bb321c", "value": "669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc68e49-f347-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712320045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320045, "uuid": "1c0c3864-95eb-452d-a304-9d224607fe88", "comment": "Malware payload (AgentTesla)", "value": "d32a9f003d7d44f7839d1e73ab0880dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320045, "uuid": "574159b8-8786-4765-83af-3089cd333323", "comment": "Malware payload (AgentTesla)", "value": "6827f81b3add0570684d911484c7c3a75f4d565123261d4173306ab35e998494", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320045, "uuid": "4e91f71b-7f0e-44cc-98b8-2b1c10bb2acd", "comment": "Malware payload (AgentTesla)", "value": "600da56efcbe1f1ecfbf984b6f7f1103e067e43d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320045, "uuid": "57d3a5f7-9b0d-4ebc-9fe6-156f12de943f", "comment": "Malware payload (AgentTesla)", "value": "7f449f2f76b64bb28094cc87a51ca35ef69484c9693298e6dc7797ab95f7ac13f8d62172b801dd0ed2d5726cb9f274df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320045, "uuid": "a04a6dea-86b9-4516-8d38-8fe14addf0a5", "value": "T1A6B4C0E1B38188CAF8A766764C2FD93021B35DBDC491560F71EA7B259DF3352009BA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320045, "uuid": "1f5b8845-c520-4b95-88d6-7c1c2beb0d9a", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320045, "uuid": "bb51933e-a7fa-4e58-b7a6-186b67829d7d", "value": "12288:ZCcSi5DOVYoesQTkvn50uFD4SylLXueay:ZoigJvpaLXu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712320045, "uuid": "98f7c93e-ce63-4c49-b0a6-5606d6d42bf2", "value": 541940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712320045, "uuid": "64c24acc-8baf-4d5b-8a98-2a32ec71d52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320045, "uuid": "ec848120-ad92-4012-ac3d-c3bb58f48599", "value": "6827f81b3add0570684d911484c7c3a75f4d565123261d4173306ab35e998494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7af0aba-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309649, "uuid": "aab53204-5ca0-48ad-a187-e41ff7d97e0a", "comment": "Malware payload (Gafgyt)", "value": "1a372523774c3b4a29c2b83700d4bdf5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309649, "uuid": "f7208b07-6881-4b20-b164-7a3f76190e42", "comment": "Malware payload (Gafgyt)", "value": "68698d39f4ef23469fdcf36d9d63755bb285b6c3c865ed121570519b2ece9f9d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309649, "uuid": "63f52790-66a8-43c5-ac73-2a64b6a4c9a8", "comment": "Malware payload (Gafgyt)", "value": "1c0adbc68723972ebbf7857c1f3d6ecb611fbacb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309649, "uuid": "773d4319-b83b-4ada-8e53-e2caceebe11f", "comment": "Malware payload (Gafgyt)", "value": "e44a32d51a359b402280c31332f9e178bb31d2c37eff2c20b6052c298f012bd174d66c6d3b1496266388fc0e2d8b4121", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309649, "uuid": "42c67644-125a-4223-827a-9c67fe143d90", "value": "T15BE30737F2D18DF5C04B42B226EE9AB29D62F1FF0772311B33A01D706F2A9C61959A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309649, "uuid": "c7c47722-3f68-40fd-b247-d594df734292", "value": "3072:LC8HKooAbEAr1KIfIvlK/ADLphaP1HIl/cm+6VOXFNqOPPe:VEBIf4WMLpha9HImm+6VOXFNqOPPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309649, "uuid": "30f766a2-4efd-45d7-b9e0-991d3a896a3f", "value": 150024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309649, "uuid": "0b03f22a-6cad-48a9-adb4-31663e4fab9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309649, "uuid": "6f03d790-2854-48fc-95c2-64fc9e25c27b", "value": "1a372523774c3b4a29c2b83700d4bdf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21816cf8-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344213, "uuid": "a4a46982-a4f5-462a-8531-087e82e8e1bf", "comment": "Malware payload", "value": "b883787fee80f7c0b9347bbc3989146e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344213, "uuid": "f757c528-5435-4a31-8314-cb4f9f5ae10a", "comment": "Malware payload", "value": "69725114dd1f89e7b21114e8f5c00c14d195b342a458a396d74c86dac3ee47a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344213, "uuid": "fae602f5-1199-427a-9d8e-bbfddd98eca8", "comment": "Malware payload", "value": "b0f6d845e93d8c466e390a1c0324395f48dac4c0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344213, "uuid": "1e090e71-993e-4827-b104-758a27bc293d", "comment": "Malware payload", "value": "b8fbc5310559d957cceba75e921e65c029617958284e06c2963df68fdceea10a9409a1cbbd9c453f61b5c0138c1c63df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344213, "uuid": "fc08303c-d90a-4c75-8368-73ce1de8ae7f", "value": "T1DA842942E3A44AF6C056817489E2DA32FA71BD650929376797D0CF3B3E227717B1EB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344213, "uuid": "41f13dd7-252d-45c0-9872-0658c470363e", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344213, "uuid": "0c8ac5e5-aeb3-4b93-8108-c434b148ccbd", "value": "6144:k9brjUn3IAxFMlgUO994Vygx2/Yj2kc2HYAbxRG+1Jm2705hd1:MChpN994Vy7YjpGqT0l1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344213, "uuid": "b722ca09-dd23-4011-9434-250bbff8eb23", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344213, "uuid": "1fbf300e-2263-40d1-acb9-b9d2968efe75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344213, "uuid": "901a8f2c-176a-4817-bd42-baf66825275a", "value": "69725114dd1f89e7b21114e8f5c00c14d195b342a458a396d74c86dac3ee47a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7bfff4-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712323483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323483, "uuid": "5cdeab40-7205-44b8-929e-1c5343c987e1", "comment": "Malware payload", "value": "a7eb0ae275c44199f159c9eafa6309e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323483, "uuid": "b0efb669-626e-43f4-89ac-b0eea40297a8", "comment": "Malware payload", "value": "6a80b9dc6b924943b88fe9bcf4ddf9ad3bddb4b544537db7aa6be2b5e66c17e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323483, "uuid": "32ac93a5-cb36-44f1-8491-d956b9642047", "comment": "Malware payload", "value": "39fc9e9c90d0da1c0fcd2b47f3f96e177acac986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323483, "uuid": "e010fb0b-6cfd-4d1f-9d04-eb741854c4e2", "comment": "Malware payload", "value": "edf6eeb19bb9cfa17f83af7422de2285a38b159cc8511273f277dbd829026330c56396e3794c1733737626c34beef52b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323483, "uuid": "c54310b2-11a7-49de-b1d9-eafc3ea6b9ec", "value": "T1919733727046A8B3DBBC25B642E587B2F67DB81AE921F506329550B7FD108C886331FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323483, "uuid": "109125db-1283-49e8-a779-93c2feab0006", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323483, "uuid": "bf47bedd-0d9b-45ef-a868-50ab8f89a770", "value": "786432:6ce48FMXwJl0xu7qjdvA2g57lGTtoEm02ebipCx1U0W8wz6c0P96Q5ETuZZcDBaO:x6MgJ4djd42g55GRm02mWO20Wxz6fP9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323483, "uuid": "04ad9040-59af-41c2-8bab-ebb8f2486f4d", "value": 41610929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323483, "uuid": "a59e0213-43d4-464d-b415-f2d29972e16e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323483, "uuid": "b69f7136-2815-4219-bff5-ae4295ae91a5", "value": "SecuriteInfo.com.Java.SuspAttach.19225.14476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d587cc71-f345-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1712319175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319175, "uuid": "c3b1e99a-2125-4d77-8f96-155d39897e69", "comment": "Malware payload (NetSupport)", "value": "06ac7c7f4dee7d87b322e1867c18edae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319175, "uuid": "d228d522-5fdf-4bcf-9c5d-54aa9939e164", "comment": "Malware payload (NetSupport)", "value": "6aa5563dc0479af1b8282e7bf6779b495700f739fc877c484fc302696f36cddd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319175, "uuid": "51a81bbb-e855-47af-8c61-237c4ed62119", "comment": "Malware payload (NetSupport)", "value": "3c96743309a6cf764078e4af072a052952f3cabc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319175, "uuid": "b2cef8ba-08bf-4edc-80a7-91bd155c44a3", "comment": "Malware payload (NetSupport)", "value": "9445b5f9b3255dd8319b40d22751e6c78de9b07fef17f7cebeed24d472daf6a60e5aca5e33647f27704830f91423caea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319175, "uuid": "11e5ef29-a1a3-4c46-bbee-b4bada3cec66", "value": "T1A4B46B59B211337D9AFF63BA207F23052333A5AA74168868B478D5E02D6CD895237F7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319175, "uuid": "fe85e257-ca20-4126-81ff-04260f54444f", "value": "12288:V77tS0VoYPgs77tS0VoYPgg77tS0VoYPgs77tS0VoYPgM:V77t777tZ77t777tN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712319175, "uuid": "c5891508-3e80-4e74-b1ed-602c6a2f3c8c", "value": 521117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712319175, "uuid": "d8ba982c-7d97-4c12-9d6e-b9a082f286ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319175, "uuid": "d2426ed7-b368-49c9-a386-d82c84cf499a", "value": "update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73203e8-f358-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712327392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327392, "uuid": "cfbc08b1-8b4f-4e26-8458-d42261c44b2a", "comment": "Malware payload", "value": "d856b1a367b6ae1ae9dc7d8644169fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327392, "uuid": "f99825dd-6b0a-449b-8958-670a5ed116ac", "comment": "Malware payload", "value": "6bef0e292558bea1ab8846299c6af9bde762e43573a54ac8fb91811c3c4f8a33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327392, "uuid": "098f37da-57f4-491f-a642-87bcf9835d00", "comment": "Malware payload", "value": "a305926ab738d134b630a867fabcaf27811aa95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327392, "uuid": "2c784d49-4ad8-48a2-a8b6-18de8602b4d4", "comment": "Malware payload", "value": "b3f1c74a07253d968a598263476fa50fc1955e1f5c97faa579e61330034e7627e567b574eb9226ba2bd75fcbdb670555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327392, "uuid": "34d52487-46ad-46b0-b5d8-251d332aed8e", "value": "T14F55B04BF392BD5ED1627438C0A6A37397727824532247DB378F8435EF4A2E09E66784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327392, "uuid": "fbec5653-eb25-4c66-81e4-6ba9be85fc63", "value": "1ebc56366951f0b8d889ba1f414e11a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327392, "uuid": "550bdc99-0bbd-4497-bac8-e04488905b48", "value": "24576:sB86xEAn7XfnRu2kZAhJXfeWCTLpXph+eDBkTll:sB80n7X1wwuL1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712327392, "uuid": "47f9468a-8be1-45ec-a4c1-467109adcc9a", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712327392, "uuid": "589555fc-8b82-4979-9f42-43982702e914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327392, "uuid": "2d924a9e-7f12-4a77-997e-e4d627f69aec", "value": "SecuriteInfo.com.FileRepMalware.31304.6753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d9f691-f35d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712329373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712329373, "uuid": "95cd3071-cb98-4044-9b03-9c6839678d99", "comment": "Malware payload", "value": "634197365295ceae7104357b3f573487", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712329373, "uuid": "587ea7d8-eff9-4615-baa1-b442d4625465", "comment": "Malware payload", "value": "6d54dda9e14d5c38bea8f1b336e9e0eaa856c5d876b64d5e01d325dfcd066762", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712329373, "uuid": "558cd857-be5b-4a08-a8ef-56e5b592f60c", "comment": "Malware payload", "value": "86bbbc78b677f083a29d4586b940ec8b8569181a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712329373, "uuid": "b53aef2e-7492-4ea2-95ba-e02e465d68c1", "comment": "Malware payload", "value": "ee0de105b92badac566e510c820355dac40a0ef1c6545d19f3673908abf54d195aa7ac299878db3b979dbf42bc927bfe", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712329373, "uuid": "55fabf4a-70ad-4f03-8f44-58a9210b928c", "value": "T18B62C0134DC76BCDF12DC3F8EBEE7B5B55AAA864D11F8EA90600059047861ED0E1EE36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712329373, "uuid": "c0005bc8-c070-49a6-a409-240f050fdb55", "value": "384:u53cVMS5zx83Rpzta94tkfmNOJpyb8mgECY3A2IRRDVk8aR:XVMS9ml89+ZNOJp4+xnfRRDu8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712329373, "uuid": "8ec3c58e-9b0c-4688-81cb-661e1c50db09", "value": 15905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712329373, "uuid": "1078cd45-515c-4b46-848a-a3dd98cfaf53", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712329373, "uuid": "893733ec-f378-4b21-97d9-9d39d14123dd", "value": "DOC820-820820.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdbecf8-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343996, "uuid": "473ea572-48b3-4135-866b-e1bc64fba288", "comment": "Malware payload (Socks5Systemz)", "value": "e9b417eccc39d158f82863f8e513587b", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343996, "uuid": "5be289f7-a13c-43f7-a701-72317e0a24c9", "comment": "Malware payload (Socks5Systemz)", "value": "6ef4aae5baff4d0c7d1e36a434dba594a3456b7922e72466fd1a76cfb0d6df5d", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343996, "uuid": "157c25ae-6500-426e-8685-595201d47de1", "comment": "Malware payload (Socks5Systemz)", "value": "1a9cc23c925b749f91133bc92fef97302ec723b5", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343996, "uuid": "c0962443-a704-48dc-bf32-8490fe3eb422", "comment": "Malware payload (Socks5Systemz)", "value": "68a5402a0e044cc52a2d4429135a55d1313ca904d93452c0d0238eec0e2c3d9c7867c90063b0ca3739077eb923c87183", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343996, "uuid": "90305115-ecaf-4826-b140-caae0eb57cd5", "value": "T18EE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343996, "uuid": "a7d8d207-b860-48e9-9109-cd570f91227f", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343996, "uuid": "a4ff7c8e-4ca8-481e-a0a5-98e6da2b6e15", "value": "12288:sjsgiZdvAeRw3+auHJ50cClvBqIPcvpWwZtmdRKLiTOkoRpeHimkniIjcBDQg5Ey:6sgwdvAOhp50cClvBqIkvpfZtmdR+iT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343996, "uuid": "bd4e364b-ae5f-4d71-b64f-1fc2ed9ef427", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343996, "uuid": "36313725-eedd-47c2-917e-4d45b7b520c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343996, "uuid": "b2df46fb-752c-4960-93dc-a25c1beb0ec3", "value": "6ef4aae5baff4d0c7d1e36a434dba594a3456b7922e72466fd1a76cfb0d6df5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ca208b-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "dd0c2bbe-9790-4e47-ba32-c28b3cf6f366", "comment": "Malware payload (AveMariaRAT)", "value": "f162051a9bbf0654b6e528b601b048b5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "c4b38e4d-b956-4816-97c9-2495d1184712", "comment": "Malware payload (AveMariaRAT)", "value": "6f00f39f32bb3556f024b6e877337a8e6ba5a2feda5d1187e85684de23471ff7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "ed7e4f0f-4635-42b4-84b2-f7a43287ec6c", "comment": "Malware payload (AveMariaRAT)", "value": "19af80d9fb075026bacc9a56aae68d84b36cc123", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "adb13301-63e0-40d8-82e6-aab149478387", "comment": "Malware payload (AveMariaRAT)", "value": "d26d5d3e13219af929d9d2992a4597301b4f469999b9714ae8976ae346faa06c10b62384d0a1ec3fad97f2c800d8f632", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "355fc427-305a-4629-9acc-f768a91a5a35", "value": "T121E37D227BE54039F7B705701AF93E25D7ACBE310E31CA4B5BD4488B58B1589E9363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "bd022d87-106d-4ae9-9202-ae5fb4918acb", "value": "0145d2c473bdbcd7b46a054bd6893ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "dd30d2e4-f849-4a22-84ce-02a73cf31580", "value": "3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwjw:2dx3wqz3ZcDeDKYzqG01wjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "41f58b5f-27a4-47d4-a5f2-0b4096d7e6c1", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "3fa8dbf7-439c-4764-aed1-fcd700d1e8d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "670a9a28-e343-4597-a034-d00b70fa1a3a", "value": "171232524697e35246a2c30a489356b87d3c5303ea4c887116c0c70f131b7f9e7ded60e56c137.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb5d0a3-f2ea-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712280074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280074, "uuid": "97052eb4-859f-4427-897c-9e52e65741a3", "comment": "Malware payload (AgentTesla)", "value": "71be9f51632e4bed46fbcddb42abeec3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280074, "uuid": "324b82f5-c366-4063-8402-28606fda2794", "comment": "Malware payload (AgentTesla)", "value": "6fd8e845cfa1bf8f809f0f372c2d4e955c6a3b6c0e88fb8f474a2645f587ecf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280074, "uuid": "29d1597b-7edb-4e20-b880-b1e2bc3c6fa9", "comment": "Malware payload (AgentTesla)", "value": "1d6190e891027b1b80a58b8680a1bd508d8a8932", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280074, "uuid": "37e0ef00-d0b2-4637-9947-053dd2c3861b", "comment": "Malware payload (AgentTesla)", "value": "24513a679e5125556072ed7c3e965c1a1dfbd78ea06656116b4821c4032fa38c5b3ac07d5e7539b55cb842dfa1a2fe6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280074, "uuid": "ad58612d-3b05-4816-a8e5-b7378162176e", "value": "T1A3E4E08C355076EFC8A7C972CEA82C28E66135B7530BD243A46712ADDA0DAD7CF154F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280074, "uuid": "6e8de6ed-3556-412d-8c25-46e2adae75e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280074, "uuid": "af040a56-178b-440c-a169-27c0d7c4936d", "value": "12288:CuUHqk0Au1p5AVSbzDzAGlV9C9mqiZVzfo8Ps7pI6Zl9vnEiAJtXJJvJn3Gfgk/:4HJ0AMX3DzdkivzvPs7pIIPn5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712280074, "uuid": "b31236ba-1575-4083-bf06-507c609a96eb", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712280074, "uuid": "b3578118-68c7-4b11-b364-ed90da88a3a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280074, "uuid": "7059318d-e006-4996-bef0-6f5fc5541887", "value": "SecuriteInfo.com.Win32.CrypterX-gen.2006.1539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca748596-f2ea-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712280072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280072, "uuid": "c06c3e29-9044-40d3-b4dd-74114b46954c", "comment": "Malware payload (AgentTesla)", "value": "42ccbe82ed5e8371bb22119c15839d2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280072, "uuid": "bb219ef6-69bf-4c57-bb09-4fff26583736", "comment": "Malware payload (AgentTesla)", "value": "704427aa451d261a1a92a6e834a1ee2be50971a012e711f9f660403904a9622c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280072, "uuid": "ade9b0ea-42e5-403f-80d4-41d2e0490237", "comment": "Malware payload (AgentTesla)", "value": "59aca10355bdda9c5461d283d62e4df67085ee34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280072, "uuid": "afa93082-57ce-4291-8ab1-fe308ad871ab", "comment": "Malware payload (AgentTesla)", "value": "2a7c11cb50417d59abdbd4ea041952488edf4a33b12c0d05d67ab70282c7446d1739e02f7ac503849d9b006da21d8a0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280072, "uuid": "453312fa-40e8-46cb-a7f5-3edbd9470b01", "value": "T1EBD42311377ED73FC6260FBE94E12E0953F488267896DBCAACC0B184968E7E411D45AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280072, "uuid": "3912c8b3-789a-4987-a4a2-a64dd270009d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280072, "uuid": "a3756c34-6445-420f-b50e-64d54426ddbd", "value": "12288:/8UHiWHJRBDgJVQoha02CXwS3UlA3osCymrW2rvk:bHzHDBDyQoFEGojymrvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712280072, "uuid": "2981994f-01a5-4e22-b560-5e3648d5a9bd", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712280072, "uuid": "ab72ff3e-8d04-4d87-913a-42835455a908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280072, "uuid": "bae2405c-8f69-4813-93f6-a39bc991aca1", "value": "SecuriteInfo.com.Win32.CrypterX-gen.23422.3824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea26ffc5-f314-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712298164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712298164, "uuid": "d3ff6225-c2a2-4c76-bab6-b060fd2d045a", "comment": "Malware payload (AgentTesla)", "value": "217545aa229869e2829dd537f5ff02c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712298164, "uuid": "0c799cd8-8c70-4ad2-a198-fdb006b4ddf9", "comment": "Malware payload (AgentTesla)", "value": "70517116e2400906af6125849ac27b66159a45f6f1782178351e82bfe5ba205c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712298164, "uuid": "1b4ef9e6-c9bf-4d4a-b441-1f3cf7d6e89a", "comment": "Malware payload (AgentTesla)", "value": "1f6dbbd1ba7b375448a4611c28b75e32d4ab4642", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712298164, "uuid": "4e148009-5ad7-43de-b471-2c9f9a64547f", "comment": "Malware payload (AgentTesla)", "value": "88bb68b3c82a66238f15ade17efb3493de095e9e57abe4d56107390d1d9893bfd2f685756d6dfd5fda8f168fd5796142", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712298164, "uuid": "de27f672-eb57-4d0e-891b-921ba60c9a36", "value": "T19AE412917B2BEE60D3BD5A31C276201A0773BA862133DB0E7CCE53565582BE219C5B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712298164, "uuid": "953062c3-c461-4b9f-bcf3-6567afad791c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712298164, "uuid": "d060d80d-e69d-4b56-852c-9e51e2d694b8", "value": "12288:kiUHr/ui4jslIKtUWAcNiXgZvLbEGydgjI07CJ8qY5QYaBdV65kR:IHKi4jsqKtUW/5vLbR7jI0eJ8Brc6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712298164, "uuid": "8a8908f0-bfaf-4c91-9c92-76901ecb75cd", "value": 670728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712298164, "uuid": "c2735cca-4ddc-4733-8f24-491de368648f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712298164, "uuid": "26711857-f951-4696-8082-0272b9a2f509", "value": "Payment Advice_1660001165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b789830-f30f-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712295858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295858, "uuid": "cd147ca2-9aad-41a7-8fb3-5b9b1d8ae87e", "comment": "Malware payload (RedLineStealer)", "value": "ca4e17f76bf0bdb4791f131a82aca295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295858, "uuid": "de021d64-760c-4c1c-b158-28d83051cbea", "comment": "Malware payload (RedLineStealer)", "value": "70878cac9a4cfcc99128ccd8223b3988ac902f39fe7c30d32d05c5bdd161528a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295858, "uuid": "8491fe81-8b54-4131-b9e2-b3ecb29e38ea", "comment": "Malware payload (RedLineStealer)", "value": "b48b236a1183e2e6e4eef1b5d657cf1daab8640a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295858, "uuid": "be47b4e1-e741-4648-8db6-d48148447dd5", "comment": "Malware payload (RedLineStealer)", "value": "1a7dc04cb92b46918c99d2361bd1912f561177ee56e266d46a1929cc7d2eac779f0f6e2ecbda5f69250b4aea10f3c3b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295858, "uuid": "d3d5be0e-3e66-43c2-8066-a45b2b22e5ff", "value": "T14A45BF0273D1D062FF9B91334F5AF6115ABC69260123E61F13A81D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295858, "uuid": "febce19e-1a0b-42fe-81b8-90aefa964c44", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295858, "uuid": "df8d2af5-054d-4948-902d-42f0e799972b", "value": "24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8aIBjBiBqESQ81EZJ:lTvC/MTQYxsWR7aI1BbBSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295858, "uuid": "06ae3037-803b-42ae-bc4a-9bf22237dee0", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295858, "uuid": "5863834e-4c22-4cc5-b47d-c40e7eceb05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295858, "uuid": "d8accba6-6442-4525-97ff-91490d6433fb", "value": "INQUIRY#46789-APRIL PDF.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b9c97e-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286638, "uuid": "fcb68f8b-fb2e-4d37-a169-33a792ecafdd", "comment": "Malware payload (Gafgyt)", "value": "be1b7b6d1dbf03f8df62763bd94c16af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286638, "uuid": "7d0a06d1-92a1-4313-b589-a000e4224657", "comment": "Malware payload (Gafgyt)", "value": "70ebf8847588cf944f163659b46420d2d6f21bc32dfe4c801217f1a4898bf49d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286638, "uuid": "01cbfad0-5086-4a4f-8294-0bb5d8b2a957", "comment": "Malware payload (Gafgyt)", "value": "b67b2b496456a81b4f9755333e7e312eb41986a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286638, "uuid": "9e7c92c6-d036-4a4c-8d4c-fde366b1e7d3", "comment": "Malware payload (Gafgyt)", "value": "706eec97825a0e069213e8e429cd7f64f64a3cbdc87f42de4bff3411f11d0021529b6e5c2430ef10c55e21d4226f95f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286638, "uuid": "5977ea26-5b06-4f6c-a5e4-b05f7768d299", "value": "T13904717AB7618EB7D80FCE7305DA4912188C968652E93FABB3B4C528E75784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286638, "uuid": "1176122d-a461-4106-8a15-3647bc71ef61", "value": "3072:aaF7XSy6Cv9RDT5hCs1ZQhmv8uqx1BVnKoe:aICGVFT5hCZhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286638, "uuid": "935bab59-455e-4a5d-8516-31282f4e0825", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286638, "uuid": "bbb65b9a-b6a7-4b60-a0bd-f39d974423bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286638, "uuid": "9c597a7c-8dfd-4b35-bc1c-87c3c8963b48", "value": "be1b7b6d1dbf03f8df62763bd94c16af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98028753-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712321219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321219, "uuid": "d568347d-6a05-42ca-99aa-b4ac53754325", "comment": "Malware payload", "value": "df50f255e5d3b91c91086040e884c2cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321219, "uuid": "834b8f1d-65ae-4dcd-8865-18f8e2eacc17", "comment": "Malware payload", "value": "71590c7a1fc3ab8e8096af9afc0e4da2f9f451b5b0cc37200c2f3671ee282e77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321219, "uuid": "800c37f8-cff8-455f-a5a3-94ec6762801a", "comment": "Malware payload", "value": "982a84934790b868072c6fac71ddb299aa425d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321219, "uuid": "24828234-2c0b-4546-a17b-510a4c0b1a7f", "comment": "Malware payload", "value": "500a4626d044bab9f92eda3923c348ae3e4fab093ea1d9984517f9273297301404d6f266746b43a918ef7c333db6c9da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321219, "uuid": "ee1fc8b4-cb7f-4529-9afd-8a826d08b085", "value": "T1CBC4121067FE413EEAEF5679B87421000BBAFBA7A502D7DF9C1055EA6963BC00721367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321219, "uuid": "90456543-6733-4407-b432-53e3620ea895", "value": "12288:Gf2Ov+kR/c07tYZLyOJ1nlffll8QNOBf7sjqDz6/wM5pu+3:wFRU0BYZOEvlHkojSz63V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321219, "uuid": "dc006e19-e6bc-4888-a690-596b918c4b77", "value": 580609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321219, "uuid": "d9c27a45-6b67-444c-a760-e3d3e1dc6ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321219, "uuid": "8dea32e1-3ddb-4836-9134-4b0a95650a32", "value": "71590c7a1fc3ab8e8096af9afc0e4da2f9f451b5b0cc37200c2f3671ee282e77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de71aa55-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712323485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323485, "uuid": "75b4b789-4d74-4a0e-95bc-469a44982f4e", "comment": "Malware payload", "value": "6fcd814cd0c069d53c1af8ad8d6b2bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323485, "uuid": "eb17ba00-317a-49ec-88f7-d4d16c7548d2", "comment": "Malware payload", "value": "7252992878960d08b7fbbaae3be981fdb502627889f52e4c5426955df780712c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323485, "uuid": "0a34420b-091e-4d93-b3c5-177e2db0ab00", "comment": "Malware payload", "value": "a31472f7b5cf99eababa8d1f613a8f9cfeb4b598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323485, "uuid": "6493e848-1967-4be8-a0b3-245f721342fb", "comment": "Malware payload", "value": "eabf2fc680c93a7e26605f89bf1d38381699f72208f3656ec1849f18c43455df202a57e636fc436d0a09950870641753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323485, "uuid": "0e322eee-319c-4b45-a5c3-51f446488fb0", "value": "T17363E723AA55D419E11546F0ED6595F524AB7E32C462AD0B328FFD2C3B72683A8F031F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323485, "uuid": "0a95632e-17e4-49f7-ab02-52d9ee15c85a", "value": "768:u6gWG6qidRrDC9jVZHnNJ8DILHS6cm6C/XDQpV33:TtDC9jLH788LHS6cm6QSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323485, "uuid": "2053a5e5-39f7-4811-a05e-a55a28b408db", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323485, "uuid": "884d934d-4cb3-4b32-afd0-95a3c5242b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323485, "uuid": "2a3f694d-347f-4928-a751-948ef8ce469c", "value": "SecuriteInfo.com.Trojan.Heur.VP.eeW@ai@BM@e.24482.29824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37fd823-f2f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712283899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283899, "uuid": "9d936bb6-6378-483d-b017-e2214da4b032", "comment": "Malware payload (Mirai)", "value": "60364c93ddc6fb02c2e457f0bbc13138", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283899, "uuid": "c4d210f3-18bb-4414-8b59-aacbd11b60e7", "comment": "Malware payload (Mirai)", "value": "72c7ef11df6b648f23f12a22aae025a5454d3892bb987611795805face5297b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283899, "uuid": "505deb07-0fe7-4aa3-bd01-7f66c5e689fc", "comment": "Malware payload (Mirai)", "value": "e6fc6f81e799c843c16e0ca2eef0529c16d8e27d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712283899, "uuid": "6b1c5872-3502-4ddc-bfb8-dd305945f33b", "comment": "Malware payload (Mirai)", "value": "75603975cfe2910e2bf02744cda31a5ba7cf184ad74f9aa67c51a5635091784b39280a08bf00b560ea715cef867ca782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283899, "uuid": "ae1c11eb-92ef-4b96-b453-215016e21eb6", "value": "T11BA3C509BF510FF7E89FDC378AE91702388D941A21A47B76B574D828F24B54B49E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283899, "uuid": "8e29fdd4-cc4b-4e4e-baf3-115d08cb63ce", "value": "1536:uI5ETw86eKnkV4gtqRq522ykUiIh7NQVJ9AfoJ1ZVbi7N4RsgwbZnLM:uI5ETw86V84gtKq596UOfc1p1wbZnLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712283899, "uuid": "a834bcab-4210-4153-a9ec-43db76f4d76c", "value": 105360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712283899, "uuid": "36662925-9dce-4e67-b140-9c227b1ef544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712283899, "uuid": "861f8185-5cc8-4c1a-a6ba-a96c797f7610", "value": "60364c93ddc6fb02c2e457f0bbc13138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6a0998-f345-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712318972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318972, "uuid": "823301c2-09f5-43fc-835a-466108a25fa6", "comment": "Malware payload (AgentTesla)", "value": "e05d8c572c8f93d6f208f2ce14f6ef87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318972, "uuid": "55c26307-6df9-4289-b33f-abc8f3644921", "comment": "Malware payload (AgentTesla)", "value": "73599936653d9327d6353a3d93d3db43f4c5a38e33f861f781f95f683eba02a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318972, "uuid": "40dd22ad-9250-4de4-a380-a24c5ca89325", "comment": "Malware payload (AgentTesla)", "value": "179c397f765461ffb12abb91c0335592427ed5dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318972, "uuid": "513c6ff8-dd7d-4239-940e-1605adb7edbc", "comment": "Malware payload (AgentTesla)", "value": "f4b3006ed9cf83055d8fbd4590483a107b29c00e49ad4464a612d23488edbc405035036f92ebcd5f5646e2745821e4b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318972, "uuid": "aa57c2b4-c338-4be2-8f1c-edb2f7af08c7", "value": "T193E4235F80627E13F329B9D7E54E4FE808A5A564EA2CF0469B458E0CC1B39D03B98C67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318972, "uuid": "82e92a70-15e8-49fc-8478-d16fc4cf280d", "value": "12288:Z+Q57+mTQKeJX5dOpp7/DTNLIU73roQQ7bq5t/IRhDeEI:l57+mobWZlIuox3q7/I9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318972, "uuid": "cd5d99cd-8ae0-4dec-8abe-adaf5fd641d3", "value": 685129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318972, "uuid": "e829dc15-8b8d-4481-8448-257828f2e306", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318972, "uuid": "e8bcf5ed-483f-4358-9b11-02543cb4b1d4", "value": "\u0391\u0395\u03a1\u039f\u03a0\u039f\u03a1\u0399\u039a\u0397 \u0395\u039e\u0391\u0393\u03a9\u0393\u0397 \u0393\u0399\u0391 \u039f\u03a5\u039a\u03a1\u0391\u039d\u0399\u0391.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8877db03-f2f6-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712285116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712285116, "uuid": "3f959f1c-3058-4206-a01f-bb41829853ac", "comment": "Malware payload (njrat)", "value": "2f0f688519cf6a7d3a73102fb0a67d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712285116, "uuid": "4087a65b-3e2c-44ab-b8ea-75009c89ed5d", "comment": "Malware payload (njrat)", "value": "7398b95f4ac56dfe5d4fc93f73fe94877fe267e8a6737dae4fac58273978c23a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712285116, "uuid": "959675ab-e2c1-413e-8b2e-ddc7d9ef1d41", "comment": "Malware payload (njrat)", "value": "c423d50e04229ddeebbf1950338f8e79fcec36fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712285116, "uuid": "c5676252-4d4e-4fde-82e0-a9c22d8d85a0", "comment": "Malware payload (njrat)", "value": "225138c08d2f0a759612e6ffedbc0992951e43557b0ab651e70b516ea443a9ad6f02fdedaa36e0ee898b2ad220dd7fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712285116, "uuid": "1dd4f383-bd3c-4f67-9aaf-dfc4d3400d21", "value": "T1DAB3FB387D952133C67EC1F689E50A8AEB69223F3191E9ED4CA742C418B2F166DC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712285116, "uuid": "4f905048-8431-4bd0-ab67-ea1c9e39a493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712285116, "uuid": "3371cfb3-fea9-4e4a-b7cc-d9377a10a607", "value": "1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBl:w5eznsjsguGDFqGx8egoxmOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712285116, "uuid": "a5392771-f2a2-4319-b3ff-ca19ea996a80", "value": 110528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712285116, "uuid": "2e24d714-becb-43bd-9637-dbe4ecb3277c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712285116, "uuid": "e5a8c2c9-b972-4c47-897b-4e93b8d07a3a", "value": "2F0F688519CF6A7D3A73102FB0A67D43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f667bde5-f343-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712318371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318371, "uuid": "743f262b-c05b-4d42-9841-ac57f85baf0b", "comment": "Malware payload", "value": "4d1ad3cc8141ba0d35c15f02ef497641", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318371, "uuid": "9b5d740e-e180-4f00-b0ce-b0fa9b605993", "comment": "Malware payload", "value": "73f0fc661c8dcdaa8282da6f4798eb676a691dcf84cfde721479fd904f968699", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318371, "uuid": "a4e9ef74-6db4-4064-a462-43182cb2e28d", "comment": "Malware payload", "value": "2181025dca3f0eb09cc012fa00604d6da5e4427c", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318371, "uuid": "f0a5f550-3881-4064-8780-0cc012527642", "comment": "Malware payload", "value": "ffa4c8ca1da6b9d07e9d8e26becf47371a135643b9485001be2e480d0ed022c1ce442a4da77dee76f3699400a6756346", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318371, "uuid": "0dbde1cc-eac6-4a1e-a50a-0f5a5054b0d8", "value": "T1B7A2AF24E6BDF815C29B66BD405E04F2621E4141CB88AB4F3895EB9F1BC55BF03CE5C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318371, "uuid": "32e5061f-debb-4c4a-b57e-b779295492eb", "value": "384:zFqHyeDUlM9z6plt0oD4h/vZDHUZEki1P4RaM2xP:zsSWxWp+DXki1POB2xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318371, "uuid": "b4bdb0dc-3d73-4ba3-82f0-fa4b119dd1c1", "value": 21511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318371, "uuid": "f3d04d6c-c069-4306-b21a-1c27f525db46", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318371, "uuid": "a419857f-74ed-47ca-a03c-076595561ab6", "value": "Murat-TextAttack.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b19268-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286633, "uuid": "718573c4-3ce9-4a35-a890-1cb5fa0e1133", "comment": "Malware payload (Gafgyt)", "value": "f8c76807db1e7edd1db050a24e277b9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286633, "uuid": "8c8fa6a5-698b-4584-a80f-f5f270ace54f", "comment": "Malware payload (Gafgyt)", "value": "758ed311462f04ef6e9ec173a04459d168038fb27f0825ce4bae2aec655677a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286633, "uuid": "f059c980-4ec5-44d0-acda-b8c699de205b", "comment": "Malware payload (Gafgyt)", "value": "9821f7882a2c112becfe2f58270fa47e0c6f94e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286633, "uuid": "ec2ec5f2-8738-41b5-8f16-17ce2635dbbd", "comment": "Malware payload (Gafgyt)", "value": "9cecf72ec868d4879f5edbbf53f35bd0fd5a60fcb1eb0176d520ef22abedac7c52f7daacb7069cdd63a70e014a7014ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286633, "uuid": "c7fe1db8-86b8-4137-b701-b90fc8327a9a", "value": "T1C0D30977B61C0793C4C706F11D6B3BF28F68A2F312E761C5661ADA908B739B61412F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286633, "uuid": "fe54200d-14d3-4286-b105-8d91a5e8cfe6", "value": "3072:eVrQyEDCvqBvpnTy3P5hgrJ3JCI0Dmzj0qDJAGyoze:eVrQyEOvqbnT8P5hg6I0Dmzj0qDJAGyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286633, "uuid": "b0c7e74f-fb1e-487d-a8c4-189801b9c0ac", "value": 141485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286633, "uuid": "3279d515-01e9-4c81-8d15-bb9eab8b5a67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286633, "uuid": "077882e2-ce40-4d76-b543-2415e56fc23d", "value": "f8c76807db1e7edd1db050a24e277b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bc0c6c-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712323474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323474, "uuid": "978216b6-3297-41ef-a9a7-6b32714629cb", "comment": "Malware payload", "value": "6ba27c0cedb593b7ab21cd66eee82897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323474, "uuid": "37760917-97a9-4fb8-bd60-206839b57175", "comment": "Malware payload", "value": "75ee25b2897e5555391d0450c627316fc2e7837542aa141cf32a5b41935020ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323474, "uuid": "d2afa26f-dce9-4806-8f7a-2a436ff440e0", "comment": "Malware payload", "value": "ccd4d097658fea8f4bddc209b6e739c01242739b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323474, "uuid": "1b338f72-2e00-44b0-a4cf-29f05a7fc0f3", "comment": "Malware payload", "value": "8d1730c6cdaaeb27ad232a72ec24f377a2b82755c66f47173ecaeff650aabcc0d7f85b55d055a4d1fe44329dec74ac6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323474, "uuid": "cc88c0de-0810-4158-bbe2-4c2c05e858cb", "value": "T1495623BE20705D9AC9D7997A346002EBFA64D1A88EC7CBDC78D18AFE5C0B19CD58C560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323474, "uuid": "ebbc62bb-1141-4df2-bcb1-80bd5d668288", "value": "decf7a566c1c48204e314d1f4392e854", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323474, "uuid": "009ff59c-f5fd-4d27-9da1-609b1c3afd7f", "value": "98304:HUNbSE4hgY1en/xBOTBw4hFz6kJ2VgyDAci1LriVLUvdeAZV:0lhYgeeGJhFzhygyDfSPihU1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323474, "uuid": "d9d06cdc-1cec-4cab-84b0-7d15d41149ea", "value": 5931024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323474, "uuid": "225db2bf-0e09-4fe5-9c77-90303b70dbe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323474, "uuid": "795a7c64-16ac-4855-85ed-312e6dbc4862", "value": "SecuriteInfo.com.Win64.MalwareX-gen.27822.32442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71f31cd-f361-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712331257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712331257, "uuid": "6aa5a8c8-f68c-4d7d-9678-757e14170ade", "comment": "Malware payload", "value": "1f35a3e2b101ccc86238375ce8bf4570", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712331257, "uuid": "7e41305f-a45e-407b-847b-480cf1078778", "comment": "Malware payload", "value": "777ee34b630d98f50ef25b585f36f198832f01a34a643ee6a5889ab71bfcd8d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712331257, "uuid": "51efb09b-f9ed-4922-bdb0-2c5bf6401f49", "comment": "Malware payload", "value": "4f47be3b055bd0f30cda0952cc48ba5d06fa8a43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712331257, "uuid": "980550bc-f04e-43b3-a611-f83f99c47599", "comment": "Malware payload", "value": "fa0b33d11824770b5c93cf16187c664147ffc6e4655ee3480b184d81335bfd9a48afc337762bac04633a4733db74f177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712331257, "uuid": "71807998-bd88-4838-ac04-e9b5eeaacfdb", "value": "T1CD16AF4773E7C1F9DA7B81FAC9210226EA71746007389BDB25A0462EDF63ED05E3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712331257, "uuid": "5f685b8d-c042-4aa6-934d-d65a7116b582", "value": "ce1444d915054b4e2ded192c44720156", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712331257, "uuid": "fe3a5e5a-e511-43a3-8823-dbc0e8ce9334", "value": "49152:mAkTe+d8lTHJ9rGW/j2+aVL+i4qyAkTe+d8lTHJ9rGW/j2+apAkTe+d8lTHJ9rGV:moFj/jC94qyoFj/jCpoFj/jCIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712331257, "uuid": "b6d4e122-a767-448e-8640-43ae0d26f13c", "value": 4065280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712331257, "uuid": "20f9da04-4dfb-4961-9a78-98a2ad4ee486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712331257, "uuid": "68598ee2-31be-4b91-85a6-5b31093e1adf", "value": "SecuriteInfo.com.PUA.PowerShell.Runner.11167.15227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5b5685-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286654, "uuid": "de6c51e1-9ba5-4ef2-acd9-3c22503f86f5", "comment": "Malware payload (Gafgyt)", "value": "7759f1b48f1545fe471a52005e3da022", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286654, "uuid": "9dc05982-9b12-4476-b080-e192da704f5e", "comment": "Malware payload (Gafgyt)", "value": "781a6ca1b2b2cd5cb121b6c2747cdee721a1b64b3adbdf53af2caa7311fa62be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286654, "uuid": "b2f7cab4-e0e3-49e4-b862-e268f9a06841", "comment": "Malware payload (Gafgyt)", "value": "a952c7e7e3877be451034a6795dc36792fe8caed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286654, "uuid": "bdc3ce8f-8fa7-4c7c-bc7f-932f66fb8c30", "comment": "Malware payload (Gafgyt)", "value": "ead4d2823f057e75f858255759f71c5b1ad3a89932d34783546e340ac5f5e11013081eabdf325cf8dd879759ff276778", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286654, "uuid": "f28d9e94-31c6-4723-9f50-aff837e1d872", "value": "T1FA04B63E7922AB7EE268827107F76F71CB5511D333929392E13CDA145EB224E188FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286654, "uuid": "0a141cb3-6b79-428f-b12c-667051452f57", "value": "3072:UhZRj5n9EmzUyMhi5hWTt5s1qAuhmv8uqx1BVnKoe:mjrYZi5hWJ5Lhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286654, "uuid": "d3082f34-5a36-4b5b-ab7c-c56cd7b6288e", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286654, "uuid": "d740d0f2-974b-4e35-84bf-8ed056d67457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286654, "uuid": "aa6a590f-52c9-4841-8a81-cb07413f9a3e", "value": "7759f1b48f1545fe471a52005e3da022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38c482c-f342-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712317830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317830, "uuid": "59b28b8f-5854-4119-97d9-decdfd22217a", "comment": "Malware payload (GuLoader)", "value": "d2c2dde3149468200fb0700ae8c37e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317830, "uuid": "768a43d5-e714-487a-93ba-d249f7540b3f", "comment": "Malware payload (GuLoader)", "value": "791893c5cbeae9788a3fd58d2f673fc0841bb533acc1a097d84f9f147c8c214c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317830, "uuid": "a52c28b5-5b8f-4713-a998-a55245df8a0d", "comment": "Malware payload (GuLoader)", "value": "a361124d0ac1aef843a9cc40e1b66b6789924677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317830, "uuid": "34b04c14-cefc-421c-a0a6-524a7f57f6ac", "comment": "Malware payload (GuLoader)", "value": "0d17787d699ac3d642f5a4dd13bfb500badacf964a14b231fd987bded01daa8cd5c7fc62530673be379687d97ed9c8d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317830, "uuid": "0c2cefc0-95ec-428d-80c2-ce3157358025", "value": "T139F4025232A0D5EBDBE886F22CBB81A61AF06C5C07D9524BDBFE73549032353581FA4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317830, "uuid": "36947baa-3212-4378-b0d6-831ad326e219", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317830, "uuid": "54dcc18f-64a6-44cc-8bad-55744b09d092", "value": "12288:g396BGtxLg66oIfHJJ2f9371iKrmaPoMyxX0wVAzM3XD2aCzgNfvdf:g393tR6tfHnu7FTqX2zMG0tFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712317830, "uuid": "27aca586-7fc0-4a43-aa4c-ff7ac06a0482", "value": 726951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712317830, "uuid": "2f4031d0-af38-492a-b3af-4a626c840c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317830, "uuid": "ecea069b-4ef0-4e9c-b983-ea8d2e6ac3ad", "value": "791893c5cbeae9788a3fd58d2f673fc0841bb533acc1a097d84f9f147c8c214c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f31f58-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712320998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320998, "uuid": "fad5d721-f5d3-4731-83d1-17bd9acd39d5", "comment": "Malware payload", "value": "c3e5999b0dddb5ba2ad4a9001e015f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320998, "uuid": "17383f3c-aa03-4fd3-a02d-1d1755d52fa6", "comment": "Malware payload", "value": "7bf5799b29b29518612d069a2bbab2499ece6404c555f73d8db37d167cf0379f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320998, "uuid": "be413470-2019-4d96-a9d0-cd08dc29723e", "comment": "Malware payload", "value": "377e0f7ec6fcd37fa8bb02ae8a57c5020603b1b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320998, "uuid": "268ac001-de05-4201-ab33-8d8987d0aedd", "comment": "Malware payload", "value": "55809cc014118ef5a4bf552209fa408aad200707ae72745435458780e7b7a5a71ead8b8b5f23abd3459367ffcf3b3a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320998, "uuid": "e8c02ab6-643f-44df-ada9-aa0318ba27f8", "value": "T1AAC4121067FE413EEAEF5679B87421000BBAFBA7A502D7DF9C1055EA6963BC00721367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320998, "uuid": "4248ee88-69e3-40c8-9c71-d66f053bfc9a", "value": "12288:Gf2Ov+kR/c07tYZLyOJ1nlffll8QNOBf7sjqDz6/wM5pu+8:wFRU0BYZOEvlHkojSz632", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712320998, "uuid": "971d78b5-2998-4cc6-a1fe-9bb6d6bdc3b1", "value": 580609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712320998, "uuid": "5f9b385f-deb7-4b7b-8c90-d711dc1c5d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320998, "uuid": "2b973af7-df94-4ed4-89c0-96a1e94357c9", "value": "7bf5799b29b29518612d069a2bbab2499ece6404c555f73d8db37d167cf0379f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14043e9-f328-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712306739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712306739, "uuid": "a322762d-5773-4989-8c6e-acd0f891d637", "comment": "Malware payload (AgentTesla)", "value": "2dfb4a7e5f0f5c8e4852800a78e5a758", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712306739, "uuid": "b8b5a0f5-c34b-4f3b-93cc-f09d979f5991", "comment": "Malware payload (AgentTesla)", "value": "7c616600a67995ac3936a14fc4dba5b9c5b608884facaf5de1ae17697ef4d109", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712306739, "uuid": "3390e8b6-9e23-4c99-9cb3-c9df7d7c4ce8", "comment": "Malware payload (AgentTesla)", "value": "8fa939f4b5fbc62b8e82464ff5faf48845ba1178", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712306739, "uuid": "16d5e0b4-6161-42be-b872-726594f59096", "comment": "Malware payload (AgentTesla)", "value": "ea62d6d8b36f90cb0b35443f927ef4c959780b1187e49218dbd5af265061dcc5cea5306d936f325944457b2ec907112a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712306739, "uuid": "d5edc699-ffba-417b-a290-1896aede5332", "value": "T16DC423BC5123C0056E6E9EBE6B6CD0A3C95D623539CDC7853ACA87113B41D22936B83F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712306739, "uuid": "9bfc1ffe-8bc8-41f7-9b50-c5dbdc31cdd3", "value": "12288:yCocJ0vVAFXLtVBjvK869Zr4Ck+eOhWVbpBiQT3yIYZLbWi71IUH19P+:ucJEW5LtVBjv169ZrdkxeiTZ+IYJP1IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712306739, "uuid": "0c83c467-710c-46d4-9380-d50c59e5e754", "value": 580354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712306739, "uuid": "a4d7b821-681c-464a-99d1-799ee83cc208", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712306739, "uuid": "21f53ef9-bcf8-4f5b-a0f5-af0a53221207", "value": "scan001048.rar.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2121c324-f2ef-11ee-a120-42010a9c002e", "comment": "Malware payload (Guildma)", "timestamp": 1712281936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712281936, "uuid": "3b7b50a7-7b77-4d6f-a242-00b7ffd7d087", "comment": "Malware payload (Guildma)", "value": "177ec4bae66f4c52caec00c3a2821b07", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712281936, "uuid": "70b7cb8f-f7bc-4db8-a6b3-fd3c2f3f23d4", "comment": "Malware payload (Guildma)", "value": "7e0ce70b001b96a73da04175076a1f60b46eac72c208813654dfd94359c81b27", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712281936, "uuid": "65211283-2764-41f3-9168-fedb8d3d593e", "comment": "Malware payload (Guildma)", "value": "abcc6871fc4fda0e8c132350e1305ecf2caa23b6", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712281936, "uuid": "dc387db3-8dc8-4707-a3af-520b6a784151", "comment": "Malware payload (Guildma)", "value": "2a4210304981cf1239657ae35d2b4d1234b6f38d2f242a76a9d70eed98da2249f1cfe38bdd66d9614f981e3664a91501", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712281936, "uuid": "8822a1d1-f734-4597-8e56-084f2dd3a717", "value": "T19AE58D23B249653FD46B6A3A8E67D112A93BF37137128D1757F0094C8F3A6817D2B24B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712281936, "uuid": "1c928436-ea92-49e1-9b82-85f600c40734", "value": "c3295912c8a24e0bdbe977ca78ba1c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712281936, "uuid": "8e4d3bbc-ac2b-44e8-ba6c-3a082626678f", "value": "49152:3RBx8YWn/sSkSnvekD0hk3mCPHZQTo4awuqV:3R0BlR3mC0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712281936, "uuid": "5e460dcf-7958-4abf-b061-746649144030", "value": 3215872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712281936, "uuid": "aab2e479-6da9-4219-804c-bab7bea27f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712281936, "uuid": "0eee24b9-07e4-4dfe-90ce-0107eb200e98", "value": "sdk_decrypted.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de029f52-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712309740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309740, "uuid": "8753b7fc-741d-4086-965a-33e5744e733f", "comment": "Malware payload (Formbook)", "value": "5457ca71961c1501548be04b8c096416", "object_relation": "md5", "Tag": [ { "name": "contains-empty-folders", "colour": "#9EBB74", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "opsec-fail", "colour": "#5A008F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309740, "uuid": "b61b78cc-f8c2-4f6b-8d2d-9cce8a7187ce", "comment": "Malware payload (Formbook)", "value": "7e52b81c8ca934c00f573f0b693bb0fc44abe9eebe8b21661e385f2b0cd4c393", "object_relation": "sha256", "Tag": [ { "name": "contains-empty-folders", "colour": "#9EBB74", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "opsec-fail", "colour": "#5A008F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309740, "uuid": "9423ac04-e55c-4195-b5b4-386a1eb1a7fe", "comment": "Malware payload (Formbook)", "value": "d0706a4f2e6784ccfe740e578cca219963fe880d", "object_relation": "sha1", "Tag": [ { "name": "contains-empty-folders", "colour": "#9EBB74", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "opsec-fail", "colour": "#5A008F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309740, "uuid": "bceb52aa-cecc-43b0-b222-96f1d4746768", "comment": "Malware payload (Formbook)", "value": "c84e80f4799e846bb6cba75f6bc2f0477526cd7047cbd9d17e96ccf444de39292b41c8980934e0c2624157e95032af34", "object_relation": "sha3-384", "Tag": [ { "name": "contains-empty-folders", "colour": "#9EBB74", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "opsec-fail", "colour": "#5A008F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309740, "uuid": "1bc29914-0e44-4355-8504-576882e7d0d3", "value": "T1FBE423B07B14A17BEFF90BBA0E19D27C838D85185B0A44C01AE941EE5F76B359BF95C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309740, "uuid": "9ad23b80-f134-4334-a57f-a0c4bf6db383", "value": "12288:43/iSLnuDgIYkx11AAV3KAbUJPwMuSdvFzpGvRkAwu5kYUYUiIi9fGA/pp8:4P7LMmZA8AAJPvNERkggi39fGO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309740, "uuid": "dc6399dd-8edc-4962-b1f3-ce892383283e", "value": 694199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309740, "uuid": "dc19918e-a1ba-4e4a-afad-b755231d71b7", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309740, "uuid": "b1239360-4e3e-47aa-b792-b4fdc1b747e5", "value": "RFQ ML - CONTG. 0992-19-PD.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f69f15-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344216, "uuid": "7e511de1-de52-4086-8fd0-6fc5810aafb4", "comment": "Malware payload", "value": "b90a1550b557f69e44c662f6231dd336", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344216, "uuid": "0b1dccba-7201-487b-ba6d-4bbd847d3997", "comment": "Malware payload", "value": "7f627e13524aac760d8e7858f67b234d343b766182953dbc52215f6ac37dfaed", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344216, "uuid": "6324dd40-c8ab-4f3d-8f53-69c9d0902612", "comment": "Malware payload", "value": "837280552d19f35d64c005b90bcae4d0ba7603ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344216, "uuid": "a348194b-0f9b-463e-bdc2-4b0816d8a5be", "comment": "Malware payload", "value": "6a34477ad2ee83ca3a058ed1b84db2d35aaadfbb5fd500d18a327207382b83a4a51ebf9541e61a682bd04e024193d6d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344216, "uuid": "ad48e550-ce69-4c77-b3cf-508e9b7edf0a", "value": "T1C3457C17F69941E8D06DC1B48B468172EA72BC520F34AADF0690B3592E77EE46F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344216, "uuid": "be3f556a-d188-4441-bc27-2e47021566a0", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344216, "uuid": "4eca9bab-5813-4dc9-b8a8-815a4600aadf", "value": "12288:j/I5bYnfeqP8u2lfMzwUQX4N3vYT1+hf/bnxlbm8LtJiyW787WRMA+nkaocrV5AI:jQdPqp2lf9UQoE+hf/bxlbjhi47bfoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344216, "uuid": "8263b787-bd0b-403a-9464-b6ef18700b32", "value": 1251384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344216, "uuid": "04e91cc1-e1b7-4da8-85b8-fee5f435c729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344216, "uuid": "78a68529-d9c5-442d-bdb1-5db3fb6c0645", "value": "7f627e13524aac760d8e7858f67b234d343b766182953dbc52215f6ac37dfaed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7d5f84-f344-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712318433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318433, "uuid": "ae6740f9-f404-4a66-8c22-c549cb83fc60", "comment": "Malware payload", "value": "253894f951050fe1780b7d72230a997b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318433, "uuid": "a2fb19fd-c42e-4d37-a11f-b56e7221f7ee", "comment": "Malware payload", "value": "80af92d4a363f01d5cfe473016d8994a700b0937e9c4c5de953637d4435c019d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318433, "uuid": "4e7030a0-e738-4ab8-ac43-32fbd5dbcf96", "comment": "Malware payload", "value": "94af09e5b3ebcf88ff60481a17481cc7194162e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318433, "uuid": "fb33c5b8-d59f-4166-9258-6a47e4776015", "comment": "Malware payload", "value": "6bf239bcd6b34a5dbd70b57c446d145a47f76759dd962e7f33dfcc49aa17435c0ddb42038982630b691e00c42dc4f79d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318433, "uuid": "283024e3-1a82-4c7c-b9a7-146c4292c8b3", "value": "T1A1A63315E9E104B3D6A9093028BCEF75FE610A8A4F051AC7A3B4DA2D7D76F81F533618", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318433, "uuid": "ca527113-689d-4748-a12b-2a10c5813d32", "value": "8c2569b7ea105c161af93da6bcc0dfa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318433, "uuid": "f16da91d-2d3b-45fc-9727-fc6979a93c33", "value": "196608:ODmqxGIFaWLgIlRzQMOvP7c4UZMvA0qltCszR/6l0i4Wd/xkS:MhFzLg7Pn7cbMvWcct6WDWd/iS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318433, "uuid": "efb4ee25-f27d-45b2-8799-ea8688995e49", "value": 10289819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318433, "uuid": "485e22f4-a8e8-47dd-8b3c-5ddbc8b27792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318433, "uuid": "bb8c8b95-3b62-4abc-ad3c-2a6e59f921e2", "value": "253894f951050fe1780b7d72230a997b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1556334-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712343998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343998, "uuid": "e9692fac-eb1e-435d-a334-edfce1610655", "comment": "Malware payload (Socks5Systemz)", "value": "5be7a2ffbdb6154724064ce9178d33c2", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343998, "uuid": "ebb73121-3af1-4ef9-9abb-b2dd0c55728b", "comment": "Malware payload (Socks5Systemz)", "value": "812e7b57905f44dd2a2861b76d1816579f20beb5071d933899d7ffe4f222663d", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343998, "uuid": "c6cf4cea-85b1-4d1e-adf5-357f3c8a0ff9", "comment": "Malware payload (Socks5Systemz)", "value": "ccc7e64c81b4e327d73ca6beb39c5beb5f0f1a1b", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343998, "uuid": "06167c36-af53-482f-8cca-7f64e3cd47f4", "comment": "Malware payload (Socks5Systemz)", "value": "8f6f05ab991195d632d99ec2a71285c2e8af6855e1dc829c2aead994d00d34188e574473cb1760ca838799c3a6f7d03c", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343998, "uuid": "96c3f517-942d-4293-97a4-c5737da564c8", "value": "T180E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343998, "uuid": "e8376337-4a23-4b37-bb89-c5f7cbb8184f", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343998, "uuid": "705bd265-22bc-4182-96d4-a27d694ede7a", "value": "12288:sjsgiZdvAeRw8+a0H/50cC9yBqiicvpWwXsm3RKLiTOkkRp9H3ckiiIjcBDQg5Eq:6sgwdvAhTf50cC9yBqivvpfXsm3R+iTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343998, "uuid": "d6e14629-662d-4fa8-bc8f-931be550fa39", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343998, "uuid": "dbd6a3e1-4066-4e67-9624-f59979b44a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343998, "uuid": "60db25e9-1526-45ab-8bb8-ee3f113fc338", "value": "812e7b57905f44dd2a2861b76d1816579f20beb5071d933899d7ffe4f222663d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213b1179-f340-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712316725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316725, "uuid": "7f42c072-4951-45f5-b997-29a88b556b87", "comment": "Malware payload (Formbook)", "value": "0c72285fcd2eda1574978a9b01f5d58b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316725, "uuid": "c6c1191d-0b47-473c-8284-e381c3e8dcb7", "comment": "Malware payload (Formbook)", "value": "8243f0400ffe13c6d332e0ab70af833ae44e446a5419f411a5c2586c86c51277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316725, "uuid": "b0f6d2b4-4597-40d0-97ff-ed8b94be6895", "comment": "Malware payload (Formbook)", "value": "a20251798e3b226bf69fc57938ec5672767e72b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316725, "uuid": "39b73002-4df9-41e0-976a-1c19823b348c", "comment": "Malware payload (Formbook)", "value": "989f4a55dcbc36ffdd65641b5b19c3475c4bf7c3ff5001d2f020c8a09a02009e4ce756fda7bb8dbd6aa476ace165a28a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316725, "uuid": "714e44c5-d4b1-47df-bbb7-da7f0a5b2c41", "value": "T18FF4BFAC365079EFC86BCD76CA982C64EA6064BB530BC243901715ED9E0DA9BCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316725, "uuid": "01bf1b4a-f167-4fc0-b550-ee07e6bb39f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316725, "uuid": "7b6b375b-e780-4fbb-8c97-911a5252fdfa", "value": "12288:e722e4FyGUH9mz9l9eGQtjFhA7ANHEaHD8069jvG3M6GJYEwCzLHYf4RE+ZOdKMD:x2R4HA9l9ePhdN1HAP6MHJzRdeWTj+ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712316725, "uuid": "de225e99-be50-493b-8e95-0c16d5f42ce5", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712316725, "uuid": "4a535b3c-16b1-42c3-b3be-205f2326e1c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316725, "uuid": "f0489962-a853-47f4-b261-85a7e8e4f438", "value": "SecuriteInfo.com.Win32.CrypterX-gen.28316.31463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2768f7a-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344000, "uuid": "eb04652a-5cc1-4a26-b44d-35d3bbe21928", "comment": "Malware payload (Socks5Systemz)", "value": "b2c0b6237b47f51ca0ed5f12e837e6a6", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344000, "uuid": "2a6bf52b-036d-41fa-baef-153dd3e6bef1", "comment": "Malware payload (Socks5Systemz)", "value": "82ea322328e3d53f8a0d96ca32618cd9666cf795f4e7b8ff87ad4fe00cb907e3", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344000, "uuid": "4e17bb30-a66b-4915-b0d9-95444f088874", "comment": "Malware payload (Socks5Systemz)", "value": "52725200e7d1fbe49d38865f41b35b41ac4f04b9", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344000, "uuid": "47ca77c1-abcf-452a-8aae-7d92b516f55e", "comment": "Malware payload (Socks5Systemz)", "value": "8409741ffd9971675929d37f981ea6632ba8dc5062804452ee600fd21f7b33553402738947c0e8b971b0be4da11d2725", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344000, "uuid": "324048d2-56f4-4363-b4c3-0a900e06301d", "value": "T1C8E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344000, "uuid": "9d3907aa-a504-4563-9bbc-eaee4ecbe5ea", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344000, "uuid": "00401b9e-82cc-4753-a39a-c28005310114", "value": "12288:HjsgiZdvAeRwk+asHR50cCB9BqUJcvpWwxXmJRKLiTOkgRpkHQOkliIjcBDQg5Ee:DsgwdvAJ3x50cCB9BqUCvpfxXmJR+iT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344000, "uuid": "85ad6b61-b399-49a9-a1f3-7ec96bb69c6f", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344000, "uuid": "0c2cd2ac-4581-4ebe-8cef-529ba1d9c87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344000, "uuid": "8c100e1d-9a9b-445a-be31-8bff06b2ad97", "value": "82ea322328e3d53f8a0d96ca32618cd9666cf795f4e7b8ff87ad4fe00cb907e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f740b4a-f33d-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1712315407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315407, "uuid": "7bba64af-1382-4021-9cca-31148d8acf81", "comment": "Malware payload (IRATA)", "value": "f5adc75f5964b035ebeedba63038ae74", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315407, "uuid": "3743aa4e-9914-4821-b82b-495f690c29e7", "comment": "Malware payload (IRATA)", "value": "834702f8a9d0b943e9aa0371011171176818bbca1b49f1e6e1679fd6b604447c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315407, "uuid": "d4560789-e54f-4582-91a1-9bfb842e5971", "comment": "Malware payload (IRATA)", "value": "be91b6337f31ddac31e742710011e8d9a0ef7ed8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315407, "uuid": "a4c63922-044c-4b35-a5ff-65efd30e32e7", "comment": "Malware payload (IRATA)", "value": "87304f39b5c4790eac558517108650c2fd7f4acc096c2cf5c027fcba117c77c751e68118631b3dd30b84a8fc9329b074", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315407, "uuid": "3b840252-4c45-4294-8e99-d85c9d20ef06", "value": "T19E162353F265AD27C8F2C37226752936113A4D148B07BB4A3A5977FA3CBBDD80B816D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315407, "uuid": "b6b2ecd3-415f-4d19-82f5-a0a9f91cacfd", "value": "98304:4TqYjwZAkkmX/WlkslMPHV9F7F5KwnFIbD6e4ku/Uow8oIms2z:4TqYjfavW+sUh6wnFI36Vku17ms2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712315407, "uuid": "ee522656-82ad-4d51-8a92-233d7b5e94d2", "value": 4034973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712315407, "uuid": "2bcae4c2-bb49-416e-9c4f-03b44f6c4862", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315407, "uuid": "493e7b78-737f-4d5c-8cbb-9e35aad94110", "value": "KissLandd.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258517e4-f39b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712355817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355817, "uuid": "247412f2-f806-446d-be3e-01aa954c096b", "comment": "Malware payload", "value": "a2166cb411f00882de0db59ee16cdcb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355817, "uuid": "244ab547-1d16-4121-976a-a765dc4508b0", "comment": "Malware payload", "value": "836ecbaaa234a47abf63e17776ff267cef04ac63e0854e9344df0056359aca19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355817, "uuid": "4e689453-e6eb-4579-8f4c-0e8632ca5510", "comment": "Malware payload", "value": "cf940184441f087556d75056c532b7c33d3bd9ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355817, "uuid": "f681196b-0279-431d-b119-a7ba71247b1e", "comment": "Malware payload", "value": "9903ceed9d9f5b2399d7cb074d588904eef94373f74d3bd3b5129573fa246e88517c368d07e227c50eba23a06ec7937f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355817, "uuid": "0a38664f-05d0-4750-80fc-7d44da927e72", "value": "T1EE1623C83C8179FEC0CBC7759421650D7A793BE1BA3B884C6ABA09518E33A5F9F36544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355817, "uuid": "abb7eb22-f73d-42b4-85c7-b2cea71b1e1b", "value": "fc9716c514b61e0aa36b43744583deb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355817, "uuid": "97920ea4-e0b3-431b-b859-cc4a339e641e", "value": "98304:dFs3XgYFD//Z/fpGLqsfqJK9zssX8zqs85ze6bijNPPLEculgghVPUO0Uk:dFs3XgY9/RALlztEGf5ze6bipnwculVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712355817, "uuid": "49e3f623-5916-4f01-9bbc-40788f1477c0", "value": 4133376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712355817, "uuid": "9dc3799e-0063-47fb-bf93-40180c47ef18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355817, "uuid": "4f4ae145-6cde-4889-87a2-3e0588ee2b50", "value": "SecuriteInfo.com.Variant.Lazy.496763.13990.14611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cbb9a6-f314-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712297919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297919, "uuid": "8d85b0a9-d8a5-46f3-a498-061f571d0bfc", "comment": "Malware payload (AgentTesla)", "value": "9b7e70f3b5a86ca521eb20529771a83b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297919, "uuid": "e078dcc2-9784-462d-b9f5-a71958fb57fa", "comment": "Malware payload (AgentTesla)", "value": "8506e0fdcf9ce49bd939a62bacd3e4d1af3522d72e660382684b1e4d1bb8e6b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297919, "uuid": "8baee768-4324-4c60-b68b-16f1d14475e4", "comment": "Malware payload (AgentTesla)", "value": "2158d8a9e5bb6e3c4825d2a67d1abc0117ebe5e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297919, "uuid": "b9600917-fac1-4ece-aee8-821be0384f4c", "comment": "Malware payload (AgentTesla)", "value": "c24412a1bd66613038e36277a9532b83c4b288ba6d341d3898f5d0d25ce2624b1667215ffb7f6d7b344efc15fa4960cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297919, "uuid": "f5cbfbf6-efb6-4d97-8df5-8c8966186a75", "value": "T1FBD4231237785323C4FBDBB95C702B1207B4D8A5E7B3D66D0CC99AC60617BD96AD0A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297919, "uuid": "a8c278d4-8ff1-4af3-9d4a-68131fd6407e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297919, "uuid": "fea91973-4cc3-4729-a370-79d2c7c678e0", "value": "12288:eRUHJhAyLS/6eg08NxFoi5YLAPg7iTYoq/HsGMpaJ4eYSn:PHJhR00noOYMPhT6iaJNln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712297919, "uuid": "e1380995-3bb7-4c46-aa65-9460ce1c2cb6", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712297919, "uuid": "f99b4195-8dc3-4a42-943b-edb8b4f16911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297919, "uuid": "bc67bed1-337b-4e0f-9a40-ecccbf1cd1e1", "value": "Azizi Riviera Azure works.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d227661-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712321013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321013, "uuid": "9ad4ebd6-8f87-4415-b6dd-4c30a159528f", "comment": "Malware payload (Mirai)", "value": "cf0583fb4a2b106a9f7a0ef3e51325ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321013, "uuid": "1afc84ec-dc56-487f-8536-0eccf2dcfddf", "comment": "Malware payload (Mirai)", "value": "857681fcd434df44f6f4c27096cda24dafbf364ec21f86e7caf81b9dcf410d62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321013, "uuid": "6170fa47-c005-42cc-9014-895b611acce5", "comment": "Malware payload (Mirai)", "value": "dda799dff296269b159c9ddc62670d8328b2d6ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321013, "uuid": "7053aa1c-6d41-40de-8ea4-68658f9d87a5", "comment": "Malware payload (Mirai)", "value": "e27a09b1c6993754b0df512c747bda44e839009b6e80650af960cc5e4c130eac29c66366ffce95da5c1fb31b066cabc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321013, "uuid": "02d24b2f-902c-4ff3-b73b-20a4b577a54c", "value": "T19C432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321013, "uuid": "2ed978c5-3f14-4e68-a6e4-e2b2de07d79d", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwY:RqtmZPuutfbltZFBSJsBcfDSTFI+BEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321013, "uuid": "bfc999dd-7220-4c17-b8ed-a31a3d6df338", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321013, "uuid": "c5196315-8945-4a88-80b5-2492c65f72d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321013, "uuid": "a3b5b1df-d9e4-467b-bef8-4665d0333ddf", "value": "cf0583fb4a2b106a9f7a0ef3e51325ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77aa1c82-f30f-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712295825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295825, "uuid": "16a725bb-d3c9-4333-a0b6-f8937b462cff", "comment": "Malware payload (GuLoader)", "value": "2f59ea72687ed5346508e5da6888d0a1", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295825, "uuid": "a2edbce6-7b80-4e0f-9897-b41af3f6a39b", "comment": "Malware payload (GuLoader)", "value": "85d86b35598fc8dd2385b3ee5b0422a2485b42c9642cb2b3ee70e9e2c09f9297", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295825, "uuid": "abd67dd6-548d-4d6b-8f23-2f3beda558eb", "comment": "Malware payload (GuLoader)", "value": "01e39cfef91af891c27c027064c742ce73dc23eb", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295825, "uuid": "7eeab91e-95df-4dac-afa2-579f81ef46d8", "comment": "Malware payload (GuLoader)", "value": "aec47ddf9db97fde01a9a014649496e856aa35cb604a8125810e158afc5ad0f92ee2417cdaed3ed375b8bd5ca4758802", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295825, "uuid": "93e43a35-4a8f-4e87-8e84-1f70496aa070", "value": "T1762302577AC974435CABB6E9891EA54E7CCCCEDD103005F8BDA7A683E01D45C7390D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295825, "uuid": "cc74a801-a7d8-400d-97e1-caad12e14916", "value": "768:owkf0vTCAu0YfSqJmJ8FjZg5IIPdYMfS/PRb9L/HuMAewyzxN7Zj:Y83upfJmJQNAza/Pp9zHvAeDxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295825, "uuid": "476acbb2-0791-4bda-9bc6-7e1e4afe020f", "value": 49164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295825, "uuid": "d67bbf16-a45f-48c9-9ed1-b97a8d760fe9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295825, "uuid": "50d7dc29-934f-461c-8513-79f6f0b07b1a", "value": "- Salary payrollAuthorization - Apr-24.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ff18cc-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344003, "uuid": "c8ade53e-e2b2-4ff6-a86c-54bbdd53f55c", "comment": "Malware payload (Socks5Systemz)", "value": "efb297945769586380ac34bac6b3549e", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344003, "uuid": "3f7abad3-2b9b-498c-8abd-9db24c9ce0ea", "comment": "Malware payload (Socks5Systemz)", "value": "8623d2038c33f039ec2d2482b379b9e3ec6ff18e15b50b6220738d8e47cac89d", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344003, "uuid": "c5913818-aa9a-4666-9d25-29ddbf2a1560", "comment": "Malware payload (Socks5Systemz)", "value": "a8abefb89ad5493caae7f981e2aa1228b695cfed", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344003, "uuid": "5eaa1ad1-ebcf-4c76-a949-e98db1059c68", "comment": "Malware payload (Socks5Systemz)", "value": "857f1c4f2837685e3aef0c9773b99df311b11d342f119990d1acb4403b3078b09efa8e8028299db92e4331d05e2a1cf1", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344003, "uuid": "1492f843-f08b-43af-87e8-60729f20c2e7", "value": "T11AE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D9789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344003, "uuid": "97b5d362-1a09-463b-b118-b576dcfe8ca8", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344003, "uuid": "e921e226-722a-4de7-95aa-99fb3f4a10ac", "value": "12288:sjsgiZdvAeRwx+avHJ50cC1nBqIHcvpWwpFmtRKLiTOkIRp2HKmk/iIjcBDQg5EC:6sgwdvAo8p50cC1nBqI8vpfpFmtR+iTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344003, "uuid": "af4a8648-0328-4b5f-a67d-d89b5d3a2af9", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344003, "uuid": "2247f4f1-6bf5-47d2-b7fd-8b91ffc64d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344003, "uuid": "7370b31f-0941-4082-a380-2ff07204ef9b", "value": "8623d2038c33f039ec2d2482b379b9e3ec6ff18e15b50b6220738d8e47cac89d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c737b06-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309604, "uuid": "b40ffe37-c578-4d9a-b175-557287043ba4", "comment": "Malware payload (Gafgyt)", "value": "d3d794e0898151eae2bc7b491d1fcee0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309604, "uuid": "1f4d3a7c-cbb5-470e-bfdd-045ba129692a", "comment": "Malware payload (Gafgyt)", "value": "86ef1dc147f06aac054fa099bb6eda26871b84d64055c22266c2bbb0b7adb131", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309604, "uuid": "ab21d893-c24c-43de-98c7-b6c705a80c43", "comment": "Malware payload (Gafgyt)", "value": "7c0a4eb89c7764baec7268dfd4534f325683a0ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309604, "uuid": "62bcbbe5-02d4-4db0-b8bd-20adfb0b889c", "comment": "Malware payload (Gafgyt)", "value": "37b503226b3e2ed86a4099f27c708122b6be76d5a841ce003ece06b8e1355a86d7d3c650acfd509ee1aa644c6598c34b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309604, "uuid": "cc09295c-fafc-40fc-9391-739fc4ea4e98", "value": "T1E2C307B5F340C672D14305F2225ADF321C33FAFB165AA54BE3A81DB0DE7A0826565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309604, "uuid": "34880bc2-e295-4f40-a24a-b1e59ee706a7", "value": "3072:7dQKUAUxUjUSUnU/UKUDyzJ2L5lv4eb8M5745hGImJ00OzQaGyPZk:3ZSE9wChXzJ2LrQMz745hGImJ00OzQaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309604, "uuid": "20d7a40c-9df3-4b62-954b-9f145e74c6d6", "value": 128739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309604, "uuid": "a760eb69-f7f1-475b-8ba3-516dbc515f5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309604, "uuid": "db83d7f2-e185-4bc7-90c9-9ad62f31a4bf", "value": "d3d794e0898151eae2bc7b491d1fcee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5146009-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344005, "uuid": "79409102-d659-4dac-9394-acbea2b1779e", "comment": "Malware payload (Socks5Systemz)", "value": "f5b8b558d1b38d250ceebfa1174ea54a", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344005, "uuid": "a15a2336-d61a-4896-b0e4-2fdb3a7257b0", "comment": "Malware payload (Socks5Systemz)", "value": "88a4cc3c8178a1c3aea0806662549d03c900fc39ad40d60af26344aefce186ac", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344005, "uuid": "b85f6f29-2f19-43e7-9b20-2900aeaec79f", "comment": "Malware payload (Socks5Systemz)", "value": "aa0172d34daa58e80bdcdb7b1951abeea6727a01", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344005, "uuid": "3ee90de8-d42a-4c4e-aa6b-c1fd075ff6f7", "comment": "Malware payload (Socks5Systemz)", "value": "676772b045207eeec322ca01d70edae568dadd8c4170d54bafee4d246d66029c72d4ed4964202516217a8c07e1ca5415", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344005, "uuid": "0044d4ba-1062-49de-9367-b19c727b02a7", "value": "T1D8E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344005, "uuid": "773d6895-c68a-4d3b-a8f7-17c80d06d37f", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344005, "uuid": "9115358f-d6a3-49c1-a788-cb6cdd4ce4e6", "value": "12288:sjsgiZdvAeRwg+adHR50cChtBq05cvpWwxHmpRKLiTOkgRpUHguk1iIjcBDQg5Ee:6sgwdvAl2x50cChtBq0yvpfxHmpR+iTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344005, "uuid": "014dbb35-fd0b-4b10-898c-cb18c857f3e6", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344005, "uuid": "67c96aa8-ef05-43b7-ab18-004c8c00f429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344005, "uuid": "6722a319-d5f6-464e-9a8e-1195b25645d7", "value": "88a4cc3c8178a1c3aea0806662549d03c900fc39ad40d60af26344aefce186ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8b8958-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712309416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309416, "uuid": "aec3657d-a9d6-403a-aac8-0e9c4ee2ad86", "comment": "Malware payload", "value": "f42ce23ef996b3faaeb8eeb0bd16a57b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309416, "uuid": "f209b98d-4267-434c-8858-eca37ba06e0f", "comment": "Malware payload", "value": "891d2b4fa091bebace056084cd24f4f063d080f7070110b0fc3fab97670e206d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309416, "uuid": "25c36df8-eab2-414e-9ab5-b59be3093a21", "comment": "Malware payload", "value": "369144f6db7470bfe14b3f8b75c44a3c2ca84a28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309416, "uuid": "e3b1d696-e170-4989-b9e3-9541b904bd15", "comment": "Malware payload", "value": "488888abceda5bf7cff533eee4f0c4c63e9693a3692f6c19e5fb6747fb0145d00c71431d41ca5216376fcaf1330461c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309416, "uuid": "30fee60b-635c-4778-a2e4-3eda1fcce5ac", "value": "T122923B82E983D8F4E86249F11836EF66D632E13D5448F647E3795672B5C3800C6B77AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309416, "uuid": "76ff0e87-c5a4-4d87-9eac-70bb37f9d872", "value": "384:fU9gq6EzApfwHiMwrc1h9Lm7u79/LXpVl:i6QefdXrcFm709/LpVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309416, "uuid": "173dfa64-e458-4159-aa6c-ecdc95fa2f02", "value": 19856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309416, "uuid": "8823e305-e2e9-4e7d-bf86-76618bfdc109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309416, "uuid": "39214f90-b6ae-491e-a6bf-fc41777ca0fe", "value": "SecuriteInfo.com.Trojan.Linux.Gafgyt.10525.13139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dbf8f3-f337-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712313059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712313059, "uuid": "53963444-9a10-473a-a855-55d803836d59", "comment": "Malware payload (Mirai)", "value": "e310feff3f402d386c49ac10fdbdf843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712313059, "uuid": "e2143b99-c097-43e0-989f-1e1b9e9c74bb", "comment": "Malware payload (Mirai)", "value": "89e60d9d552554afb187f8d1612fcd1e46bb48066c2d38ba141b969d0c1408e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712313059, "uuid": "7e136ced-2a28-40cb-802a-ffba68743385", "comment": "Malware payload (Mirai)", "value": "742bc69aa714bd0fb9cfd02f21d28b6dd9ab857f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712313059, "uuid": "840a0073-525e-4505-be65-a8732ecea648", "comment": "Malware payload (Mirai)", "value": "b33008ed79727fa6755b23a9aba1344c59d39cfde2c8e065b4ba4fdb53a7f9e94872cd2a9c88493b2740dee428c5b0cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712313059, "uuid": "da642612-7bc6-4e22-9918-e842a9143bc9", "value": "T13F02C0A13B1123C2F521EFB57BD8342BD42D963570CC5F217629828BC06A72D14BF22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712313059, "uuid": "fc21755d-1dae-4fdf-9aa5-bd8bf00d714f", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQp:yb2eX3zAKuiNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712313059, "uuid": "005fa882-da9d-4519-860b-b8a2323eaf6d", "value": 8640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712313059, "uuid": "a9b86aa0-6ffb-4189-9b61-d9729c3a49bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712313059, "uuid": "3526a8b2-613c-4480-a7af-c57cb413a91a", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.FSO.12559.14433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59c347d-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335093, "uuid": "56aec3d4-658a-4ca0-a708-b0a85d5a6dea", "comment": "Malware payload (Gafgyt)", "value": "cc6d982cd4e15ad9563f915eb0231166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335093, "uuid": "2d9a2d7e-3cd0-45ef-aeed-93be3c662590", "comment": "Malware payload (Gafgyt)", "value": "8b01a379b915241a82af2e59baa7e42140a4a01864de96f71e68dcb8d2f05b33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335093, "uuid": "69172c5e-9102-48ec-a5b1-6c8678cee6d9", "comment": "Malware payload (Gafgyt)", "value": "28ad6dc907b415fbcbc8b6e14c96ee7b92249721", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335093, "uuid": "e46be074-ffec-4018-998e-a65e8af9669f", "comment": "Malware payload (Gafgyt)", "value": "6335f1ecfbce28dbe477ba6cc1d12c79f833406c9ef9066c917ab2626cd5afab0991b874dfef814dd914e00c15dc2b2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335093, "uuid": "8d748356-10f6-4ceb-917a-ce4b7faada3c", "value": "T1C9A35C43BB1C0B53C09B6EF02DF727F0876AF96116A36185A509FFC45772AB02522F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335093, "uuid": "a365f602-4fa3-49e0-b491-947eee096585", "value": "3072:oilSL/OyQ/rvD/WIFNga0DnNkhRK5TK51x:1lSL2yQ/rpr0DnNkhRK5TK51x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335093, "uuid": "d7c00108-ce87-4b80-910a-fd0b4ed4b04c", "value": 99960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335093, "uuid": "4f2703fd-b563-4d63-9bfe-419798067395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335093, "uuid": "a44116eb-1c6c-48bf-8ec0-40cb0e7807fd", "value": "cc6d982cd4e15ad9563f915eb0231166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae6b76a-f314-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712297978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297978, "uuid": "1fc1b8ce-3235-4f8f-a907-9f36afaaa16b", "comment": "Malware payload (RiseProStealer)", "value": "6b822932c8d64c86f333d47f0eb9b203", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297978, "uuid": "8a770e83-7405-4d73-bc32-e35161d39ddf", "comment": "Malware payload (RiseProStealer)", "value": "8dde9ae7bba0cf1cd94a37bb3a08b417e8948dc19e3b2a84117b1b500963e75c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297978, "uuid": "252c8300-af46-4ec6-9871-b337b69d7eef", "comment": "Malware payload (RiseProStealer)", "value": "417e904b3ee027a7b45ce716fad31c2e1a3234db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297978, "uuid": "3571bb73-fa9f-4bbf-a5e7-b7d054399d99", "comment": "Malware payload (RiseProStealer)", "value": "d090f963abd4f6f257ed1a99eaee894da77392ee133831ed58228bcf28438ca9933e74bffe59b8162db76477f025d14f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297978, "uuid": "f2c073c8-d85e-4e7a-b339-5d20607afade", "value": "T101B533B4925B1C63CB256835B8F549304FB5AF800EC316C3E96A989C97FB767502EB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297978, "uuid": "263b6dce-b996-4329-b185-235fe7131a07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297978, "uuid": "38b91fcb-17fe-46ea-bc10-df463e50fb2f", "value": "49152:uDoMAuAykXxYZaJr1xcGVo1f46fVk7bpqxHACdSTAgf80cDK:aOygYAJxa1N40mh3UOAgT6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712297978, "uuid": "a3f5bafa-511a-4e40-ae51-b8b7fcaf694e", "value": 2454152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712297978, "uuid": "5ad5601e-ef2b-46fa-89b2-d070091a9265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297978, "uuid": "bbe8eb09-310b-4de5-aaed-a04448487e9d", "value": "6b822932c8d64c86f333d47f0eb9b203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b33d74-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309597, "uuid": "e5c00f92-68dd-4bdf-8949-a5a2b9aa4fd3", "comment": "Malware payload (Gafgyt)", "value": "809c4658b594c9f31526d556b7b0f792", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309597, "uuid": "50d41ef8-ef85-49a2-b919-fd0f7cce165d", "comment": "Malware payload (Gafgyt)", "value": "8e0fd9c0cf3bdb79f43aa8004d9c23a63cb20a7dd4383924d12ff77d67901b87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309597, "uuid": "dcf349a0-e32d-4dd7-9780-1563f316f214", "comment": "Malware payload (Gafgyt)", "value": "0af1cd15d4f6ce0716134b88ce5dc00f05a57be9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309597, "uuid": "6c93509a-0c77-4b69-b2fe-5f485d6a2c8c", "comment": "Malware payload (Gafgyt)", "value": "db7cf623a87c8cbe3b482415de9ac3ff4934074a3955a4a52ab11be865c96194c7ba982ddccf8a4e75b6a9b04ebaf8bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309597, "uuid": "b47f3553-e3b6-4df4-8cb4-0d76a3c94f7a", "value": "T157E3E511F8814767C3D323F6E65D879E3F3206EA23DB33116B3409B46FC2B992969964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309597, "uuid": "40d9703d-bdfb-4426-9522-3491d34a1bd5", "value": "3072:no9um2+EgXulnEaXydGXpi3lXDWZ5hcO1ejTjIxFXmOqDQ4DtsL6Qse:noPZulnEaXydGXpiJ6Z5hc8ejniFXmOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309597, "uuid": "7ca21bde-c7a6-40b8-9448-d47c7a46007e", "value": 154514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309597, "uuid": "86337e79-4334-4973-a6ec-aeeccd2f165f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309597, "uuid": "f233e65c-b106-49e7-a4b4-594de935f23e", "value": "809c4658b594c9f31526d556b7b0f792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da09c83-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286627, "uuid": "cf241dd1-3004-44fd-9d8e-ab6c35501035", "comment": "Malware payload (Gafgyt)", "value": "6a5722a49657f24f8bc1424129dba0b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286627, "uuid": "7e977ddb-9479-463e-b225-9c582493cbf0", "comment": "Malware payload (Gafgyt)", "value": "8ee7db976037b9909b19f37f096fd085793bf316869daeae8ee62e50f750e5e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286627, "uuid": "42142984-d467-491d-b654-abb28a18a041", "comment": "Malware payload (Gafgyt)", "value": "54e752f9133a728049d3641abd4ac442b19458b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286627, "uuid": "7696c7f3-6da9-4fc5-96e8-5bf2d3d1e552", "comment": "Malware payload (Gafgyt)", "value": "0159cb6dbad667c14b144eb57943bea887b2cfd457902671313b928047a232adaf77b2a290d93fa88fb86c5a44ba85f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286627, "uuid": "f4381a40-5f64-427a-8a0a-af5c5f3a5289", "value": "T1CEC319F9E30BC6F3C40316F2125BEAA70D21B1B7166AA985E7282D70EF734C62555F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286627, "uuid": "482f7fe9-9ab0-4bc0-b8a1-0e00d5ea2858", "value": "3072:EWpbc37+Qp2nrkGJc/I5h1Y7rCmJC0OzQaGyPZk:E9Lyc/I5h1XmJC0OzQaGyPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286627, "uuid": "2cfe909e-cf12-4638-90af-b66a5ee9d696", "value": 127460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286627, "uuid": "de4bdda3-1995-4ce3-ba7e-7070fb7601e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286627, "uuid": "fdb386a2-bd32-4f4c-afd1-83cff89a68ad", "value": "6a5722a49657f24f8bc1424129dba0b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8636639-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712323475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323475, "uuid": "78a5b541-9d36-4c6e-a7f3-ac7a59773f23", "comment": "Malware payload (RemcosRAT)", "value": "636a54861ddd167065f294cc76fca7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323475, "uuid": "26bd9473-1b7a-4bf8-b8f9-92252e535772", "comment": "Malware payload (RemcosRAT)", "value": "8f02ecb26530c0a13b7f00020ebca144fc271fe36a5caaba1f4b3270e8e0023c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323475, "uuid": "44e654bf-ace0-4e25-b674-c45e03dbfa7f", "comment": "Malware payload (RemcosRAT)", "value": "7e3eba28bc4b89801c91de5450aa28da5c6ff941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323475, "uuid": "93627180-6774-4c5d-bd22-94a20b4c76fa", "comment": "Malware payload (RemcosRAT)", "value": "3808fdb8d7779e29203d6c42a5c869dc25eb9bc4ca5785c20b5f2057e026b45a73aed289deaee7f7ee5c64fe314ac3d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323475, "uuid": "85e88a1f-2812-4828-bc61-6a6f22d803ac", "value": "T19C1523003385FB5BD97ED7FD552A680193B15F8AB992E2489DC225CB4371B808B6DF43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323475, "uuid": "80cf223e-ba06-4159-9bbe-d2f148d1e899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323475, "uuid": "03e70f37-e246-4893-ac50-f6b1245d8fb1", "value": "24576:GgkHhAVqHxUrlWy05hMud6hHERSIhO0RDP+dB8:I2V+Ur6MIMHERSIQ0RDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323475, "uuid": "5c903fa0-accf-419a-ba4c-80e0a1bf00bb", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323475, "uuid": "c00cd2b3-250c-4302-95f1-8759ec98342e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323475, "uuid": "e1e1f9af-3c9c-48e2-9f22-722230d33bed", "value": "SecuriteInfo.com.Win32.PWSX-gen.22684.1131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caaacec-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309631, "uuid": "af7989c0-4a16-4c8e-8b23-18216333d2db", "comment": "Malware payload (Gafgyt)", "value": "c62615d521965f55b5fd8c456eb4e2a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309631, "uuid": "646aeae0-bf8f-43cd-b7f3-d7e84ce1aeda", "comment": "Malware payload (Gafgyt)", "value": "8f2445fd9c79b0f1f30fe6f783636f660deb16aae88a88c15d4eb7381518a5ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309631, "uuid": "b8faade3-7c95-4cd3-9306-e6c88d4efadb", "comment": "Malware payload (Gafgyt)", "value": "ce61e73347936740684645b9f60ba691cf22bfe6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309631, "uuid": "2bad4c37-8427-452b-a506-cb3979b0b9ab", "comment": "Malware payload (Gafgyt)", "value": "36cc3967387b7b261510359d6b29b131afab902457fb8ca962b4867c3aaa1a8436d7e7ac2375b35b5e0e525e8b941657", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309631, "uuid": "b313b8a6-3f4a-42f9-b37f-d836a6612131", "value": "T125E329B7B6080753C4C705F11D7B3BF25F68A3F322E720C5662ADA805A73AB61521F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309631, "uuid": "f40fbaef-4cf2-4d45-8e7d-ec1593bb6128", "value": "3072:WJ5X5f1H47SpnS8yGx5hkC58Dmzb0qDJAGyoze:WJ5X5fJ47An7Jx5hZ58Dmzb0qDJAGyoS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309631, "uuid": "7b6253ee-b7eb-42dc-af42-181c671d7fbc", "value": 148108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309631, "uuid": "34faa194-221e-445f-b5f7-2d3d36e02274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309631, "uuid": "db58ec19-6297-4c75-b32f-e70c6b6e3cb4", "value": "c62615d521965f55b5fd8c456eb4e2a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768cd6f6-f314-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712297970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297970, "uuid": "6b935631-c910-44ce-b081-5a9acb8c970e", "comment": "Malware payload (Formbook)", "value": "2e8375fdb3c256e12a31c39e2e7a1e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297970, "uuid": "cbb97b97-e613-4366-aeed-c6f041f119b3", "comment": "Malware payload (Formbook)", "value": "8f53280f0b7807f08cf03152768d385200db1ad864b256fd9e7decbc846b05a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297970, "uuid": "11b92c2e-6180-4731-9ac4-9e5f290734e2", "comment": "Malware payload (Formbook)", "value": "6bd539ea2da0988665eea23bc4fb578649ec9179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297970, "uuid": "c1ee1f1f-0522-480a-97c7-4052bbcf8b6d", "comment": "Malware payload (Formbook)", "value": "cf9cc0e56f1f3312a93871161d36b1877164b23e565c45285d47a95517f9665d781efea724c59b66dff33164a9b8a21c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297970, "uuid": "e8c78289-db51-426a-b126-9d0b55267238", "value": "T17AE41248BB9BFA10C1BC0A36C1E300196732DB4B7A77C7AA78CD52055683BC95DD8B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297970, "uuid": "f69149ea-95e5-4a34-bf40-1b3e64761635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297970, "uuid": "fa2bdd6d-2f44-4251-8530-1a7deefbb1dc", "value": "12288:7LpBUH8EU6tU9uVigrVisukwWrUJuj5wtSlR2BUgB6kR:gH8E3A9g5iWrUJuj5weRJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712297970, "uuid": "1a982931-a143-4e42-b9b2-1d32456461b4", "value": 672776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712297970, "uuid": "3a982746-38b9-416c-90ba-437c0b2d96b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297970, "uuid": "4d3ff46c-0de7-49f6-90d9-7e6f5cf75097", "value": "SecuriteInfo.com.Win32.PWSX-gen.21084.5000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f15ec5a-f314-11ee-a120-42010a9c002e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1712297958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297958, "uuid": "7fe59661-fcfd-4a8d-a527-53666ed8cfe3", "comment": "Malware payload (SnakeKeylogger)", "value": "10e2a14bbd30f30c2cb7260741a3d70f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297958, "uuid": "379dcdf4-1b7e-4eff-a640-c1a75abec418", "comment": "Malware payload (SnakeKeylogger)", "value": "8fb359ccf3a3b6a0eff8204f9ee27c2dc41b3270721716192a7ef9253453b59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297958, "uuid": "dd122361-31d6-4a17-9e3e-37166bf81811", "comment": "Malware payload (SnakeKeylogger)", "value": "aaf6c61c6f5e908e164de1b539096caf9fd9b4d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712297958, "uuid": "ee46096c-512e-4633-99e4-37513677608c", "comment": "Malware payload (SnakeKeylogger)", "value": "42c8ee32d893d3fb84e9091c61ca7fc2dcf53e9136204ccc263d3390a3f6a247782fbb75ddc20882435789665eaab4a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297958, "uuid": "eda4b012-8e7b-413d-b6e1-4b63b883727b", "value": "T192B4235064AD27BBC4FA8FBB08B24081D3F125B99663D1793DC781E859A0719DAC4FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297958, "uuid": "f21854c0-b0a5-463b-8fbb-733a4bc0614e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297958, "uuid": "5174b903-3407-4701-bb71-5a50ae98773a", "value": "12288:r5UHYFLi26lnnhwrqslyuBRlGxR7LBGJi:KHYFLiPlhwGKyuLlGxtwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712297958, "uuid": "175d4f3e-1201-44fb-ae05-2960e77ec024", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712297958, "uuid": "c6faae8d-f140-4ea5-aadf-017b8ad827c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712297958, "uuid": "6820546f-b412-459e-9c72-c6bff71138a9", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7b33d5-f39a-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712355565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355565, "uuid": "12394d1f-8a7b-42ee-9295-d32893e5e494", "comment": "Malware payload (njrat)", "value": "c0843930e4ea7d34e5f59d0b7d7fde04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355565, "uuid": "d35fce17-5bc5-469f-bde0-ba5b1386c902", "comment": "Malware payload (njrat)", "value": "9226ade19f95880e38c541b1971719ae8312217c4565d52097b60b3ec4e89854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355565, "uuid": "f9e1f0cc-231c-43b0-affa-ea604de101d0", "comment": "Malware payload (njrat)", "value": "4f24196573668330939b3a03daa51cd1be266af9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712355565, "uuid": "3d9b2525-d81f-4e79-aa5c-e5cebe804fde", "comment": "Malware payload (njrat)", "value": "0f558e4961fad5fa844ac8f9da6bbf67f10718bdea7024df56fd507d5ebe0934307a80e8b8fb57423ed72fd5d469ab6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355565, "uuid": "7065ee24-112a-4704-be01-5db4a7b5d35a", "value": "T1DCE2F84A7BB94125C2BC1AFC8CB3132107B2E3478532EB6F5CDC98CA4B676D04251AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355565, "uuid": "ac065cae-42b5-4fc9-b0c8-9feb78de57bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355565, "uuid": "bd23b591-0354-4296-aff5-f3fbf95221e5", "value": "384:G0bUe5XB4e0X2OSSCixBr/Q9WTKtTUFQqzFVObbk:HT9BulS9ifrYjPbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712355565, "uuid": "8dbde6a1-cd6d-447c-a3ba-bb696132c334", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712355565, "uuid": "eae981c2-954f-48cc-9269-880e6ea5313b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712355565, "uuid": "489809b1-4c7c-4666-87a9-143b301d3e45", "value": "xcdtTzO4LFYE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f839fa61-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712325246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "eb3e6833-d098-45d8-89aa-eb848d21e6b0", "comment": "Malware payload (njrat)", "value": "84769b547718b68fface344354cf26a7", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "0b2bbf64-88bb-47df-bbc9-3fd3abec33a7", "comment": "Malware payload (njrat)", "value": "939335d451713dbf01491fda82c9bc03b1cb793517f9fb3bb3a4581750aa5fdd", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "d0c8aed9-0692-4bcb-9141-96bbb96d1370", "comment": "Malware payload (njrat)", "value": "c1d3e84d82a97c9ac3e61f894d580c3211f0e909", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "3ad444e1-4392-4019-bd4e-95fa40161b0f", "comment": "Malware payload (njrat)", "value": "60736a5e4978d88769edc1bd357e407b8db0ff9956a9ab3d192693d1ae99fee78ae3b41a99dc1ac5709b43b01ea64745", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "385ff657-359a-45b3-93dc-7e1c2bfe249b", "value": "T1BEE2194A7BA58225C6BC1AFC8CB313210772E3478472EB5F5CDC98CA4B676D44285EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "a9fcb530-40e1-4472-9a9e-b9e27ccbd8a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "9d6443dc-5e3c-415b-8f60-972de15f0e77", "value": "384:G0bUe5XB4e0XtOdv3pixEpfUWTxtTUFQqzFFNObb9:HT9BuU13pis0ib9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325246, "uuid": "110cd426-646d-4ea1-a66f-675acec7884a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325246, "uuid": "d9064dfe-8689-46cb-9632-cbcdbefa59f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "cce2c156-9953-44e7-9756-29160413f439", "value": "1712325245721159bca57d1b66796bd3ddc0e68293cb290af6bbd263878d0bd09c0ee48caa758.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27666ff7-f380-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712344223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344223, "uuid": "fe83ca40-4923-40d8-985a-80655c9c8842", "comment": "Malware payload (Neshta)", "value": "a613d5d435e80a7369f73e1627e92c59", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344223, "uuid": "5b5a24c7-1725-48ef-ac13-58fdadf75d23", "comment": "Malware payload (Neshta)", "value": "9452a93a9a3cafae15835e770052669548b3e0cd50bf4eb29a3bc9513572dd8d", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344223, "uuid": "da5e1bda-3a42-4b8e-bbbf-ac7bb5b399e8", "comment": "Malware payload (Neshta)", "value": "f42b5dd8b8820dcaf36a4060a85e5d8d0c010431", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344223, "uuid": "c488e89f-3a80-43e8-b185-f81f925158e1", "comment": "Malware payload (Neshta)", "value": "cdd251803cbc43eba5bbf4ae8670769bc5194ccc8ce469730321e946fab769e8fc92c5c9dc8e08b8f63975f405a9cd95", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344223, "uuid": "af5bae8b-bd9e-46ab-932a-4f23a35dcd82", "value": "T1FC767D266ED48177F9B21732AE786B1D49BDFE340C31890F22A41F0D1A70B95AD27727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344223, "uuid": "0a905eb1-27ad-49c0-9c31-e8bf262788bd", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344223, "uuid": "cbeeaf2d-debe-47b4-99de-ddafad05a317", "value": "196608:jdPOvifHtaxEmed9ur9+1WRmVqe5pjWW4v:jdmCtaumeDurJ8DpjWWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344223, "uuid": "c9fcb684-7227-4f09-a057-f9715e69d6d5", "value": 7389520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344223, "uuid": "d67ab03e-9c03-4b4a-b3b3-c3fc8dc946f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344223, "uuid": "c9a66a80-7775-4d05-9b34-46a336c82c32", "value": "9452a93a9a3cafae15835e770052669548b3e0cd50bf4eb29a3bc9513572dd8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1bf17c-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335079, "uuid": "cf206bce-96ef-480c-a1a3-6fca8c2bec6d", "comment": "Malware payload (Gafgyt)", "value": "28b4ad083fa2e65962dc88a7fcf3affa", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335079, "uuid": "30bb0e58-fd41-4ffa-a031-929282093bc0", "comment": "Malware payload (Gafgyt)", "value": "967f593e5b536283176a3a5223d0d826627ce0b967f836aa36675fae6ae0777d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335079, "uuid": "cf6aff16-6f6a-4906-840a-03dc2fe0246c", "comment": "Malware payload (Gafgyt)", "value": "481884625433fcd57cbf4b8b4322c7b60b4041e6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335079, "uuid": "f4074e61-a3bb-4a73-ac84-427ec3634938", "comment": "Malware payload (Gafgyt)", "value": "5030c25b6fd23f7ca6b6deafecdde139facd2ac9c6e98aa7f2375f57bde815334132996e8596a6ed6d50aed80164a2d3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335079, "uuid": "7b87bef9-ade4-4db9-b015-e78c31fc396e", "value": "T198A36B27A551C67FC083A7F96BDBC5619423BC3A0B33320A73D4BEA92F168C91D59702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335079, "uuid": "5543a580-454e-41e6-8ccb-24f1b599a263", "value": "1536:+7634cQk8qj5Sb5z0BuP5XF12CZ3NiNZOgy03DYIv6xsTWhoWVa:QXlk8u58z0B+XFACp0NZOgp3D7v6xs6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335079, "uuid": "c02299e4-ce38-4728-9573-a52920f8d2a7", "value": 98168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335079, "uuid": "38d39502-75fa-434e-8ff7-003e609b501c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335079, "uuid": "5fb78971-b10e-4d77-984b-6f2cf829df3f", "value": "28b4ad083fa2e65962dc88a7fcf3affa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf13c55a-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712335056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335056, "uuid": "0282951f-f6c7-4c39-99d7-155ad4e03bb5", "comment": "Malware payload", "value": "bd8340fa79a06088e52ce3131fa3d281", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335056, "uuid": "71a9abda-9c82-4adc-bda2-a8c99faca508", "comment": "Malware payload", "value": "974ff4bbece5629e99d6eca4460f627842ba48497c81da3129a06c6318f55341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335056, "uuid": "7e9f7430-436a-4207-917a-ac4e3d76d28b", "comment": "Malware payload", "value": "fbfaac99e843972a3c26ae7616905945ccfc4a49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335056, "uuid": "024c64fc-4736-466b-a69d-2fc9bac885c2", "comment": "Malware payload", "value": "86307534aa645608d29618bd8deaca4204df82af96657222c43ca34802235bf257209061a488478405dee5573c9a10f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335056, "uuid": "af89f3cc-122f-4b7c-a52f-96c61424b631", "value": "T1151301617ACDC970E10C827DEAB95FF21054E2F786C9901FEB0C9663DFEB3494086A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335056, "uuid": "25a1656c-178c-4e6d-95c2-58e9a8c933e8", "value": "768:DOMp4YO3VuEy2IN4PmBf6QbSGIYC+0vDmwxzIdVb2DkJ2QkQYD:D16VuEywmMQbSBvJDmcI/UQkLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335056, "uuid": "7400ff6d-50e8-4292-b165-335a5fadc66c", "value": 41764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335056, "uuid": "c987dacc-9926-4f0e-9127-63137ddb4390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335056, "uuid": "edc94370-7b79-4412-b92c-02e62d54a042", "value": "bd8340fa79a06088e52ce3131fa3d281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62717f3-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344006, "uuid": "ccc473d3-b8c6-4fe5-a249-7fbe565cc23e", "comment": "Malware payload (Socks5Systemz)", "value": "5aec1fc1001d837691e1ba9e80ab25b4", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344006, "uuid": "c325d1b9-ebe2-4bdd-97b2-73c8224e4ca7", "comment": "Malware payload (Socks5Systemz)", "value": "983e108f1746ab70eb9d9d3ba2f8270d75c53cc038b0508f6b774d4ee39bd801", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344006, "uuid": "18367b37-72b2-4a4d-b8bf-5095e477df02", "comment": "Malware payload (Socks5Systemz)", "value": "a77b422b2cb6c93612c927c8e542d22b3f5f0bff", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344006, "uuid": "524fc17b-0e5f-4820-af0c-c72299e31637", "comment": "Malware payload (Socks5Systemz)", "value": "aad453680dcc23d7b2a69a95208a246301ccdd396e63dd7f3360fb525139b906e80b996c26d4ea66d817fd980d8d6b10", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344006, "uuid": "e4a5004a-ae2e-4b70-906c-b305304aed57", "value": "T1D9E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344006, "uuid": "811284f1-c389-4e94-a6df-f0ddfdb9270f", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344006, "uuid": "71536631-63fe-496d-a251-befecc31f999", "value": "12288:HjsgiZdvAeRwp+aLHp50cCNbBqArcvpWwBpmlRKLiTOkYRpSHO+k7iIjcBDQg5Ea:DsgwdvAggJ50cCNbBqAAvpfBpmlR+iT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344006, "uuid": "df26172f-dd7a-4239-a6dc-ce308c517634", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344006, "uuid": "9435e8ef-9b07-420a-b282-c6aebaa6df87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344006, "uuid": "bf9e0ec6-7bad-4be0-9414-6d8115304694", "value": "983e108f1746ab70eb9d9d3ba2f8270d75c53cc038b0508f6b774d4ee39bd801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e5e33f-f30e-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1712295548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295548, "uuid": "47218d1a-bf5b-44fb-ac1d-07effb23d707", "comment": "Malware payload (LummaStealer)", "value": "ceadf477dd0dd9681578032f4a8f9c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295548, "uuid": "3943acde-a37b-454c-b743-e94a1207ccff", "comment": "Malware payload (LummaStealer)", "value": "98f6ecc60e016311511ce920220598b33eb9671e7c71254e76d638d0f2a45883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295548, "uuid": "920fd2d7-95ad-4db4-8648-66c9d57ed0b0", "comment": "Malware payload (LummaStealer)", "value": "b769c106316c626ae05b7aa95acd6773eb027370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295548, "uuid": "8fc6df86-561e-4f3b-986d-db3c9593307a", "comment": "Malware payload (LummaStealer)", "value": "60d4303849a4eff95a9822f6a9cc382d7efbea8f083dab650b9f5546e789bfcf6c8a62315efcffd5a1d3b8e7ed76b87f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295548, "uuid": "a62c8339-9dbd-4220-92c6-fad2b1fcd516", "value": "T13E17334593FA18F8E56B887A4801BD09E7B57C044B74E5EF2394D19A3F336B0893A736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295548, "uuid": "5801a05d-4d48-46b5-9bed-7ba89e57f325", "value": "e8a30656287fe831c9782204ed10cd68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295548, "uuid": "b2f681c2-7519-4bc3-a5cc-6231b6508ca1", "value": "393216:u1GM169wLiaLBZlZvgmPqPNerU/odSkN1p/Us6uI6baSoKIna6tIw6aqyWzdIG/E:eJ1AajFPhU/6N1p9676eSaFmH7U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295548, "uuid": "c7f5de36-1b33-471c-a939-90421f502b59", "value": 19807008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295548, "uuid": "168cc9b7-a2f4-4169-a7d7-8a3b42bdc8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295548, "uuid": "5b1e696d-666f-4fb1-93c0-cf43d4fc65be", "value": "!!@Latest_$etup_2024_\u1e54\u1e01\u1e68\u1e68\u1e84\u1e4f\u1e5b\u1e0b#$.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96311d58-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309620, "uuid": "7135b6d6-8c6d-4375-b29a-cc75587928cc", "comment": "Malware payload (Gafgyt)", "value": "04a4b10d961f67da1c87d2c8c636a7ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309620, "uuid": "4e5d5649-447a-4c73-986f-0381c4322685", "comment": "Malware payload (Gafgyt)", "value": "9b08a6b7660c8a71cd8e315b2a3e576e0c7cd0bff450a19c3e6af6e93b7d8bec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309620, "uuid": "daada7e6-34a2-427e-840e-efa1faa6375c", "comment": "Malware payload (Gafgyt)", "value": "a42716048e607804e74f372a4232144682f1af19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309620, "uuid": "00e4d21e-5fd5-4be0-a0df-019396395b12", "comment": "Malware payload (Gafgyt)", "value": "87172805a3ad222eba1858a955b7b473c1a3423cadc2848eac444ca40108200250229f5156830d81967be5164ded9bb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309620, "uuid": "79e616d4-416d-4643-a3d3-3d005102d3b0", "value": "T133D329FAF703C6B2C44306F1115BAA675D21B2FB176E9945F7682C70EFA68C62411F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309620, "uuid": "4267cd44-548a-4f40-b990-cfa4bc0f5f43", "value": "3072:mqFhmlgER4K5Ywf61rwV5hccrUlmJ00OzQaGyPZk:m8aRN6rwV5hcLmJ00OzQaGyPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309620, "uuid": "c43c63e5-4aa4-4f75-b893-c463e6080613", "value": 135811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309620, "uuid": "ce357172-fc2f-4108-8e39-274fb7ce87d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309620, "uuid": "abc1921c-4b6e-4e14-842a-24f50cc2f039", "value": "04a4b10d961f67da1c87d2c8c636a7ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d974c347-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712323477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323477, "uuid": "d2ebdcc1-dbcb-4280-9f32-e2b57ee0e566", "comment": "Malware payload", "value": "62515825a762a77f4ff509b783ac9c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323477, "uuid": "eeda861a-dbaa-4ae0-a022-1bd7a99127e0", "comment": "Malware payload", "value": "9bd687024b97b4e96edc0b71e2a2cb6346feed9a370de252ffd2baff02ad402c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323477, "uuid": "fab02698-2c75-47f0-8e17-48a2138a8835", "comment": "Malware payload", "value": "21060570ef29d1744e2a3d287c3a6908caae4789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323477, "uuid": "f64d8512-4045-4681-99e2-4ee1bc2e98a1", "comment": "Malware payload", "value": "a67fd5cfe288eb7e8999813607d7afa139bc7c25f8fb4d87320a8e4153980facebd4383127cd1cec972019f3c86abb1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323477, "uuid": "548cac64-7ee0-4b1d-9103-66596b094408", "value": "T1FE93AF54D78684F2EBD3457014BE67D3D639BD272B04E9D3C7A02E86AC712D0A93D3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323477, "uuid": "ce4666b6-5fde-4501-9fde-a7e639bcee82", "value": "c552a31531df962b2298e689961d15c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323477, "uuid": "433bb1f8-d7be-47b6-9a65-80a7baeb2818", "value": "1536:ugRh6VPamHMiZ4Um6wjGv5ut4qDvEJW9BiJAKkC1J9Y+Z85B:ug/4PaMZ4Hg5uHDvEJW9IAlC1WB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323477, "uuid": "52a0e6f0-0595-495a-8d7c-d8dfecfedaab", "value": 95758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323477, "uuid": "ed98f15c-21d7-4010-b06a-fa06f8b64f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323477, "uuid": "7a5027e8-246d-4142-85cf-df5b7937100b", "value": "9bd687024b97b4e96edc0b71e2a2cb6346feed9a370de252ffd2baff02ad402c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b05dbe1-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286623, "uuid": "1fd9bcc2-fadd-4d69-a109-4a198691a2cc", "comment": "Malware payload (Gafgyt)", "value": "815f47242333c0c6684eca6b4edaab89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286623, "uuid": "62a459d2-820e-469d-8113-853a9c462174", "comment": "Malware payload (Gafgyt)", "value": "9cc36d5d643e31415aae20bbca545a4fae773464e35a53c6f0dc58ee476cd26f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286623, "uuid": "2a738360-1115-448c-80fc-60151f2f90fa", "comment": "Malware payload (Gafgyt)", "value": "3e868a79738c588be4412b98465241fe5b088423", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286623, "uuid": "3af662f5-36f6-49d5-b8e1-7805aa0e8fad", "comment": "Malware payload (Gafgyt)", "value": "3ee327f0dabd52371e737971a1439298d6e1752b0d9d56f969d2bbedb59405a3ca7cb1baa166d2a88a24e283c4bf1744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286623, "uuid": "ff34a291-515f-415b-93d6-3ffb5ca38dd7", "value": "T1E3C32BB5F740C672D18301F2119BDF624D32F2F7169AA54AE3682DB0CE6A1827563F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286623, "uuid": "534ce85c-4240-4e56-8fa5-048bbd6ed2df", "value": "3072:SNhAfn3U8UXULUwUbUJ1hYlHRRDsBOnRd5hgkEemJC0OzQaGyPZk:SMf3ts05gehYlxO4Rd5hgEmJC0OzQaGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286623, "uuid": "be37e6d4-b762-458f-a2c7-036251b6fc8c", "value": 123364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286623, "uuid": "a0a6a81f-d5ca-47bb-b624-558486969e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286623, "uuid": "b7baebb8-445f-48c4-bba0-36b5194b4583", "value": "815f47242333c0c6684eca6b4edaab89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e042c42-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309579, "uuid": "961d716e-bc38-4eac-9e3a-2874a5a3531c", "comment": "Malware payload (Gafgyt)", "value": "c52e181cc73df264e8c931452a3aa40f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309579, "uuid": "06907268-c12e-4812-b8e4-0d382d51b078", "comment": "Malware payload (Gafgyt)", "value": "9cc59ceb2495a964a1d0cde5dc724258452de8a450f0b7e832495c9e887be36b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309579, "uuid": "7998ac23-0d3e-4d16-b6d7-14d7199b1c92", "comment": "Malware payload (Gafgyt)", "value": "bf63316d46c2b02677fb192de46f848912690ed2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309579, "uuid": "f824c0f2-334f-4e73-8252-2fdc875e82b2", "comment": "Malware payload (Gafgyt)", "value": "18c129b5ec5174e9cb87c0f69fb4a999b6dc3577c594c92d777b616d44447355ac03a74ef2e0fdec25c32534c66323f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309579, "uuid": "eb33a419-c14c-49fe-9162-3b02379edb32", "value": "T194F3D73BB7170F63C0C501B111E72632ACA5C3DA34F952D7AAE42D5C5F2A58838A6EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309579, "uuid": "7c287384-00fa-4cac-9188-eec5cfefe672", "value": "3072:9oCJVR/5Tb+pKS2N8pr/2phaPFQGbcsDk2vFfsmzbEq/dNYy2Se:9Nv+wphadQGrsmzbEq/dNYy2Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309579, "uuid": "b0897d3f-5371-448f-b3b5-69d05e053917", "value": 162756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309579, "uuid": "50adc7ae-e770-49ef-aa7b-cb04779dceee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309579, "uuid": "ac05ef39-5ee6-431a-a629-d1dd5a20f8dc", "value": "c52e181cc73df264e8c931452a3aa40f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5018b73f-f345-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712318951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318951, "uuid": "14a316ac-8b75-4b3d-b318-5186fb956f5c", "comment": "Malware payload (AgentTesla)", "value": "e4604ef80b174aa323453b26d93801fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318951, "uuid": "1f7a658c-6cf3-4c7c-af57-9dd6ecbd46a0", "comment": "Malware payload (AgentTesla)", "value": "9d3e08381fcf52ee5397eebffe263bfb01850a54c0f23c3b386b76fe3a0d25f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318951, "uuid": "9bd93764-5148-4037-b961-9f65f3e66aea", "comment": "Malware payload (AgentTesla)", "value": "008f8695ebacf172863898c8419ecd50c55f076d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318951, "uuid": "42604eb6-cac0-4435-a53f-1cb0e1d69360", "comment": "Malware payload (AgentTesla)", "value": "e3ba110748bc240b612cbd0d49e5bde0e38fa635e56fe9fc9538af3ec44b75176e81fd514fb11198372c3d5aeb5e07c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318951, "uuid": "82d2512f-df07-4e7a-a9e2-80c7bef631c9", "value": "T14BF412527390D1E7DBA88BF21CA7CAA61EF16C4917D9524BD6FD332DE032362480F649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318951, "uuid": "a1e258cb-e286-45d6-8a19-01aec3353144", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318951, "uuid": "cb4544f4-f5d4-4ba4-a244-e712ed6066cc", "value": "12288:g396BGtxLg6yk19rGAp0EpsziNuL/bnB5yELdJ2lb5dhl04aCzgNfvdi:g393tRyyGAfpseNu77nTL/215dF0tFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318951, "uuid": "946c50e6-d30f-4b7c-b5ff-7b6d5e311eb6", "value": 730020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318951, "uuid": "1ae82e6a-7fd5-4752-95a7-27e19ca42901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318951, "uuid": "695948bc-59a6-4264-a0b9-7a9035293e81", "value": "9d3e08381fcf52ee5397eebffe263bfb01850a54c0f23c3b386b76fe3a0d25f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a034d2ac-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309637, "uuid": "ce69f815-6b79-42f3-a5a8-61c1fe81ad7b", "comment": "Malware payload (Gafgyt)", "value": "b71ae5a356904a495c9e8558d37cd823", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309637, "uuid": "8e9149c3-830b-438f-b96e-59f6c9fdac4c", "comment": "Malware payload (Gafgyt)", "value": "9d41eb33987936a97e64edb2cae685f7f028bbf009cbe54a2d6d95057c4d5407", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309637, "uuid": "f4adb002-bd6e-4fd8-9037-f180114b1b20", "comment": "Malware payload (Gafgyt)", "value": "a1fae6cbe32ceb6587a6574615047c20fd5ca991", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309637, "uuid": "b0e55bcb-efff-4a1f-9b75-587b23ea0308", "comment": "Malware payload (Gafgyt)", "value": "9a6ef571a2c53d9928a40c3b6e378da684f6d1554ad645a5e4170680a81260c4775bcfc09d78ea5826baf359750ead70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309637, "uuid": "bf83e351-6d39-435b-a297-8c7b6956f4f5", "value": "T14F146369B7619EB7D80FCE7305DA59121C8C928642E93FABB3B4C518EB9784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309637, "uuid": "d802acba-fc63-439f-bd10-b84bb76171e9", "value": "3072:aqFcI6coFw7B310D5hWRrLVLhmv8Aqx1BVnKoe:apIgwFF0D5hWBJhmv8Aqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309637, "uuid": "084c43f0-a5c3-4748-8fdb-e2c97434f4c6", "value": 193699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309637, "uuid": "a65397ad-6091-4256-bc07-6f847e2c64c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309637, "uuid": "ff0f42f4-e4f7-4d4b-91a5-4b199b07d753", "value": "b71ae5a356904a495c9e8558d37cd823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2898c955-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344225, "uuid": "b6f3dc5d-3aed-41a7-8656-76c79f8e60e4", "comment": "Malware payload", "value": "b8ba303732a4dca0e0c818f4a08b08e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344225, "uuid": "009b948a-c015-428f-9f78-9bd9979c6fb2", "comment": "Malware payload", "value": "9dff8d617b5d52df6c6d948e3f422ea706cffed1862a442205b54b9ef60082c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344225, "uuid": "59dc912a-ac49-4040-b7a9-fde3bc749827", "comment": "Malware payload", "value": "7e4a07c0d78ff758084fbc17f16d1849d8ecf2e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344225, "uuid": "a38b421a-f9d5-4113-94b7-f177b61cd390", "comment": "Malware payload", "value": "bcf466a0b894c2cc1f29956ef13e3c0ce9d6c41e77d0a26045f2f3baf090657a804e690205ccc301c8c3f1e479cfd401", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344225, "uuid": "4a323b12-5d08-449f-b8f3-22f7fdfa39bc", "value": "T1E9148C57B3E071F9E5764679CC514616EB7638322B209BAF03A446792F273C0AE3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344225, "uuid": "33f4cdaf-aca8-442a-85e6-441299806653", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344225, "uuid": "f64abe33-f5a7-488c-b7e3-792f966c6f1c", "value": "3072:sr85C51pbtKoiOYbu1lGcuTe4v4UpnrrkSBXcB/d3VIRpM2Abh:k951JhiOEyGzeqp0SB18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344225, "uuid": "04894a6f-5666-4cf7-8dbe-31d7da955834", "value": 200456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344225, "uuid": "30583c0e-c206-4e17-bc5d-cda89afc8a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344225, "uuid": "2ce4c89f-1e0b-4e84-ad98-ca43be001f9b", "value": "9dff8d617b5d52df6c6d948e3f422ea706cffed1862a442205b54b9ef60082c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a750d3c9-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344008, "uuid": "9b96e511-92cd-4747-9a6b-d25242f2e94b", "comment": "Malware payload (Socks5Systemz)", "value": "13177e14e911ddb8f28984690649095c", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344008, "uuid": "8ea34be4-0f3c-40a0-ae8f-8692f66fd2ee", "comment": "Malware payload (Socks5Systemz)", "value": "9e1a5046ebb720a0fcd1b3383a3f578b369a7b389b77bbb29865ed02236388cc", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344008, "uuid": "2f412b11-cabc-4c5b-b0b3-b5358a6256af", "comment": "Malware payload (Socks5Systemz)", "value": "540e9efd8a010a00b1eb4c9230f61ea09f8340c9", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344008, "uuid": "c963d184-589d-4863-a8e0-28487d83b61a", "comment": "Malware payload (Socks5Systemz)", "value": "574e38d27ccb84a01b2207ffdff3cfc6e531831d70fb99c141b0b1c23518adb9fda281f9d6ffb39f292a655be063d17a", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344008, "uuid": "1c46ecbe-4094-4a52-854c-d20b6adca569", "value": "T109E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344008, "uuid": "3e21ddc1-5753-4bb6-9bca-169d4f1b6a07", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344008, "uuid": "98499168-73b8-4e03-a07d-d7a9b0cc92f8", "value": "12288:HjsgiZdvAeRwn+ahHR50cCJxBq09cvpWwhLmpRKLiTOkIRpQHkmkxiIjcBDQg5Ee:DsgwdvAe6x50cCJxBq0mvpfhLmpR+iTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344008, "uuid": "650caa31-f845-4ce6-ad14-0303c4435523", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344008, "uuid": "779d7fa6-fcda-47b5-aba6-88d3e3ed0216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344008, "uuid": "09e70dbd-d076-4fe8-998b-70fa51272f4a", "value": "9e1a5046ebb720a0fcd1b3383a3f578b369a7b389b77bbb29865ed02236388cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc26b716-f300-11ee-a120-42010a9c002e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1712289605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712289605, "uuid": "e8c96e1b-8c21-4e31-a883-56634e5dc4a3", "comment": "Malware payload (Gh0stRAT)", "value": "3dfe6ff32db8cd1e7f6b2fba4c308836", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712289605, "uuid": "a6040466-fd59-47c9-97c8-72d8fcd9eeff", "comment": "Malware payload (Gh0stRAT)", "value": "9f61a3757f737404c25a2837ddd1ff6c14dfe394127c8a94c5c10f00dfa34811", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712289605, "uuid": "5a7fac9a-51b8-4e67-a307-bea721d8f3e2", "comment": "Malware payload (Gh0stRAT)", "value": "a609b1de628998746bd1f33616f2a3324764fb52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712289605, "uuid": "f8f95966-dd0a-4905-b98b-0e1d89fc3286", "comment": "Malware payload (Gh0stRAT)", "value": "f923a42ce68795b27106ef8c794d4f9a377b284ac5c65aadec3d443432b7e4cb5886a10ea001d26bd64a10c935bef3ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712289605, "uuid": "9d9fcd3b-c27f-4c10-b5f7-8a20c5f8fcc7", "value": "T1F826D043B5954862C3C85671DE67DAB39B207EBE1BF3423EB648FDC43B352447A22225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712289605, "uuid": "54213f75-ef0e-4527-ac2f-cd2d081c97c2", "value": "eeac73be37480fd144f387e3563a0f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712289605, "uuid": "2ca2a89c-a091-4a1d-9f01-1ae1ede3fe6e", "value": "98304:iws2ANnKXOaeOgmh707KZxDnDCa+WlcelG07E2MLM:4KXbeO7a2v5zyelw2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712289605, "uuid": "43ec49ea-ca2c-43e1-8e09-a8e251551adf", "value": 4844062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712289605, "uuid": "493c7270-0750-47b0-98d7-95f9b2c5b9dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712289605, "uuid": "42abb083-3ff3-48b8-ae33-d5f2eb13d65b", "value": "3dfe6ff32db8cd1e7f6b2fba4c308836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47921fa7-f2fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712287154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287154, "uuid": "236d6889-b00f-49b9-85bb-237f2efe7746", "comment": "Malware payload (Formbook)", "value": "5fe4e1859b1bd6b42919a10ef385cde3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287154, "uuid": "97b414ba-7f43-48b7-a86d-2d45b27ff837", "comment": "Malware payload (Formbook)", "value": "9f6eb9b6b3bf92a75e32208dd51ce6307fa5ccdae27f02f0c7e2712544c2c04f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287154, "uuid": "443276b7-047c-4653-8b7c-3724021689a0", "comment": "Malware payload (Formbook)", "value": "00582d66344bad1a7b69106bc77c7e4142bcbf53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287154, "uuid": "dfb2cd5d-fbad-46f0-8e18-4ed72ed340fb", "comment": "Malware payload (Formbook)", "value": "154a8a100627d9b87d5af1662b26e88c3ca759fa52f5fddc5a080b507a60577e8657f9e21fc0da0aad182441f91f93ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287154, "uuid": "2f1ac37b-f23b-454e-ba23-ca23b74b0c57", "value": "T1FBD42392E74D2F11F17F87B94CB189619727AF976942D2EC4E83C1F282B135499E320B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287154, "uuid": "8f46d1cf-30cb-4833-92dc-4eebc1424731", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287154, "uuid": "157e3ea5-6b8f-4d5f-8fcb-82f89a61bc70", "value": "12288:7XVUHAjgfo3wIuzPuVAiy7VyaJDIJQOMv/o/bigpWxir3undwDS:+HAqo3wwFsVyaJ82LA/Gykqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712287154, "uuid": "1c83f020-eeac-4f3f-be45-c252be15491e", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712287154, "uuid": "b818f8bc-39f8-4e39-b4b7-4f163837e962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287154, "uuid": "aba5517b-fe85-4294-9453-41501dd88c3f", "value": "SecuriteInfo.com.Win32.PWSX-gen.20132.3337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a66399-f380-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1712344227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344227, "uuid": "f885beaf-9d3d-446c-927f-6107035c34fb", "comment": "Malware payload (Neshta)", "value": "0e8e9957231a021ec5ff92da17e17177", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344227, "uuid": "dcd4d90a-716f-4e7e-be57-08090b94d070", "comment": "Malware payload (Neshta)", "value": "9f8cf9ba6dbd13f970e1413410dc2a7c7bebb76dd94434f0eb004401a268fa28", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344227, "uuid": "c832b702-db41-4433-a95a-6bfcdd6176b6", "comment": "Malware payload (Neshta)", "value": "e64893538fd7cdd60191576a0533eba967511258", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344227, "uuid": "9498672c-9d55-44a3-ad68-60adc7d9f3b1", "comment": "Malware payload (Neshta)", "value": "d3aa2d2438fac83025cdff4c58fe5efcfc2a94567cc08bae56f8e5f40a5fe5a16f57ae83e3f59a199c502b2d6a359f21", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344227, "uuid": "4dd7d5e9-61c4-4fcb-94e9-84a1006081d9", "value": "T11CB43CD3D8DB29A4DC139837213A2C5E6967780A83DB15763380B616ADE32C387F7653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344227, "uuid": "7cd6de95-0343-49f4-b884-80463986aa3b", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344227, "uuid": "46341289-c247-4a25-b87d-d468fc481b29", "value": "6144:k90PL27eaxwTh7qSqRKb8l3Wvo3jrEvTDp9WjcqwqwJWobF3rutOiUbRq:ZPa6qAPo3jrE7dtbktOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344227, "uuid": "1c9db732-3c9c-4a70-bfe6-ed7e41abca3a", "value": 526728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344227, "uuid": "036add87-388d-4a7e-9584-4e2313b2f05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344227, "uuid": "072dc4a8-69a3-40dd-80ea-3e8dbd049a94", "value": "9f8cf9ba6dbd13f970e1413410dc2a7c7bebb76dd94434f0eb004401a268fa28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f782925a-f34b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712321809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321809, "uuid": "0bebff55-366b-41da-9be2-67ac07a4444d", "comment": "Malware payload", "value": "74b6a1cd33722988e9423c0fa7c3d074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321809, "uuid": "b52b20c3-05d2-46f8-98c1-af79fc26b932", "comment": "Malware payload", "value": "a2297e35542f9f65d9fcc9226bc7904ae126729a396afb179f236be3aba9667c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321809, "uuid": "a8cd9b35-988e-406b-a3b2-a2ce0a7fc46a", "comment": "Malware payload", "value": "bed9f4a6f03442c89bba7e0c92d791580ad488f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321809, "uuid": "a7217945-f818-4145-aa20-490b93a75406", "comment": "Malware payload", "value": "3083a76254910613fc55c9379b8c45f3cdc00d389601e203172fcd71a16ba80bdfa21a7fb6d74babfa7a18ed4e61cd87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321809, "uuid": "d5f8b030-e5d1-483b-8b5c-61b64928d99e", "value": "T1BCC4131067FE413EEAEF5679B87421000BBAFBA7A502D7DF9C1055EA6963BC00721367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321809, "uuid": "0c68dd76-1969-4825-9973-3dce39135b1a", "value": "12288:Gf2Ov+kR/c07tYZLyOJ1nlffll8QNOBf7sjqDz6/wM5pu+g:wFRU0BYZOEvlHkojSz63a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321809, "uuid": "19925807-2600-40b0-a21f-1de9e3b6ae39", "value": 580609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321809, "uuid": "964a33b8-d5ae-4dc5-8085-d1d3c790a069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321809, "uuid": "defd8552-76b0-407e-949c-48fc219f9cae", "value": "a2297e35542f9f65d9fcc9226bc7904ae126729a396afb179f236be3aba9667c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86da652-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344010, "uuid": "c3f30811-177a-423c-86ad-924681f35685", "comment": "Malware payload (Socks5Systemz)", "value": "82b4660c5fbad7003ab3dbf457271f05", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344010, "uuid": "77d1a5fa-4199-405f-93ab-f694ef951b6c", "comment": "Malware payload (Socks5Systemz)", "value": "a241b5b19f06831b94b3c3d16d725888428408baf144eae185349aad7b093b88", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344010, "uuid": "1cea519b-a3fa-4865-92e7-64193c2c5d75", "comment": "Malware payload (Socks5Systemz)", "value": "42b8abe501a8bfa06b346bc8c18699bcc04aae25", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344010, "uuid": "fa7fc5ab-3c83-4cdd-b7df-a2392a4939ad", "comment": "Malware payload (Socks5Systemz)", "value": "9458ea48c244b0d78ca154b131ead96ea70c8c9b95c2bb8213ecd64f28ca98fa1ea30ffcc46c46ee55228b376880f7d8", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344010, "uuid": "7764c381-e0f8-4b7a-837e-ba0b36d925a8", "value": "T1E2E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344010, "uuid": "418a710b-5fd7-4a3e-8bd7-7def9e80aae1", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344010, "uuid": "4ab368d9-767d-44c6-ae50-50e0058573e9", "value": "12288:HjsgiZdvAeRwZ+aZHR50cCVNBqQZcvpWwVXmlRKLiTOk0Rp4HsekBiIjcBDQg5E+:DsgwdvAw+x50cCVNBqQSvpfVXmlR+iT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344010, "uuid": "971b4a91-2f81-4704-8439-00cb4ba20f16", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344010, "uuid": "a298d729-3d38-48dc-a9b3-f58fec4fd5c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344010, "uuid": "8fa31053-adb0-4a47-ae31-737bf99de1f9", "value": "a241b5b19f06831b94b3c3d16d725888428408baf144eae185349aad7b093b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27f82e6-f2ec-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712280864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280864, "uuid": "876d7fe2-fad0-4d51-8852-cc1bfcabaee5", "comment": "Malware payload", "value": "08ad4a8c9417233f3b926d7a14cc7ecc", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "KLRemota", "colour": "#F36860", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280864, "uuid": "152e96cf-3b4d-49e5-aad7-96094b04ca50", "comment": "Malware payload", "value": "a2e814622d2972d34e412c33b8e6ace3ab07b757b74a738f55692ba0cdd69a23", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "KLRemota", "colour": "#F36860", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280864, "uuid": "0e69f0a5-3cc2-4de0-9e56-4a684f36cf00", "comment": "Malware payload", "value": "f37a7c545a9093bbcd49cc4e53d57765e2b3f2a2", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "KLRemota", "colour": "#F36860", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712280864, "uuid": "af102a2a-587c-4562-822c-29a6a3a6eb76", "comment": "Malware payload", "value": "790fae6fabb441c8512a15f4f1a7519b09b86e0aba6a72428e778afe6563d81c06c4b07717e2a55bf66cbad72a83b4dd", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "KLRemota", "colour": "#F36860", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280864, "uuid": "344b9197-32e2-4dbb-8f95-f9ac2d747b96", "value": "T1BD96336EF9BDE7BD49E57C4CE8582D7AADC2595130100C912871F40A12ECBAE4E372E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280864, "uuid": "ad0cd7f1-7000-415c-b128-ae269d6cc4f5", "value": "196608:KmznoZyd+EvkzRRLQoIh1tC7noE/THUSMB1hzZUwe0qY4qoS0T:KmzoZydDkzQoK1tC7nfz+9Ze3QXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712280864, "uuid": "b35af9f9-9f3d-4044-9d0e-8e2c369f38ca", "value": 8928172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712280864, "uuid": "cd945aaf-907b-4004-8845-e93ba668e208", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712280864, "uuid": "426891e0-e116-4d57-beac-be88d98f2575", "value": "a2e814622d2972d34e412c33b8e6ace3ab07b757b74a738f55692ba0cdd69a23.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a557dcd-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712321035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321035, "uuid": "6e1f3916-173e-44ca-82eb-e46fed8ae8ee", "comment": "Malware payload (Mirai)", "value": "c3c5c5131e0bacbd76d7a4d6f28f7061", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321035, "uuid": "5e3b00e8-89b1-405b-a120-4d845eae25a8", "comment": "Malware payload (Mirai)", "value": "a31355f0dfd026771870031fcf1e3d067184e1b0dfad03e3b075906438048d96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321035, "uuid": "1c7f25e1-4893-4b7f-8dac-8548bd23a55a", "comment": "Malware payload (Mirai)", "value": "a2fcf7cc251c3d23c3a9c0cf8aeca1dd4b6fddc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321035, "uuid": "ce1d95f9-3b46-4228-b1d6-e20aeb6af06e", "comment": "Malware payload (Mirai)", "value": "7a9c86d5f829f9de7a09b32fb229657825a2d61b1f5a342c58e3d00cc316ea45dea11d468cadef5933cdd68498f2c8f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321035, "uuid": "7c06a71b-96bb-4ff2-901c-20d633135e85", "value": "T173230272890ECDB164703C77DB999393B6E12AB5C6673013D6280B3C2FB46531E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321035, "uuid": "37aad9e8-91ea-4518-b1c8-fcf40d334286", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3UF9q3UELbUXfi6nVMQHI4vcGpvG:gECFd+A6YHAxlLRQZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321035, "uuid": "013d180e-7185-479e-9367-28ffab0df55d", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321035, "uuid": "cedbaf40-d5ed-4f82-a4f0-1b12ec582420", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321035, "uuid": "7b805471-5a79-4e07-84fc-b3e6a8b86705", "value": "c3c5c5131e0bacbd76d7a4d6f28f7061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87142c79-f30f-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712295851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295851, "uuid": "d146391d-47e4-42e3-9d0c-b59a033b08ae", "comment": "Malware payload (RedLineStealer)", "value": "6fb5a67db601271ac1ccaff256210fed", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295851, "uuid": "3f52d3cc-736e-4a83-a7ad-ba7aa6a4c4e8", "comment": "Malware payload (RedLineStealer)", "value": "a35ebba962827834f37261c10a5dfe4b1e187dfdd01ab078cb3165345459beae", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295851, "uuid": "6fd35a18-5ea0-4e06-8994-4264f0f480e5", "comment": "Malware payload (RedLineStealer)", "value": "a6e624b2478ea3a69b6ea684d75c76dbbaf5da60", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295851, "uuid": "a513144a-2c30-4e32-8ec6-17e07f1e5708", "comment": "Malware payload (RedLineStealer)", "value": "2d53ba0a4703dc46739658c3f0b5f16a0b7db8f866c477f9c1f8cb0cf2a09b730d304ef2e8f7571523788ddd8247a907", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295851, "uuid": "d6b76c25-17c7-424a-8def-09c562fd83d4", "value": "T129F42334C0D6A9F433FA444E8E51678DAECF2C8E4196A6336251246397E347A36CF1F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295851, "uuid": "6aa58854-7601-4ce3-b5c1-f671fa93f46f", "value": "12288:7nSpjY5WZwO9ThMEM/AhzpTECZ0/9f78CYuiIY4fhMjkvEkb1SZ0zSk8bAZKJl:7cE5WSO9Taj/AhdTEi0d7859jDO1YgSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295851, "uuid": "616c716d-eeb5-4e41-a7b8-a2a06b057613", "value": 778585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295851, "uuid": "629c5fbb-2432-4fb6-bc13-0b46efe4b7a0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295851, "uuid": "e541d0cb-d9e5-4396-a646-becb82f24b98", "value": "INQUIRY#46789-APRIL PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97a98d6-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344012, "uuid": "800f8c7b-21aa-4f91-9814-a659efe431a1", "comment": "Malware payload (Socks5Systemz)", "value": "f3b25d179b92096553239b14351e049e", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344012, "uuid": "20c3ba5f-6466-4900-9580-b7d2b5b6ddca", "comment": "Malware payload (Socks5Systemz)", "value": "a3a994244a221cabe5277dab3428ce40e560cf197b114898bd84f75e723ca411", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344012, "uuid": "736a82d2-638c-4559-94cc-aff8df375482", "comment": "Malware payload (Socks5Systemz)", "value": "00237a9a9e1e49b943e31ec719fa0f537d2a81bd", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344012, "uuid": "94dbd905-476e-4b09-8e9a-89666317e399", "comment": "Malware payload (Socks5Systemz)", "value": "2e24a18cc610dc6c55b747e507cb2a28f7eae2e3951f01d973c4e765bb3194ad0607251210c8492072239f4b924e3f11", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344012, "uuid": "98c1bc0a-a077-4123-bf28-babf13b2d7dc", "value": "T1BDE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D9789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344012, "uuid": "7075bd86-a665-4056-a0d2-383c2b6cccc3", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344012, "uuid": "a47f01ec-cf61-4adc-997b-19d3d58f8ba5", "value": "12288:HjsgiZdvAeRw3+aGHr50cC90BquIcvpWwH6mTRKLiTOkoRpzHlYk4iIjcBDQg5E+:DsgwdvAOBL50cC90BquZvpfH6mTR+iTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344012, "uuid": "22f114b7-9cf9-43bf-8c58-319541ec534a", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344012, "uuid": "a8a32af2-0b1d-4c85-a5b3-e87756915c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344012, "uuid": "897d62f7-6e7c-403f-9f23-d52e9e6c01d1", "value": "a3a994244a221cabe5277dab3428ce40e560cf197b114898bd84f75e723ca411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1a4c18-f350-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712323724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323724, "uuid": "a4b27463-ff60-4236-bc88-7e6f14bc0fd5", "comment": "Malware payload (Mirai)", "value": "f6430e21a13f6832f40dfd6545942d84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323724, "uuid": "8d04768d-e3ff-4e8b-aa65-7dbf8f893e59", "comment": "Malware payload (Mirai)", "value": "a41754c1f351834cafca1ec467c8c1565855f8099155c93d4bfed75e5f0fff97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323724, "uuid": "33bab7fc-80e8-4e1b-86d9-0f2aa81c07d2", "comment": "Malware payload (Mirai)", "value": "6685a25c0803209e451385718a194a79f2bdfd2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323724, "uuid": "85c0c3ff-6b3c-499a-ae03-c73e39db4a93", "comment": "Malware payload (Mirai)", "value": "1dd550b084e28a5c3537a0a9b4e3960ef3d825bfe044affb08c5ae39b4c9b643698d22234a77e55fc84e5f929287d187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323724, "uuid": "07abc656-be6a-4a5b-9978-8f2931fe242b", "value": "T1E293C81E2E219FBDF759C33447B78E25A39833862BE1C641D29CD6016E6074E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323724, "uuid": "bcc73dc3-4be8-4473-a521-dc15e9e55ff0", "value": "1536:/hK1Hb/V3UyGzDDvnjXZRfqy09kqGTkQHmFTI2RqserCzTCo:U1Hbd3UyGTn9RfkMTkQcTlqSzTCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323724, "uuid": "6413fc6b-c253-4e3e-8e94-8cc79b6bdbdd", "value": 97644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323724, "uuid": "e567b432-a58a-4cab-ac4a-e4e44d1cbae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323724, "uuid": "8f06200a-a5b5-4a08-a2ad-05fdc251d9e2", "value": "f6430e21a13f6832f40dfd6545942d84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e113b7f-f2f1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712282790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712282790, "uuid": "4f8cba7f-bc42-456c-a46b-175b7bf203de", "comment": "Malware payload", "value": "18a6f3f0e94cec4b1d35500db3fcf498", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712282790, "uuid": "220498f1-23aa-4f13-9845-d7bdcfb119bb", "comment": "Malware payload", "value": "a8526ff3f0e18aac83823c31637b93c5033266fb6ae6b3e26d5f5891480d6b4e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712282790, "uuid": "023800f3-193f-4fe3-8aba-4d0c9ec607dc", "comment": "Malware payload", "value": "ae26e5e082f9540e1b6f92eca521ab1a6c7a06ca", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712282790, "uuid": "5ac02945-dce0-4eff-a55f-d896d5bdd39b", "comment": "Malware payload", "value": "8dcd6272d426f8a5f5d42a53355c1b43b324ff86986a0f31f81a9359d946171dba9e26fbffc0a97bfb3262e1ef514a0b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712282790, "uuid": "ec9b88df-838d-4331-a015-2549f4d695f5", "value": "T163E51207F9229467D4FAD3361A62662960774C1403839B65381C3BFFA37F5DA0F9AAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712282790, "uuid": "ae432517-ddb3-469a-9124-fe5649a9af4d", "value": "49152:a/cxhynArTcPcn0s1YsggUMQgI+QFHCMMJRw65ya//kbBIoWpm:a/cxQnSgPKyMQgI+QFHCMw5yasbBIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712282790, "uuid": "b6c64481-7595-4f2e-9c92-3ee521bc0c05", "value": 3230647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712282790, "uuid": "f4006f35-0741-4b89-874a-e4e646848d41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712282790, "uuid": "60b2134a-9c29-4ca4-9dbe-1ae74f8ac504", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb4bd27-f350-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712323668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323668, "uuid": "963f27fa-3540-4289-8165-5463eeb4c546", "comment": "Malware payload", "value": "79038e38873ac647ad2cd2a3be7641e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323668, "uuid": "4ad85d2a-46c6-4772-8eb7-2aaffe33355d", "comment": "Malware payload", "value": "a855a9078ed92c0d403494ba0e1db42f02f04bd2e5d27e276b18e8cd0ebb2f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323668, "uuid": "83deefd0-321d-472b-bbf4-63260e2faff2", "comment": "Malware payload", "value": "bdc4a3a0f66cee3af85048dd39aa81866247d738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323668, "uuid": "4ce3c8fc-533b-4f37-9911-d151896625ce", "comment": "Malware payload", "value": "72a1b7c7883778bea2e5a51ee3b96f7128f0f69326ea720be8b47bcb62553071e342bb4a566db17720f1ecf00652d99a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323668, "uuid": "320657d9-1720-4192-97f3-bf9427bf87d6", "value": "T193644B22FB55C277EA96027289A99F6E401DEE810F3451C7D2C87A6DDDA07C21F3235E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323668, "uuid": "dc87c864-d177-4f22-bd19-96427fd7cdc7", "value": "80c713bacba00b3ee0a9ba457c64e205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323668, "uuid": "8e041be5-9fbf-4412-bdad-7098762992f4", "value": "6144:Nm1Hykp0L2nve8sEEGiX+oJEsgDEvDO9dscKqmXLprUX6KFGqUm:NhLRXG5qH83h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323668, "uuid": "f385af3a-70a9-409f-9db2-02bc96f8e220", "value": 336192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323668, "uuid": "ae11eb66-a06e-4413-ab0b-b509b9d0ecf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323668, "uuid": "4171bbbb-83c4-4a62-8829-811ae17067f8", "value": "sample.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cea0909-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344232, "uuid": "99ffdee7-7e33-4b10-802a-ce43869ab604", "comment": "Malware payload", "value": "04a47e4891ad85891444ca7adee8bf23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344232, "uuid": "5a1fced5-027e-4fc3-a010-f73a6fb39132", "comment": "Malware payload", "value": "a86cfebde76ea15501560960fe3802c49fe2e6468ef6ff4da03d7815cfcfbe22", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344232, "uuid": "f75b9110-48a9-4768-b402-f4ea83cdc6bf", "comment": "Malware payload", "value": "1b6f6313c8637808135d420a1ba2e46562e089fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344232, "uuid": "518c2cd7-83a9-4def-ba25-edc4939d1456", "comment": "Malware payload", "value": "e40ef5224de2d785cb9f4acdddbad0be415ead8f6510fbb0c0098f704165e99081df199679289b40ef4d10898fdf9e48", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344232, "uuid": "e082a3ab-ee3c-407f-9b86-d441209eb307", "value": "T1B9368C23B6C18077C5772230554EA379B2B9E9795B35828763506F3DBE306C19A2C3AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344232, "uuid": "28f77911-0b23-404c-855d-b647982b35f3", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344232, "uuid": "d3fb6437-8cb1-4a91-8031-59ffd075e1f9", "value": "98304:6JBGvFx4fGCt0h+JI+XIfNXm3U8ZgjqcViPNlEoWJrsamBwTYDwTzrR9AM08JEEq:LFQzIfNEBCtiPNlXWJIS0MF6M9OxcI6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344232, "uuid": "5226f400-42ed-436d-99f8-3cb958a11d09", "value": 5103104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344232, "uuid": "de7c5127-ef51-47f3-ba4c-69118a4bd4d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344232, "uuid": "1f564b9d-dcfc-444d-ab72-87cee573445f", "value": "a86cfebde76ea15501560960fe3802c49fe2e6468ef6ff4da03d7815cfcfbe22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aecc7b2-f359-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712327667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327667, "uuid": "2ce8026a-a31f-4ff5-8f60-84df11b61a7f", "comment": "Malware payload (AsyncRAT)", "value": "6657934f52a0686aefcfac430c49eb6c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327667, "uuid": "23ce78e7-1fe1-417b-a8b3-63377a8abad0", "comment": "Malware payload (AsyncRAT)", "value": "a89667a64a05760547dd5b7f8a87181fb145a48ed2492392918e653c7e5bb9a6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327667, "uuid": "651431c4-b4b9-4f80-b7a8-50fbccc17af6", "comment": "Malware payload (AsyncRAT)", "value": "e803dc674a183866df2ea7c732bd6ce288e4d273", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712327667, "uuid": "9c1706bd-2e3f-4152-9cce-a9b06b8e14a0", "comment": "Malware payload (AsyncRAT)", "value": "acde6f7601264ecfe6a94c749c8f4b9b48818d136117c58444e05111593664ab8f415f9fe06e208be787210db2ec463c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327667, "uuid": "b34f999f-b525-4213-9fc3-0c0e9da9912f", "value": "T1C2236E4437E8C13AE6FD4BB5A8F2A24582B4E6271D03C7597CC814AA1F03BC596536FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327667, "uuid": "12fdd04c-8583-4c7e-8ca3-6392b44fe604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327667, "uuid": "6c236cbf-c314-4a84-b170-c20331655081", "value": "768:oq+s3pUtDILNCCa+DimriAPYb+geRHuPkqgmvEgK/JfZVc6KN:oq+AGtQOgQbBJtnkJfZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712327667, "uuid": "139f3200-a915-4850-89ea-ea6c380f3c89", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712327667, "uuid": "e874da32-dc30-4c19-a975-a686110aa2bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712327667, "uuid": "d3967e84-010f-43c4-b36f-bd25800693a8", "value": "xtPT79JKvvlE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac889b2-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344014, "uuid": "b3c2611d-ce01-4def-9686-5a5f22124b64", "comment": "Malware payload (Socks5Systemz)", "value": "dcae88600b7a18726d046bff6651c8d9", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344014, "uuid": "b314f696-7569-45b5-95d0-fe889f821c5f", "comment": "Malware payload (Socks5Systemz)", "value": "a93ed273a544eddc38deb22de284d8ca9e5f56c5c65782c1678ddfab0e15804e", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344014, "uuid": "7b8249c9-75d7-490b-bac1-7020f6778dcf", "comment": "Malware payload (Socks5Systemz)", "value": "b001a47cf07b7de3cd97d18bd5d6e6675a9fab79", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344014, "uuid": "16760b22-3271-48c5-85d3-a6930ee662f2", "comment": "Malware payload (Socks5Systemz)", "value": "611bd20d11724c7fa1ed550f72828515389c928c4c2de56ca674b67e5dbe827c6985daceb94af67b3da61d765737977e", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344014, "uuid": "1b6c80a3-b234-4707-a3ed-d110e681de62", "value": "T156E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D9789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344014, "uuid": "5c53e338-705d-4fc6-976f-e273bce03517", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344014, "uuid": "79bfa028-03bf-4580-bb36-6cacd5fa6e77", "value": "12288:HjsgiZdvAeRwZ+aaH/50cCtKBqi6cvpWw3EmXRKLiTOkERp1H/skaiIjcBDQg5Ea:DsgwdvAw1f50cCtKBqinvpf3EmXR+iTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344014, "uuid": "6f09a0bb-a560-4beb-8c6b-c6eb0c0e68c5", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344014, "uuid": "e6371dc2-af09-44f5-8346-d99bf58d7d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344014, "uuid": "059b707f-1ab6-400f-a474-ef557bf41819", "value": "a93ed273a544eddc38deb22de284d8ca9e5f56c5c65782c1678ddfab0e15804e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb76f6c-f33d-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712315562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315562, "uuid": "5feedb5e-1299-4513-9d88-79c2f02569dc", "comment": "Malware payload (Rhadamanthys)", "value": "5e71e6fc7d5fbc4bc1b4309d1330cdd5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315562, "uuid": "515cb3f3-b373-4638-9455-881b792ba421", "comment": "Malware payload (Rhadamanthys)", "value": "aba115e0bea67fdde8e73b402d39c7902841c5156febb1651437a306a4da9740", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315562, "uuid": "3f8a3cc7-d0ce-4aa7-b235-43936b97aaf2", "comment": "Malware payload (Rhadamanthys)", "value": "f0faceceb9762f7c5d9535d2e16046fa95033b3d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315562, "uuid": "3fafaaa0-cd60-4e1b-8992-2bce786f8fee", "comment": "Malware payload (Rhadamanthys)", "value": "955d732018745dce55025deddf286e7e05ff8fff87e349c0a062ef7b40a7f9f02d9507d7f5d29ee1a6ad6cb98e99464b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315562, "uuid": "e56666ae-174c-4663-b1a9-88036eb357ab", "value": "T1BAC2F1CEF683517DD745A6FD0A9C3924A91C73965A281CE8FF48C8D07EE07DA1218E62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315562, "uuid": "9905cddc-e665-4aa6-ac41-640ee51583c7", "value": "768:Oh3H8s1Yu/ZpkF5AkIEwdXNp5FH9VVatc+a:Oh3H8SYmZOPAkWhN/FdfQc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712315562, "uuid": "21bd7bff-94e0-492a-a840-7c83c03284a8", "value": 27742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712315562, "uuid": "64fab0fc-7579-4b9f-bd1d-b206c5927575", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315562, "uuid": "8c1da9fa-b92d-4400-ba0b-217bccd03c0a", "value": "DOC5723-57235723.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313311b8-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344240, "uuid": "6226bff7-c0b0-426d-8bdd-7ca25d475865", "comment": "Malware payload", "value": "b33cc694c90f591caaa57304cd49f259", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344240, "uuid": "0256dbfb-7e79-4256-8cb6-aa316b7d709d", "comment": "Malware payload", "value": "ac4764b8309b52ffc020e2fcaaf2dd612c0080b1be575c29e5e171dc434904fa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344240, "uuid": "c3806afc-b406-4395-9721-b3e867e916bc", "comment": "Malware payload", "value": "61623fc8dafeb0a52dfb0638ec4a92734dd75219", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344240, "uuid": "285b38fd-92ba-4f5b-a2bc-b0fa351aae05", "comment": "Malware payload", "value": "ded240ee7814392040855bf034aa0b2c5b40b55c72e8e8bc8d656fe7386946751798467d2e77c22a5cf038153011578b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344240, "uuid": "7c3b21a7-fed6-4924-8747-5d32d4bad398", "value": "T1C9765B02A98AA0E5D72E123804BA373E8D79BC4E5B358BF76754FD5854322C36C3635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344240, "uuid": "20abaa8a-cad6-4ad7-8e52-98c1ea7e38e2", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344240, "uuid": "f9d8b04d-c4aa-4053-a748-ab1d293793f7", "value": "49152:vKORTYygKK0xzN6lulIyZZmQxJ/8bmgdgZNRqrJCBbVxW/rFSTS1lihscGWEcT/q:vKO6nKZ7J/8b8ambejuGWEcT/BdT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344240, "uuid": "05b4c97e-73ad-46c2-90d2-7fb73bfb0486", "value": 7157744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344240, "uuid": "0eb56281-c51e-48a6-bf7c-7bf4decaf302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344240, "uuid": "4cb35715-71e0-4b91-99f9-3d5f16e8fbda", "value": "ac4764b8309b52ffc020e2fcaaf2dd612c0080b1be575c29e5e171dc434904fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caef3c0a-f321-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712303695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303695, "uuid": "a41772b6-62e0-49a3-a1c9-2986b63345bb", "comment": "Malware payload (RiseProStealer)", "value": "c58613667ad928b9e369db25b740ec9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303695, "uuid": "d5f69090-62fb-4dac-8874-9314f08761f9", "comment": "Malware payload (RiseProStealer)", "value": "ae5c73ae04c51465b7fc1dd3238dc80b959fb68146cc9572c52a6d48bc47cfe9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303695, "uuid": "ae5740e6-e526-4225-b8c9-d8b472b38270", "comment": "Malware payload (RiseProStealer)", "value": "16755f756eea39eb5f012ee3daf41a9474c9d488", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303695, "uuid": "e2b6408a-a8a4-4cab-b9af-56f767f5fbb5", "comment": "Malware payload (RiseProStealer)", "value": "b216fd13432972a94f46d670302b821e031bed16de99cec736720bb02fbd6c554582492a9e7436d4461541150e8b139b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303695, "uuid": "c7d3a4b8-c664-4f9f-bede-ff5041ab8b40", "value": "T150A533D594678C26CD42F874A1609CA2BCB4DFF285CFA1256434B27A8F1B31CDB4693D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303695, "uuid": "0f0a63ae-d511-4efe-a890-2d1b1d3bf0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303695, "uuid": "d9324123-7288-4ee5-a01e-382f2bc348dc", "value": "49152:spWN1Y8Wa0xaCL+VXy2WU9KzuSPtW4mIYhcTEKgnUaMvZjpxOHebYKAvsT:ga1Y8Wa0syhb6UmIYhcTEKgiQHebll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712303695, "uuid": "32f6cb6c-d941-4296-9e70-8d4512631514", "value": 2263688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712303695, "uuid": "2aa9ad98-4dbe-4dfe-8476-9b5fd80d5ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303695, "uuid": "f1750740-eb1b-47ea-8fcd-8cbe8c3e75e7", "value": "c58613667ad928b9e369db25b740ec9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf97b3d-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344016, "uuid": "67b80e28-f2f0-4293-ae49-ee451ca3ffa9", "comment": "Malware payload (Socks5Systemz)", "value": "8bf7e229765638cffa19ff744959ec95", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344016, "uuid": "2e9f39e4-bafc-417c-8f59-97f8313d55a0", "comment": "Malware payload (Socks5Systemz)", "value": "ae919bb449c8bb9af6793315151a820351b824b32ece804695ae80d2101da1f3", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344016, "uuid": "88127003-fd01-4b32-afd1-741fa3aee1b0", "comment": "Malware payload (Socks5Systemz)", "value": "83853b7d6d4a356ecef2aa7e7eece45d95b214e0", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344016, "uuid": "6ba30499-1dda-4826-a6ac-4bb13d9ba42e", "comment": "Malware payload (Socks5Systemz)", "value": "6bbced575c4dde7d94f25a30beb90f394d2f642800984ef77d8fe419dad5aab57b14df44936b3528d1ea3c158c9b4e99", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344016, "uuid": "4f893f36-cfbd-47ff-818c-c9ce4b91d3dd", "value": "T170E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344016, "uuid": "fc07cea3-6df8-45f9-b829-6dc7833bc617", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344016, "uuid": "e6d0ac98-f001-4425-a0e5-2f57e11ee4d1", "value": "12288:HjsgiZdvAeRw/+a1HJ50cCNTBqQDcvpWwBhmFRKLiTOk4RpqHWukTiIjcBDQg5Ea:DsgwdvAWmp50cCNTBqQYvpfBhmFR+iTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344016, "uuid": "030dfb05-998c-4189-b976-7dc173bcf5f1", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344016, "uuid": "b29277d3-d5b7-43b9-b090-9baf0be3f3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344016, "uuid": "ea1e4841-38d9-4b83-8ead-6b7893008ab8", "value": "ae919bb449c8bb9af6793315151a820351b824b32ece804695ae80d2101da1f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144a61e6-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712320998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320998, "uuid": "f8c573cb-c9a0-49aa-b3c0-e085eff397d0", "comment": "Malware payload (Mirai)", "value": "04c8a71a0dd7870adc7ea5b00308586b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320998, "uuid": "10c79298-6535-4fe8-8f58-fa3292a1d095", "comment": "Malware payload (Mirai)", "value": "aeceef4e0ab20d0860e0b6fcf29bb88f9599ba2447073a22057fc4e5d7d3c922", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320998, "uuid": "e4e5b0e4-3f5c-47bc-83b9-646135d72251", "comment": "Malware payload (Mirai)", "value": "b3072f22880f448c1c882c4678097776907f17df", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320998, "uuid": "fe1eb7cd-a087-4bb3-9faf-1a64c76ce5b9", "comment": "Malware payload (Mirai)", "value": "2c0c0a19fa5a0e1674e25e6b93fee5bdc26fa4db39c2218e5182cff70d6cae3dc528bb678d7cddbb4612ff002eebebe0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320998, "uuid": "58e1ec4f-91c8-4bde-b666-7b228ff3b667", "value": "T134A2E1BDFB60C18CF442847E1957167B066FF8A647E8420E9905D0C702C39DEE49EEB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320998, "uuid": "3295a5ed-d5a8-481e-aa77-67ef29852e87", "value": "384:UDYC95A2rM7RjFrvX2V6H2XJ8LaHYsbX1chJTNifHhBJhpExUC03uhHB3QJmRx7P:UDZ5Dw7RjFjcU+O24sDSNifHhrhpEguj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712320998, "uuid": "c515503e-bef3-4505-a84d-69fff4d27d79", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712320998, "uuid": "55015111-50f4-42ef-93ec-ae2ef0dce42f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320998, "uuid": "dce357c0-8c4a-406f-b2db-f13d5f3d7f02", "value": "04c8a71a0dd7870adc7ea5b00308586b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60f5f4c-f329-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712307096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712307096, "uuid": "50fee269-a123-4d71-a17b-b4e3c6731253", "comment": "Malware payload (AgentTesla)", "value": "8fac5e61273c3395030fd331b536db36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712307096, "uuid": "426b6f2b-468b-4a66-b0c5-e45248526d39", "comment": "Malware payload (AgentTesla)", "value": "aee7679d622bef3608f1e4902ec91728c672cbbc1af0b49d9ff8f78467f255d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712307096, "uuid": "6d8dbb00-7351-4645-9a35-48ad8a7c8745", "comment": "Malware payload (AgentTesla)", "value": "7ba5e0f8b6fe94a088c4dd45484f83e2134a54f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712307096, "uuid": "9f94afbb-843e-4ec2-a409-a1bececd8a21", "comment": "Malware payload (AgentTesla)", "value": "f5d51d6a5ca2ae1c063764fa7641f2f675f16ae1064b2129fd3b502dbaeef5b9ec7347812115a99247efa0aa54dcd50c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712307096, "uuid": "22f699b2-483a-4ecf-b04a-ee8157c425bb", "value": "T17225CF21B5C6C076C2B227719E7AF3759A392E761236C28F67C83D761FB04416B29732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712307096, "uuid": "0b905045-5a1a-4486-9a1b-add083394c1a", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712307096, "uuid": "d05ee37d-1cd2-493a-82fa-c558f2516e36", "value": "24576:xRmJkcoQricOIQxiZY1iaSpxt+GY9P1I+1oS:+JZoQrbTFZY1iaSpxtF23Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712307096, "uuid": "ce4fa9b6-6ba6-4f8b-9025-7fbd3ef34622", "value": 997749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712307096, "uuid": "eb3f12ba-40cb-4574-823e-b12930de8caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712307096, "uuid": "04e7ec55-2009-4c7f-b941-79ddb95292c8", "value": "MK_Order_200387_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d0b0fa-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286613, "uuid": "f12a2623-076c-41e5-998b-a9ecd30e9e03", "comment": "Malware payload (Gafgyt)", "value": "a717ebeae37d4a1552559b29f41c5bd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286613, "uuid": "3a86d0ee-f468-4026-a1eb-18964239ff8a", "comment": "Malware payload (Gafgyt)", "value": "af062a6e013b5ac8336a136a91995f9dc7a1ece1d94fce69c19d9ff2db19f291", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286613, "uuid": "b882d8f2-1551-4305-990f-76585e5829f0", "comment": "Malware payload (Gafgyt)", "value": "fb4df088bf14fb79a0d844787cfbec04fa83ff17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286613, "uuid": "b0b8df8c-097e-46f3-a16e-a962d311b87d", "comment": "Malware payload (Gafgyt)", "value": "8faa274a6e9f01e8fe9c3df9e615a51b1139d1ff4a8a6632b090d61359ea35c84bca99ea2c9cf82d5112df1d806c9755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286613, "uuid": "efc58f5b-7d3c-4365-bfab-383e462181f6", "value": "T139F33B24E4404767C2D313BAB69E866E3F321BF653CB33115A349EB41FC2B992D69874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286613, "uuid": "c268e653-89db-4dce-8266-b3c45db2e21b", "value": "3072:cyd1BPL8Z60aMnGjuog68Fi5Ls5hM1D1/6JrTRxmfQOYbr5Wn:Lz060auGjJ5Ls5he/6XxmfQOYbr5Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286613, "uuid": "a265c557-113d-475b-aaae-83f78b7dd47f", "value": 170949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286613, "uuid": "abea4b36-446e-46fd-87fb-85bb342f27e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286613, "uuid": "72f58f2a-f835-4b8d-ab25-21ba583e670f", "value": "a717ebeae37d4a1552559b29f41c5bd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac02113-f34d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712322459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322459, "uuid": "689c4b92-421e-4086-b259-202b654e3d08", "comment": "Malware payload (AgentTesla)", "value": "a402a1b2187e025f4e8f791fb302a1e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322459, "uuid": "450755fa-d8b7-4116-9f0b-38cb7b99c48f", "comment": "Malware payload (AgentTesla)", "value": "b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322459, "uuid": "50e1d72d-264f-48cc-8c65-f8a4e8418822", "comment": "Malware payload (AgentTesla)", "value": "eab8402c4c752684e5bf5f3eb6ce21ac2f8fcc74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322459, "uuid": "e4fe163c-cf16-427d-b564-279ebe181e26", "comment": "Malware payload (AgentTesla)", "value": "4df57eee1de80ba7c5669ba931ff09ce0e170a1025223a9f67fcaa5e91c41caedf0d2d402dc32e172102de2cad6b608c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322459, "uuid": "b853a5ed-a2b5-48d0-bce9-22c9c3924d62", "value": "T18535AD027392D03AFFAB92B35B59B2015AB97D244133852F13D82D79BE701B1673E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322459, "uuid": "cb8bd308-a733-4c2a-b855-957df2b6808a", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322459, "uuid": "71e171cb-1038-43a7-b217-215644ef8bdd", "value": "24576:6AHnh+eWsN3skA4RV1Hom2KXcmtcM4wkExDla+:Nh+ZkldoPKsacLwlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712322459, "uuid": "b016135f-5af4-4212-9d0c-0a6680bdabfc", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712322459, "uuid": "0a4d16b3-c3ba-4503-8b9a-ad8736652ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322459, "uuid": "8da4118e-8f85-44ac-b88a-6d82b4f176c5", "value": "b0195ba69b400a134c86bc120c2dcc9aee2390d6ad7928603462480d4eb1d76e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d5b5d7-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335085, "uuid": "69bb40e0-6957-4577-a781-c16a04e4fdb4", "comment": "Malware payload (Gafgyt)", "value": "0f97d635b4a079a94a11e8ac46e5a003", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335085, "uuid": "a2647055-ccfd-49b3-a256-3f339af65825", "comment": "Malware payload (Gafgyt)", "value": "b0f6762458a7bcd2baa8be86151e2292852e9535ec617c45849438272372a8de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335085, "uuid": "8aef4d88-2ce6-48d0-9573-325be1c78238", "comment": "Malware payload (Gafgyt)", "value": "508afef8a14f5da6f7bd15d9592884732c848486", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335085, "uuid": "44838654-49d5-4908-9e3e-aaafca784615", "comment": "Malware payload (Gafgyt)", "value": "c29e62fcbe5b19471c921d0602ac7367d88bd897be55d67a713ec45d31707b32b5730e190900db713aef864877163902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335085, "uuid": "a5ae1869-483d-4f26-8606-a12c9ddca630", "value": "T176A32B41F9408B27C2D327BBE78F435D7B366A5897DB33116A346EB42BC67982E39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335085, "uuid": "17d0319c-a9d4-4295-9c60-46f1a2d10d3a", "value": "3072:86NxQIR6/zwOeqpHIciTOM99Duz+SBu9Eyvox:CQ6/zHeaviTtDuz+SBu9Eyvox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335085, "uuid": "5c03cf3a-657e-4e90-a30d-2c46737986bf", "value": 103904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335085, "uuid": "1931dd37-dfb6-4758-ab62-7bc3d1bc7bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335085, "uuid": "6fff8264-aadf-4daa-acdb-71ca516bd39f", "value": "0f97d635b4a079a94a11e8ac46e5a003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c8185c-f343-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712318254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318254, "uuid": "add11a72-d2db-4d0f-8cbe-e3d29af84bed", "comment": "Malware payload (GuLoader)", "value": "8ff6d5c20b09737261248a3335ce8898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318254, "uuid": "4a605010-c488-4996-8200-9d1d06376a0a", "comment": "Malware payload (GuLoader)", "value": "b11eac916daabd2924e16d9f4bac0b8760f608c8f23c9e98d2b0240526a00c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318254, "uuid": "91de312b-27c5-44cd-a513-9bdfc002c3d9", "comment": "Malware payload (GuLoader)", "value": "764fcf893e02ec25e46feac2cb88ae88b32be3a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318254, "uuid": "639f27d4-c752-44d5-b270-283f0a0c0be2", "comment": "Malware payload (GuLoader)", "value": "413f942f7ec934e75fb423dd6f126b0076c2f663be4219f960b6860495eb99ab3eff4646598b519744136504e4ffa681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318254, "uuid": "8117ffa6-3542-4bc8-9b1b-25ba31329bb6", "value": "T1BEF49922E2ACBA5BC4AD19FA9F025178D97F2F005157D8377122B7969F3316DCB8221C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318254, "uuid": "224e7e46-aa80-4fdb-8cbc-94ad03cafa23", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318254, "uuid": "9551402b-d996-424a-babd-ec9e2145a65e", "value": "12288:Mo9HOyVpvKsdkVDik53lldigcOmTywmHBjLrAI:MGuyVpv7dkVDJ5VlcgcAwOrAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318254, "uuid": "f0db4fbd-3210-47e2-846d-9b2d0adde639", "value": 749880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318254, "uuid": "35ec6558-4fbc-4984-a4f8-b58d9166806f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318254, "uuid": "70561e6d-77fe-4dbd-b4e0-0b52976fedfa", "value": "b11eac916daabd2924e16d9f4bac0b8760f608c8f23c9e98d2b0240526a00c59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b4c2bb-f2fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1712287158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287158, "uuid": "91321756-25f5-43c2-8e1c-31874f37ee5c", "comment": "Malware payload (Adware.InstallCore)", "value": "9abf6b1356f0ae994b17e9c6708811d2", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287158, "uuid": "f7100e6e-cfec-484c-8d41-f8c7b895076e", "comment": "Malware payload (Adware.InstallCore)", "value": "b14e9fc89dfa19abe5a726d0afa33af6de29e2696187f38a32d00119e78d1e6f", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287158, "uuid": "2818cf2e-e49c-4dc8-bfb9-93ee8ccd5ff3", "comment": "Malware payload (Adware.InstallCore)", "value": "b94e36652923c938b2d240dfd869ae72b330c081", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712287158, "uuid": "8598d32f-b345-4176-95a3-6c155e1eb0ed", "comment": "Malware payload (Adware.InstallCore)", "value": "205e35203bfb4e156d6c225012cdadd2aa09e99fdae42332db3b36374675fd7a5763b4e85cf2cf32b55d77b0e35838de", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287158, "uuid": "3f899fb8-ff19-4187-8afb-d1516cb69446", "value": "T1EBD533898CACA4B6C94174F0DC6752C289B7BD068536AC5976BBBE1C0B35613EC4F39C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287158, "uuid": "6b906835-3f24-4a92-843c-e52dc2d2fd06", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287158, "uuid": "783dae08-fd26-44d7-953b-b0403e7ea1b5", "value": "49152:3y6tXYlNU6I5oc7i0BwEqfTgcFfNv8ZU2aOP8Y/1uxcN5Ppw2qVnqKc7wh2oS:CkXYlYoP17gcFfOZaeFPpw/xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712287158, "uuid": "8691f86a-3ae5-45dc-9442-daec6c8a0c42", "value": 2905367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712287158, "uuid": "e621dc4a-418f-4043-994b-b9ab65ae238d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712287158, "uuid": "88c28266-0422-4525-ad9a-b24093e0ab47", "value": "SecuriteInfo.com.FileRepPup.18893.11285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af65cee-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712309413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309413, "uuid": "71572278-0ee1-465c-88f7-3d54d106e20d", "comment": "Malware payload (AgentTesla)", "value": "129185a60b5d4e7a398cbc0376306b84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309413, "uuid": "e252f75f-cb1f-40ee-963b-5a9fa31372c3", "comment": "Malware payload (AgentTesla)", "value": "b1a574a7a0aad03e9f0a8470fd53013c565e67461ff21fc79e1bb6205974adb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309413, "uuid": "f9316d47-2ce5-4679-b566-ccddd4088273", "comment": "Malware payload (AgentTesla)", "value": "d60d88043a128786e02d96a2727d17e72a3f5cce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309413, "uuid": "15f0beef-82bf-4e1f-907d-89a77733a6ee", "comment": "Malware payload (AgentTesla)", "value": "2bed140f8f8472efd13ba8fe00813675069150b88537ecb4ed1dd54cf3c73ab32069ac441c859366496e9cbebab27b83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309413, "uuid": "a8f3e37a-de92-46fc-a4cd-bf27c3cc0f7f", "value": "T129F4BEAC36647AEFC45BCD76C9681C64EA6164B7830BD203A02315EDDA0DA9BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309413, "uuid": "a124ca2b-6559-46d7-a88d-63f790b8b388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309413, "uuid": "7d595c1c-4ecd-4e1f-aadd-bdaaa380a707", "value": "12288:0AUolYAVbUHOZbblIP3cFW4bA5OFltxh0lsylo7O5U8rDL0I:0QL+H4q/uXtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309413, "uuid": "1dd32c44-8261-48c9-9706-53069e307693", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309413, "uuid": "f7ace044-6788-4f99-b9a1-840967236a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309413, "uuid": "b75acecd-1c37-4114-bcdc-fb389f30497c", "value": "SecuriteInfo.com.Win32.CrypterX-gen.20577.9045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a85300-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "96a8b8ec-859b-40d4-807f-500be1d4f5aa", "comment": "Malware payload (RiseProStealer)", "value": "dbf7b733692d7a9d50c40fc00a379d73", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "71c2c144-897e-42b3-8a2c-320a70558d39", "comment": "Malware payload (RiseProStealer)", "value": "b1f081d813cd08c026ba6263093a43c771698cb969138498f35524baa151237e", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "e28423c1-0a55-45c6-8d7d-cb99b963d784", "comment": "Malware payload (RiseProStealer)", "value": "4878cc2eb0d99c1c5e0b2f23a7594deccc3db01a", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "31539707-47a5-4da2-8e6f-2e1cc33d25fb", "comment": "Malware payload (RiseProStealer)", "value": "748103b4f1b6a91d43cb0f0b2cb1e082fc94db5e9a5145fa5225571ed2c586ef7c6c30be38335b483b446c272d3aa7ac", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "449b2aa5-f635-427d-857e-70e889ac0865", "value": "T106E49BDD765071DFC8A7C972CEA82C64EA6074BB931F9207901315EDAA0D99BDF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "6b0823c0-b7fd-408b-ac28-919ad70327b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "d3310de0-a0cf-4591-94f8-fb1bd0e3b6d2", "value": "12288:fY7wpbASrI8lI+2muZHASqEct0gw1dSPujcqjien+JWobicFDSP0Q9iXgakdrRjv:fYVaIz+8HFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "3a6dc8b3-1402-4aba-80b4-f90c34fcd917", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "3a595abc-7402-44e0-bbd1-e6f9b2b45024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "6e440610-39a9-4c7b-a952-23ef35b8b3b3", "value": "171232524570452cfc1123de8b7cabf91834cbebe0e4fd1dae96e0b4418fab427bf67de7f5439.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabdbf69-f34c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712322217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322217, "uuid": "546c5091-4ff5-41b5-8e4f-90120e25d2ac", "comment": "Malware payload (AgentTesla)", "value": "7a7f86d32ba1985e7f4917d0ccd03a12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322217, "uuid": "a5f30d78-83ae-47f4-8c8a-df5f4d284457", "comment": "Malware payload (AgentTesla)", "value": "b25276c6c6edc596aa8568e14b6f0925ac571f141afc15b9ce29d4f1f47765b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322217, "uuid": "8e14f22d-4918-4d53-ad1b-6d1e6a880fb8", "comment": "Malware payload (AgentTesla)", "value": "b7cf7230b2e4e4090b940e2419d78f83402fb2fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322217, "uuid": "e7274b69-d31f-442d-ba58-4771eed0e716", "comment": "Malware payload (AgentTesla)", "value": "dda06778de12cf30691c85bfa37bab34ac3525b942df9cf930af80ed017ca73f4eb7c1060bbf12e064fa3799b54cfed6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322217, "uuid": "3db651fb-0cbb-4ff8-ae8d-bc0db66459fb", "value": "T19E45BE1273D2C03AFFAB92B35B6AB2055A797D244133852F13D82D79BE701B1623D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322217, "uuid": "9613b536-59c7-4de1-9427-e68894829825", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322217, "uuid": "e041eb62-144e-4ad3-9955-ed86d78b34e8", "value": "24576:4AHnh+eWsN3skA4RV1Hom2KXcmtcy4T3VWf7BB1A9Z7G:/h+ZkldoPKsaclbcf7hAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712322217, "uuid": "f0aaf792-75d2-435f-b7b0-d0bb3fc3e9f6", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712322217, "uuid": "abbfe459-51d5-43ae-b1c9-fbb337fcb491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322217, "uuid": "6ff6e48a-979c-43ec-bef0-cc81a7f3375b", "value": "b25276c6c6edc596aa8568e14b6f0925ac571f141afc15b9ce29d4f1f47765b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a787947-f343-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1712318083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318083, "uuid": "87dd2fcb-cbd7-4fac-a9de-880165ec11b4", "comment": "Malware payload (DBatLoader)", "value": "58b7bdd6f87b8d6a643ed50a34b92e2e", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318083, "uuid": "352b7127-6964-4a26-af0b-7574873b8772", "comment": "Malware payload (DBatLoader)", "value": "b257d62fa275fdc02a8dd83bdbd31868a742d3fe53909b545948ef45a54e49cf", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318083, "uuid": "3c18b368-bb70-4468-8dcb-d0593d27dfe1", "comment": "Malware payload (DBatLoader)", "value": "c1638e4db5c653f485c9eab174530d0033fcef8e", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318083, "uuid": "8f238c8f-3f21-40df-8bfe-9cbcc509e796", "comment": "Malware payload (DBatLoader)", "value": "9f051861d7fa0c9e1eec0cb4428001959969e4e292e59437e9961e89d0e906fa54ba64b02d3abfbe74c9696006756a87", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318083, "uuid": "5fc12921-789e-468b-a67a-bca52fb046fd", "value": "T17936E8E339FD278617063F5B974FB5940A1FFD394BF26AE440C72588014A58B29A09EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318083, "uuid": "b66bbeee-0cca-4a7f-ac36-507eec86c29b", "value": "49152:TezOW2/puR1S5LyWb55JBnZkRidEiXTqdiMTOciC1UMIrHu6zYDMJhlJ48pDud:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318083, "uuid": "eb5b20dd-3d8c-407d-9d49-b89018698dd4", "value": 4945681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318083, "uuid": "af58a579-ed82-411e-ad36-c908ac58c7ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318083, "uuid": "2c53f751-b03c-472c-aeca-27f08b164e57", "value": "TransportLabel_6447589460_pdf.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1983ff-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344018, "uuid": "bf2fca8e-fd5e-41e5-9ce6-4f98189a9d5d", "comment": "Malware payload (Socks5Systemz)", "value": "0f5cfe73962a91ddfd6fc51583e94d4b", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344018, "uuid": "a214450f-a661-4db0-aad9-1d1d7325afd7", "comment": "Malware payload (Socks5Systemz)", "value": "b5c5a9720368e0c38d99bc9f39fb3a9096377f1bd4f3bcc690e15f8d858acafa", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344018, "uuid": "94ed89d8-5726-49ce-b657-62b822a5d4de", "comment": "Malware payload (Socks5Systemz)", "value": "c9c58f1949f94ebd2eeada6e7040fb733765d048", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344018, "uuid": "898d2731-1f9f-4c15-b619-bf36512fd3cf", "comment": "Malware payload (Socks5Systemz)", "value": "73fbec472eb12851af2ae0cbded89a7d5afdea86febe2608d0c1961867dc32ecdd95b027ab3a1ac29dfc6050649da836", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344018, "uuid": "b54160ca-77a1-4fce-907d-b9b0341867e5", "value": "T151E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D9789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344018, "uuid": "79459703-ac0d-4b81-9e52-9c3326bbb127", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344018, "uuid": "ee18ed47-766f-4bab-84a9-2708612dae7b", "value": "12288:HjsgiZdvAeRw/+a5Hf50cCdCBqCycvpWwX8m3RKLiTOkERptHn8kSiIjcBDQg5EK:DsgwdvAWa/50cCdCBqC/vpfX8m3R+iTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344018, "uuid": "a91bde3f-b41d-4c32-bee3-fe9633932392", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344018, "uuid": "010ec2c1-3a89-442c-881c-0cd13a766b77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344018, "uuid": "ce656ab6-fda3-4bed-8adb-62cf15bd9c2b", "value": "b5c5a9720368e0c38d99bc9f39fb3a9096377f1bd4f3bcc690e15f8d858acafa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8615710e-f336-11ee-a120-42010a9c002e", "comment": "Malware payload (DanaBot)", "timestamp": 1712312599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712312599, "uuid": "ada8ec74-fa4b-4aea-b7ea-def748106756", "comment": "Malware payload (DanaBot)", "value": "219ef06e5b58fcf3134f362ca6073c06", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712312599, "uuid": "457f6415-30c8-4212-b72b-4aecffda636d", "comment": "Malware payload (DanaBot)", "value": "b86d5ba2ec3c95ad28c63d2c1256a6ce067bbea9b3f2903babe468f53d3838ef", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712312599, "uuid": "f5b8e514-a24a-4108-9c01-7c37c897e3e6", "comment": "Malware payload (DanaBot)", "value": "9d784d81fec551d248506901f7283ed7d91f8017", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712312599, "uuid": "97d619d0-f46f-42b8-b496-f1a97f43dbce", "comment": "Malware payload (DanaBot)", "value": "53c3a95ffed08ffabf99a641293e5b4ac7a49780eb47a95958f72ab88d4e53dd3e11b46e608a90007bf204c76b4129f0", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712312599, "uuid": "d6db6eb3-316c-4aa0-b70b-f0e96759a6ba", "value": "T19506F126F284D53EE49E1A394037A994D93FB76278168C8B56F048CCCF3D4817A7A25F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712312599, "uuid": "07b645ce-25dd-472b-8ce2-4fad850cc534", "value": "3515998abe0aea14ac46a446bebe93d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712312599, "uuid": "cc957ecd-cc4e-4b1e-b7d6-d4d55d8efd62", "value": "49152:qdtvLwUU5h6/60ChOUreaSwotBP1aH4vaTZtSkLvUWgIc/ivZAFZnyFNz30dm9TN:iuo61frTStildtSkjDctBARkdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712312599, "uuid": "eb04bb7e-a5c0-4516-8ba7-1006faff4790", "value": 3706880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712312599, "uuid": "b5c88d6f-09c5-46b6-81aa-b60f315639a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712312599, "uuid": "439e6806-1533-4407-9238-479050c407e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2fb40b-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344020, "uuid": "803c7857-7259-482c-a89f-ff5a9abd79e0", "comment": "Malware payload (Socks5Systemz)", "value": "de049a3635dda347ab835c2bac47e7dd", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344020, "uuid": "f5043d43-714a-47e1-8c62-58a14064de67", "comment": "Malware payload (Socks5Systemz)", "value": "bcbe49e9159ef66970f9781fc3c00edd4ab23f393082ed11dc75112787e02a03", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344020, "uuid": "91719934-63dc-4716-84fa-8c9ebf903561", "comment": "Malware payload (Socks5Systemz)", "value": "16c0b9fce80a5fac5d1e3ea067763b982b791c57", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344020, "uuid": "cb8666e7-a0ae-4485-a108-9a830e4f8ae4", "comment": "Malware payload (Socks5Systemz)", "value": "c3412b99a6ee224fb41e9bd960db23a2990e791cf0ed425753c5eacfd55c31f27ee3289a5c4163daaab09dc2b931e4c9", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344020, "uuid": "147c846c-44c0-4c2e-b11b-05faf88bb911", "value": "T1A9E49EB13A0BC1FEC35A4474E853A603C57867F18B64E646EE6C7C7CCAA34A471D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344020, "uuid": "0eb00e11-7286-4962-96d4-1ab5ef50317e", "value": "aa1202e3cd3c2f9a17d50b85dec46207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344020, "uuid": "737cfb40-f217-4f45-8997-96ebf51c5cd6", "value": "12288:sjsgiZdvAeRw6+asHr50cCpKBq2ucvpWwnwmHRKLiTOkkRppH/4k6iIjcBDQg5Ei:6sgwdvAvPL50cCpKBq2LvpfnwmHR+iT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344020, "uuid": "f5636c05-78ba-4061-b724-b5365c734918", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344020, "uuid": "0f4db793-d5a7-448f-ab43-c4ed14cc71b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344020, "uuid": "dfadda76-7353-4fbb-8146-4380295bf1bf", "value": "bcbe49e9159ef66970f9781fc3c00edd4ab23f393082ed11dc75112787e02a03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27c5d92-f369-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712334578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334578, "uuid": "2ccc7fd7-8785-434a-999f-33919eae1e47", "comment": "Malware payload (AgentTesla)", "value": "e3d5399a365adbe04a405e405c54f4aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334578, "uuid": "0b86b207-2074-4dad-bdce-081f8c7adcb5", "comment": "Malware payload (AgentTesla)", "value": "bd7f924e17174165e42ee077f973be26f07c6653ff33951ff9c53fb7cc833bae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334578, "uuid": "eedd753f-d8ce-44c0-86a2-339b55b61a21", "comment": "Malware payload (AgentTesla)", "value": "73885090bd1f680f2b9fc1b2641838f7d171e595", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334578, "uuid": "bd119855-ad41-4ad9-b4ca-3ebf7b4ab9ff", "comment": "Malware payload (AgentTesla)", "value": "a4448541b2e9b4f88d47f820ae3f37770b8670e8975b90a7b2dc07c50f0ae20016e8e3dd1472c61073c05ecf38862770", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334578, "uuid": "2195609b-3dbc-4d00-8b27-8c9637b37ac5", "value": "T1F6F423CF6270BF12E27593FB50994F4353BAD61279A8E11A68C3C2D84963FD016A4DB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334578, "uuid": "8acc8ad4-75bb-438d-be0b-9f9db4c40c93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334578, "uuid": "1fb83ba3-2eb8-4744-8177-7c57aae629da", "value": "12288:/pndsbu0jTgll7ORn7rDpTLyAJfrCQIdZaLtxKVQWFH0h0Q8kR:KdTgXWd3yCCZnapxKlV0h0QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712334578, "uuid": "fff6b681-0dca-44d7-82f5-fb4e169b00bd", "value": 733704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712334578, "uuid": "5bbf9e7d-e3a5-4369-b389-30b50f383fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334578, "uuid": "3418c16e-1e9b-4bb8-b703-d34228bc652f", "value": "SecuriteInfo.com.Trojan.PackedNET.2779.17787.32363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83d5fc0-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712325246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "12c13461-b57a-4f43-9101-bf93da2eeeaf", "comment": "Malware payload (RemcosRAT)", "value": "31b0f56a8bb3f5fcc3b8bfecb2684ce0", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "e098303e-7063-446e-b4d4-7c0eb92289ee", "comment": "Malware payload (RemcosRAT)", "value": "bf19328d703ff4ad6b67c9cd584147ed69ce2e82932350334f1705aad63316b4", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "a9b6d465-7065-4983-82c7-581959a5fc0e", "comment": "Malware payload (RemcosRAT)", "value": "ff505f7a5015510639153857f4377b42c02700c7", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325246, "uuid": "9872667e-4175-4751-961c-c66dfcd3a17e", "comment": "Malware payload (RemcosRAT)", "value": "19186c28c3fef903c82d55f8ac1df600a4e0b6f6380634bc34e957400e301638b53d7417294362f8ca34fb4791304185", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "6d328d90-bbcb-4933-9e77-9341e71cb6d9", "value": "T1EAB49E01BAD1C072D57524300D36F776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "2bea8731-5b9c-4c4c-97f0-29d6aaacc77c", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "750714b2-4aae-41f7-89c7-2306d809261f", "value": "6144:gXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNy5Gv:gX7tPMK8ctGe4Dzl4h2QnuPs/Zs/cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325246, "uuid": "289abf76-3d05-430c-ad86-569114a03b67", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325246, "uuid": "d38a8e6b-df41-48e1-b9d2-fc20aaeb72ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325246, "uuid": "ec33c96f-ee05-4792-9bc9-0f7c422cb489", "value": "1712325245744004f5902f018d98f993f0a4fa06e5ebff0611e82b883bf6f5430dc03cd13b963.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f552f4-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286648, "uuid": "25035cff-30b5-41b6-9042-ea023681b165", "comment": "Malware payload (Gafgyt)", "value": "595b1811e7680a39c293a167b257245b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286648, "uuid": "c9fcd493-1e29-43dc-ab0c-f609f8c72886", "comment": "Malware payload (Gafgyt)", "value": "c27fd045f109fcc0baf5c1ea4060f55231d9fa95baf053ffc93f04684c2130af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286648, "uuid": "05637215-9b43-451d-aa9b-0116756fae55", "comment": "Malware payload (Gafgyt)", "value": "34827db1f6fa59a2c6c683734c0b37924cd9dfbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286648, "uuid": "6f6ca3c8-870f-49b8-b9ae-cfd878530280", "comment": "Malware payload (Gafgyt)", "value": "837c3a841a9a378e839b4bb49009cf6e56850fc8617d10c8b5263ac887ec833e99e41eacd57ac2aa2bad4d3dbe592127", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286648, "uuid": "46e9026f-f741-4efa-86f6-66b9615fd84c", "value": "T1C0F3B63BBB160F23C0C500B111E76632ADB5C7DA34F952D76AE06DAC6F2A5883465EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286648, "uuid": "ab77060e-a1ec-444f-9429-9c701c45c994", "value": "3072:Mqnuwd00SXON8C6phapM7I5n3lNsmzjEq/dNYy2Se:MqD+zphae7Ix3XsmzjEq/dNYy2Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286648, "uuid": "dad415cc-33fe-4f27-a527-43840e9051ed", "value": 157989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286648, "uuid": "1859af6a-41a0-4e02-ab98-212cbf2cbfb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286648, "uuid": "5eaee88f-f6f0-4834-8bb1-a9a415633b51", "value": "595b1811e7680a39c293a167b257245b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6421f8e-f321-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1712303688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303688, "uuid": "2ecc25b3-933b-43ca-b8b1-3d0c43b43592", "comment": "Malware payload (Adware.Neoreklami)", "value": "245e1ca01de158a5849b064486bdbf15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303688, "uuid": "09cc3324-4dd7-44e5-a882-be5293ce25c0", "comment": "Malware payload (Adware.Neoreklami)", "value": "c35d7a78351494327c6be40b8045b743edb04e04f4db64cf9203ca5b15bdd1f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303688, "uuid": "656831be-0dae-40be-a429-b952f840cb9a", "comment": "Malware payload (Adware.Neoreklami)", "value": "ab50b42575f2709ab9ed14ccba23ef97134080af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712303688, "uuid": "ac907a82-1e12-45a7-adc5-e3ce1205cc32", "comment": "Malware payload (Adware.Neoreklami)", "value": "8d1b793622980ad886701d92ae89bda098b62663da426a30b4302cbbedbe0814e887bfdb5c6a7a96a4df9787cfa3e8ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303688, "uuid": "254a3ad5-58e6-4128-a3db-704a2b361e8a", "value": "T1BF6633143DA219B6FB16A1B24DF03FD8F1E8A2164C642D373794E81F5FBCE80A155E98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303688, "uuid": "5141b6b0-6d72-4b94-8dc6-6f590692bd3a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303688, "uuid": "106b9cc9-3788-4b99-88eb-787f1320c45b", "value": "196608:91ORxhOLc/C7Y9hzxWu7uDVCdnnoOf1+zP:3Ozsgd2jpiw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712303688, "uuid": "91341999-2b0d-44b8-bb51-95486feb4d28", "value": 6859386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712303688, "uuid": "c2038e65-d82e-4679-a03a-9c5ba9dbdaa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712303688, "uuid": "2b2dd5e8-4de6-4f49-ab1f-43ac7d0494b8", "value": "245e1ca01de158a5849b064486bdbf15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d157029-f355-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712325764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325764, "uuid": "6ff24aad-57bd-4d89-ab92-cc7ff944dc1d", "comment": "Malware payload (DCRat)", "value": "6ee8535bb232fe000b49153b670a1803", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325764, "uuid": "4da09ca3-549c-4f8c-92cc-6cfbd690f576", "comment": "Malware payload (DCRat)", "value": "c41c07c2d1e2fd62641eba007673cfcd56bdc30a4e608e43656805db673b151f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325764, "uuid": "5bdc0e1f-2bdb-4bb2-b1a3-46eaaa9eb382", "comment": "Malware payload (DCRat)", "value": "f614e5e362ea0f85f8938e337591c210831db32f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325764, "uuid": "491c982d-d5e5-46a4-82ba-a2fb0f34fb71", "comment": "Malware payload (DCRat)", "value": "9d0457a6868044647fd614daddb8f3c726a25f8e0537b51372c2e88ab987fc60afef6aa15e7f67f09ec2d91b4cf1e02d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325764, "uuid": "5180374f-a516-463e-850c-e45f97050fb8", "value": "T17EC52303B7C8C9F1D8B2353219646F65E93C3C601BA54DDBE3A84E79BE535C05332AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325764, "uuid": "65d2b537-3151-4027-bbea-4f97dd1cab5f", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325764, "uuid": "a7e5c31f-d641-45d6-b8eb-79fc8ee1ddf6", "value": "49152:YImcWL9IPguCKmUIZ79ecM8Cmh2HL7dGfCybeiFkq4nF3SbYN2Y:YH9fF79bMbQExGf5eiFL4nF3Sbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325764, "uuid": "41004e44-e5fd-45f7-8669-dc0937370eef", "value": 2661024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325764, "uuid": "6b2e578a-3a0b-453c-852e-c9c32caa8417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325764, "uuid": "8542cde2-5623-405b-878e-8fde4155b079", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2899c044-f340-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712316737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316737, "uuid": "951f3527-6713-4a75-b6d7-596d3cae3ad2", "comment": "Malware payload", "value": "ae075dc74119a2f89609adbb4036c89c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316737, "uuid": "fb0dd994-3cfe-47d3-9940-42a2b5cfdc1d", "comment": "Malware payload", "value": "c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316737, "uuid": "88260d51-63dc-447e-b893-c7d2d2b1209a", "comment": "Malware payload", "value": "997a679651e30124d5544d37bd07f180728519a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712316737, "uuid": "89be2bd5-a8e3-42e1-9d07-b05193914220", "comment": "Malware payload", "value": "d0e591cce32f2ec24d63a68d42119a5f03b9db5c8169b1cec5bfc8fb092333d0cd5b8ecf11d59fa561be9ab57634b267", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316737, "uuid": "769dff25-f2ab-4a63-9b00-7fe3ff5682df", "value": "T1C6B733805AC3097AD3EA7A3558F6868D9D32323D49F21CDD7DBCE41E9AB84164DB021F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316737, "uuid": "4aca5bc5-f0fd-4f5f-a7c9-52e7748a808e", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316737, "uuid": "44667525-731f-4d22-a24d-1a7f8cc3640b", "value": "786432:qcn3/ROS+8p2CDev+J8wZEoVFVWCyeaWAEUabFmASJAlEML6qSNBC4ALQ9XMo:qc3pOS++2rmHhVFVjaDabRRLm6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712316737, "uuid": "3f2391cb-53e4-471b-b546-04020f2d3f8d", "value": 48556136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712316737, "uuid": "462cf6ca-dd30-4d72-9e2a-2515e80b58e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712316737, "uuid": "195fc184-72fb-45d5-b352-8cf1268e1bcc", "value": "SecuriteInfo.com.Trojan.Generic.35573143.31218.30227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37d3d24-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309642, "uuid": "de0352cd-667d-4605-aab8-5a364011129d", "comment": "Malware payload (Gafgyt)", "value": "d55dddf3ccc20ed1337ff698aed6b9b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309642, "uuid": "19da81aa-cdb9-41a5-8d62-222b50f58238", "comment": "Malware payload (Gafgyt)", "value": "c4dd05ac5ae071bcf52ca54b5db5716ab6677bffbb12cc6971e569659a85033f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309642, "uuid": "3673fe14-aeea-40ae-b7ca-60932adc9cd9", "comment": "Malware payload (Gafgyt)", "value": "30baa14b4cb0423ecb2da64ef8b5ef5b8246acdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309642, "uuid": "b59a1ddd-b982-4762-8d35-7bc54fe11a56", "comment": "Malware payload (Gafgyt)", "value": "7414359ca139617f58f20edcacbe8e34b05ac55789db49209fcd8f8d88b8a70e62781f9873f2fb526ff02778ac88296e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309642, "uuid": "ee29fcad-dad3-447f-bac1-7e76aaeb0872", "value": "T142D36BB2C8256F58E6A4D5B0B0308FB81B539910818B5FFE19B7C6798043DDDFA097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309642, "uuid": "375a7ca1-fdf0-4105-81cc-279b2cc3e97a", "value": "1536:Ud+UQvOo31GvFzakG0HC2YKIv7D5Gx6jQboQpjeWUP7A6sbWJ9lvHC:Udqx1Gv8k3dIgx6jQMcaWw7ALm9Bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309642, "uuid": "1aa91c88-4e72-4876-ba11-ed67182e9658", "value": 142116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309642, "uuid": "95782545-c165-4e1d-990b-be2c0ea5efc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309642, "uuid": "8db57123-3e01-4194-a83d-ddfc3a27ea28", "value": "d55dddf3ccc20ed1337ff698aed6b9b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3237c86e-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344241, "uuid": "57655228-141c-417f-b423-06284708880d", "comment": "Malware payload", "value": "bc12ceef18ea0de7057f398500bb82a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344241, "uuid": "d332f9c0-ca63-4bf0-9fb4-52bfab637483", "comment": "Malware payload", "value": "c51c1e6231a18f30b51ed4de92f3cc6108a1519208b24bf70fbf7b576dbf1865", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344241, "uuid": "0a388b4e-41a3-4962-8cb9-4cafe0a10fe4", "comment": "Malware payload", "value": "acd57b0139cd8bf864abf027bfe309dbae37ed0b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344241, "uuid": "635f6268-188e-4cae-abfe-64b77e4d8d6b", "comment": "Malware payload", "value": "748adea19cc1bb54298e2b7cd5a9acc2a59ab6a4fca7c21e45388d32f49db8c2b5eed2a4e194671f83cf6d4ac0119efd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344241, "uuid": "3b74864e-bfdf-4e5c-b3d1-1396077fff14", "value": "T121C419069CE2142DFB58BBB044FB3BB261FC50C41A272EF66D85DC3E135D6A23627259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344241, "uuid": "28b8b8cc-35d2-4953-9f9e-fc8a1860446f", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344241, "uuid": "3f995dad-223e-4a78-bda3-58f86e132b73", "value": "12288:UbGRVPnlVoXWTSpbqNoo1kmRfBSjoovvJ3f2Gu1dSpG9RymSamGSkHKDBp6gLfmW:UbGRVPnlVoX6S7QkmSaqE0Zh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344241, "uuid": "10e50734-d5f1-4ab3-af21-da2670ac2941", "value": 587656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344241, "uuid": "82d366ee-7588-409a-801a-8b75fe9eaffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344241, "uuid": "98a811c5-ba31-4f1a-848c-cc639550467d", "value": "c51c1e6231a18f30b51ed4de92f3cc6108a1519208b24bf70fbf7b576dbf1865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d68c29d-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712320987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320987, "uuid": "583bc3db-98e3-4f6d-a7c2-b610ef752809", "comment": "Malware payload (Mirai)", "value": "9412bcd54be15b30fd6a1ba7428252ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320987, "uuid": "24dc66b6-fb40-4eb6-b6ab-edc2587859dd", "comment": "Malware payload (Mirai)", "value": "c54b21706b7673ab5490348d5006b1dc243c0a42d061164893b671deb9c87698", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320987, "uuid": "4d411b92-3f1a-4c22-a135-881c5b68e8b2", "comment": "Malware payload (Mirai)", "value": "9329529af7e53df652f499d4ac95708816c9a4fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320987, "uuid": "11bf2734-e72c-41b1-8db6-4d4040a7d396", "comment": "Malware payload (Mirai)", "value": "de8fb443f56071b344e600bc58a03681d65bf5cdd05fbbe26d7096d6984659e49be374b1b6431bca3511d90206635986", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320987, "uuid": "89917c65-08d0-44fb-859b-21b1f525c96f", "value": "T114A2D1AFA4DA4997DDA9E03B011D04DA04BB2C5553B783C23E6575B38DA78E8F837780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320987, "uuid": "b3c4c1de-243e-4192-b13f-a611f8e6e657", "value": "384:MzcDqRfKUWFH39z+/49EThvIruI8qB+eANnlBQpMr/MMW+v1RpC:OMkKJFH39CBhgy7qsZoMT9pC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712320987, "uuid": "04f0e329-7240-4136-8c9f-fafc78d13b09", "value": 22440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712320987, "uuid": "c62948d5-b070-4f68-ac0f-c041caa3b9ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320987, "uuid": "bfd4b7db-b5c0-42e3-ba59-4f32944df07c", "value": "9412bcd54be15b30fd6a1ba7428252ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c107e963-f326-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712305826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305826, "uuid": "52ef0116-7990-435a-acb6-159482d0eba3", "comment": "Malware payload (AgentTesla)", "value": "6a4868f4083fe5cac5a947124139d094", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305826, "uuid": "f665d51a-32fd-454a-84c6-395ee47e17b7", "comment": "Malware payload (AgentTesla)", "value": "c54db9508c1d06e597762e1c4b29d3f6712325dc9be43782d28b5a1630f3cf3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305826, "uuid": "9bc2b28f-77bf-4d8b-875c-6fedb007ce57", "comment": "Malware payload (AgentTesla)", "value": "64187e1b684b2597671271af8c57a6bbd59a1692", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305826, "uuid": "27ff3d4b-f7e5-4603-be2f-cebcfb28cc24", "comment": "Malware payload (AgentTesla)", "value": "43cd5192a4d26a573c231f99dcdd1907faa54dbb4303f5c50fd438604f7175d620e502839696a9f512a191f21a07f7b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305826, "uuid": "bb4fc86b-ed17-4c84-ac90-1107bf2980c7", "value": "T113D423015F98C70FF74D953216A4251E91FDF85E9AA2A776F8BB0483CC302F08B245B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305826, "uuid": "e7103afd-9d20-45b9-9ab3-0814db4c650b", "value": "12288:BX451jXz6YqIL2jhYlnLH+hdn6/YpwrmXa72H+vk4R0hw:BX4r7GYqdYNAdZwrmqlkVhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712305826, "uuid": "f1b4f519-8236-407b-ab08-da55fef48378", "value": 625264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712305826, "uuid": "7d84d8ea-5c45-4f85-8f0a-87d909a156ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305826, "uuid": "86ab6bcb-9945-4d47-8ac5-415d7809750f", "value": "417866205_11664051738_20240403_92346728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c366a87-f33e-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1712315858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315858, "uuid": "9891a40a-0d36-4b9f-9f38-293026b47d0c", "comment": "Malware payload (XWorm)", "value": "22d736ac0bfacea4d23dbaf9412d329a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315858, "uuid": "8eaced65-a9a4-42a4-8710-e38f12a74a43", "comment": "Malware payload (XWorm)", "value": "c5a2fd9c057765f6eb2bde2cc86317b53d8418117c9e1362596e067b44ea7d04", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315858, "uuid": "d7b78051-cf28-4e0d-aba0-143aaafd32f1", "comment": "Malware payload (XWorm)", "value": "b2990e0c9f9549b1f8cc3dceec47663b975cbb36", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315858, "uuid": "7c0b9fb2-151b-41ca-85f3-723fd7aca0b3", "comment": "Malware payload (XWorm)", "value": "83245b457c4e4935a7f823384bdb0eecca60d23100710bdb213deddcdb5cf078844bba4e616a7f6595d57c65d69c1bbf", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315858, "uuid": "096a8651-05a9-44b4-b3c4-f0fd5e4e3bed", "value": "T1DDA16F5687FA4104F2F35A4C993226795B777A1A683DC20C05EC3D1E1FF3A8498267B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315858, "uuid": "1064312c-f059-45f3-9fba-3dbd81ea66ac", "value": "96:LQUUjcFSoSqUnPkPKOTK6yjbo+yHQUJ8fLGZ2k7:dYcFh5UsPKOTJcoLMw2k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712315858, "uuid": "f960804b-9b88-4aae-9dcc-77509d84fc79", "value": 4988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712315858, "uuid": "739d1437-7898-4b19-a70a-b3600554bddf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315858, "uuid": "aa1a4abb-46f7-44b8-875c-4470b5348cb3", "value": "receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f0d543-f344-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712318664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318664, "uuid": "91fd7c1c-0848-4018-818b-7136708d4ee9", "comment": "Malware payload (AgentTesla)", "value": "ad8c3927343723b3d64c2cb631d37885", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318664, "uuid": "cf8a88d6-f5f2-4a1a-9c3a-9a239633013f", "comment": "Malware payload (AgentTesla)", "value": "c72f90a7d37a764e69747b3efa8474a09e68f478c50769f51225d2e73ae542a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318664, "uuid": "688a7858-797b-46a1-8803-878509a72f78", "comment": "Malware payload (AgentTesla)", "value": "506cecde7b4fcf292ad35853679b8f42bea881a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318664, "uuid": "49948c4f-b01d-4d3b-8e7f-cd2fd0d0c51f", "comment": "Malware payload (AgentTesla)", "value": "b453dc358f098daad1e6655afa76e40460b93fae76b4e8bb6098d06a3b5e6cf0d64fcb1e90d9d7db1ed81b567374b55a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318664, "uuid": "1048d337-ce8e-4962-988d-6747cddfbaed", "value": "T19935BF0273C1D062FF9B92334B5AE6115BBC79260523E61F13A81D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318664, "uuid": "6b2f0c8f-979b-416d-8ba4-e95ff314c792", "value": "cc2b3e63a50ba98c3412285dee7a8f0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318664, "uuid": "35c7c48e-f4f4-47f7-97d6-4ee4bffaaa32", "value": "24576:BqDEvCTbMWu7rQYlBQcBiT6rpFd+zx4f5t4G4gOt6BYlkcYeo2:BTvC/MTQYxsWPkzx4fj4G4p6BCkzeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318664, "uuid": "44ca38ae-b0c7-4890-8d50-cd29f7b1a2da", "value": 1131008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318664, "uuid": "8421183b-ca93-4365-aed7-8ef9d5c7059e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318664, "uuid": "10b57387-9665-43de-97da-50ad1e35e32e", "value": "c72f90a7d37a764e69747b3efa8474a09e68f478c50769f51225d2e73ae542a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204feb54-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286659, "uuid": "e4ff4d90-1b62-4fba-b408-c9ee5fe4393a", "comment": "Malware payload (Gafgyt)", "value": "1027cabcb8d08088935e54af6ad4b50d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286659, "uuid": "f8a193cb-185b-4eac-8cf9-cdb08effc7d2", "comment": "Malware payload (Gafgyt)", "value": "c7ea679dc671a3f7312e2dd9c8167a9d312b731a9f56dfb7030c98c35b231b19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286659, "uuid": "83b87e18-4979-4ff8-89a9-cdde8f9b866b", "comment": "Malware payload (Gafgyt)", "value": "45c95d0c891ac28fa851687d4d189c610aa68776", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286659, "uuid": "c2e54180-d9f3-4e18-9351-5b9f9708ff29", "comment": "Malware payload (Gafgyt)", "value": "2a12c9d3b32be5a8a103b91ad2838cb5917c91a39da94160f4a5c1879938f62163b987ebf666a4b5411e719e423ede1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286659, "uuid": "8cba745a-89ce-4c5f-9648-ff806492a9a5", "value": "T1ECE32A24F8404767C3D323FAA64D879E7F3517E623CB33116A389DB45FC2B992929960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286659, "uuid": "cbf82a44-f93b-450f-81ce-e2ee6a51d97a", "value": "3072:6hlLp1zWvkO0PXs/DiW1VrdM5hn8eoadVjkmOMDQ4DtsL6Qse:O7J8/Di2RM5hn8eFkmOMDQ4DtsL6Qse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286659, "uuid": "cd415a29-8c88-4654-b366-97d4b34fdce5", "value": 149019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286659, "uuid": "ba484915-112f-457a-8e3c-5aec829eabb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286659, "uuid": "b7a2430c-ba85-48e1-b51b-f456c8633242", "value": "1027cabcb8d08088935e54af6ad4b50d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35960868-f35f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712330074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330074, "uuid": "059c069d-051d-4052-bdc4-2a2fa612cf23", "comment": "Malware payload", "value": "0ea65d26328eba2e3ca7f52be8aa24d5", "object_relation": "md5", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330074, "uuid": "65406fea-5856-44b3-9de7-7fc93a870cd3", "comment": "Malware payload", "value": "c815a8ba8dccf0c37cc62135a2694583f21388662081f556fa091ee2c25ee7b1", "object_relation": "sha256", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330074, "uuid": "7b9e61ba-3076-40b3-92e3-60280d8893b7", "comment": "Malware payload", "value": "c1919ca6b8769ba6451fbf0e882b1e78047c9aaf", "object_relation": "sha1", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330074, "uuid": "6cc42f0c-90ae-414c-9cee-c945abf3a2a1", "comment": "Malware payload", "value": "a7bebc1d58ccc6e9c852eaeccbfdb620d4fb78521681c6b7aa58682d3a3c82ad053cdc0891122aa7d555ad67e8c0cfea", "object_relation": "sha3-384", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330074, "uuid": "a612e6ee-e6c4-457f-a036-f0e8fd9e64af", "value": "T15F083389FA6CDCA783F5DB948A70E3557C6B42C81B7F18025D98D509D9F80D83A3C8A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330074, "uuid": "49419f24-569a-4f51-9a19-d85cc8c68a77", "value": "1572864:MD324o9imQO+0+UkrdUMhU82uu0CCYk6Al+4uJ5PpPGpfUas4ZuQCEB:c2ziRTDuMhwuu09i1pPpiXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712330074, "uuid": "e40347f8-4d47-4cf0-802a-4a79308959a5", "value": 84176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712330074, "uuid": "3f3deb07-9fff-4179-ad46-4d7d3c2b2672", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330074, "uuid": "275923c8-c6ec-47bb-8937-3bc6a7f54d15", "value": "Sky-Beta-Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd459b9-f319-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712299999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712299999, "uuid": "3a36de4b-0905-4506-8a88-bf21334b31ce", "comment": "Malware payload (Socks5Systemz)", "value": "33ca619f5aae7dde066b00dfedd42318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712299999, "uuid": "828421da-e2f3-4f9b-9677-63a772174fed", "comment": "Malware payload (Socks5Systemz)", "value": "c93e81abbf5a6cf82a908f3842bbd6a6df6e88457b3ac23702ff76f2c8fdb6b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712299999, "uuid": "0bcc994d-ce03-41ee-9374-560fd0c985ae", "comment": "Malware payload (Socks5Systemz)", "value": "3bd4e97d112b7e53a0f042d3d0ed5a88acba2321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712299999, "uuid": "71a995df-0825-483e-8b99-db39f4005c75", "comment": "Malware payload (Socks5Systemz)", "value": "f74a78f85af8178582fad227db7923c90825cadaa4751b44fe9ba35a61e8926e859f7b577b59acaad5372841c0dce4cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712299999, "uuid": "68b54bd0-c861-4939-8cc2-9aaf55f0af39", "value": "T10F2612A579E8E213D37FDBF2BA4448F968715CB73A92113E2E56B3118035211BCDEC29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712299999, "uuid": "934e9c11-5814-4a6c-b0be-8a77b0e2390f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712299999, "uuid": "96576719-e2bf-4b2b-8aae-2ac453f66b58", "value": "98304:0jxnJklB5sX2RYZ+GYtXYBYjEkYOEiraNOJl38QokhNIztQxu:Y4oXgfRtI+rYgraNOJ9ZhNqtQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712299999, "uuid": "3c0d6247-f504-4b21-adea-1d95631e37e7", "value": 4452181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712299999, "uuid": "f4683c70-c983-4cd8-974c-dd793ebb4634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712299999, "uuid": "3f0a2e23-ae6b-45f7-9353-fdf9fa4a4460", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fca3a67-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712309609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309609, "uuid": "fb355448-6d2d-43b0-9341-3f2446a27f54", "comment": "Malware payload (Gafgyt)", "value": "22aabdeef78ca7093b083fd9770cd700", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309609, "uuid": "1a52e271-2885-45a3-a267-2590b06d023f", "comment": "Malware payload (Gafgyt)", "value": "ca7bdfd3d6aac325c3fd608cc77439df74705af0098302ecdca4945ba7423f65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309609, "uuid": "eea6f198-ab47-46b5-b6e4-bcd2235890d8", "comment": "Malware payload (Gafgyt)", "value": "9e85836014f991bc74568e360b2710b08f935cfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309609, "uuid": "111f4920-bafb-4d63-9e7b-44751c3ae5dd", "comment": "Malware payload (Gafgyt)", "value": "cd98adb9f5df7b7717d05f3dce88fae5f283b5bacb35405cf7a5053e96e1d737dc035198e46dd7a7ddcb36d17bdde4ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309609, "uuid": "e7417694-0e43-4cba-b874-ba3b1dfb1ef1", "value": "T1A7042910E4414767C2D313F6B79E865E3F320BFA57CB33125A346AB42FC2B8A1979964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309609, "uuid": "5279725d-0a4b-4283-b33d-b9e1e0278256", "value": "3072:aZdxJkATVYafCwuoQ3aM1HNh5hcm60rfVsExmPQOYbr5Wn:QjYafCwyHNh5hcm6fExmPQOYbr5Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309609, "uuid": "a7043b3b-9242-482a-86ca-b0b895ecc3d9", "value": 175252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309609, "uuid": "21877060-59e4-4397-b1ea-c90fa42a3ae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309609, "uuid": "96a7023c-483e-41ba-9220-e588ce031d1b", "value": "22aabdeef78ca7093b083fd9770cd700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9869fd4-f38a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712348790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712348790, "uuid": "bfa19494-b641-4bcb-8a87-df163fa23462", "comment": "Malware payload", "value": "dfba29777a858f1466ed86542d3428af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712348790, "uuid": "c5965675-e73d-4f99-8da2-f61f5184ac4b", "comment": "Malware payload", "value": "cb08ae1749da4a827cc3e841ed5082d672a5a4eb931c1121ced0f599bc6ce00e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712348790, "uuid": "9d60f2dd-9014-4720-b9ba-e078f76382f8", "comment": "Malware payload", "value": "3c6e50326c641f22cdc67bd7ae80dce82e7d3149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712348790, "uuid": "e57212a6-a80d-467c-9aea-12dec5059e91", "comment": "Malware payload", "value": "6520bb0d2a3a420a47323e05c26ab22c16334ca4202adc11dbf4f9751a962f9a05f5bffe36738497993ff97075c6566a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712348790, "uuid": "779b7cd7-6b6c-4b79-ad0f-dbd4a44bb5cf", "value": "T141A6330AE7D419F4F0BBD678DE468A22DBB77C494632820F26DC061B1F677509E7A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712348790, "uuid": "68e25985-f070-4fa4-a06e-b7ea4f503f2b", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712348790, "uuid": "43758972-144b-4eeb-bacc-2f08663eed0d", "value": "196608:j3GuN8tKACUTsPnUgLm2lS45nJjAZWWhVkRbpwN15v0lddZntb4u6uY:bN8t5fTaLlSopAZWWhCd+8XZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712348790, "uuid": "0cde1642-5397-44b1-8d7e-9a465043ff50", "value": 9972770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712348790, "uuid": "55d57003-04d4-47d1-baaf-293c74c3d327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712348790, "uuid": "b29e550b-a912-45fb-a29f-c4779f2ab51a", "value": "SecuriteInfo.com.Application.Generic.3630333.28927.11250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a450b9c1-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712321240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321240, "uuid": "dc2bb104-97c0-4790-95f4-866b2765b1f8", "comment": "Malware payload", "value": "17dae9f630b6754cd83a4c7249d55feb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321240, "uuid": "637f638c-840f-4cc9-8d55-f1b95bce7072", "comment": "Malware payload", "value": "cbabd91fb0c1c83867f71e8df19c131ac6fb3b3f3f74765bc24924cb9d51ad41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321240, "uuid": "7e40ade4-de94-4ac3-b214-81eac4ed0060", "comment": "Malware payload", "value": "17b545773f79de87824316d426f975243372eeec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321240, "uuid": "488a7551-d136-4a4e-9a3d-1a853c2da1a6", "comment": "Malware payload", "value": "be9934f471b497d233424f8a031530927f53f05a604649ab002c96c015b11838c6413011ce073a4930419c1692a75918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321240, "uuid": "9b5b1ff2-3084-4887-82a0-a0eb80923228", "value": "T159B583152B3F5A99E511C8B1E27B1153A8697D0CD01C79B6CEC08F427F67F20A4EA7AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321240, "uuid": "575acdef-bfda-473b-be69-011c46f0c3c1", "value": "4cd0855d8262939d4ac1c7b198fc51bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321240, "uuid": "382f8c91-7cf2-40c4-a46b-d212bebfdab9", "value": "24576:OtkNO9GqWC6a+Rfvc12lGWe4KlZ52rjr7RC/C8oy/1x143jS6j9YJHVpHsQrO5Sm:9OT+Rfk84We4hjr72rh43Ml3vmeJTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321240, "uuid": "02207a75-4a65-4354-8238-fba7bf8eb95d", "value": 2433536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321240, "uuid": "8eff1774-84d6-4f62-921a-483e01e021ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321240, "uuid": "6c1f2c32-99fe-43d7-959c-6f150ff4e8be", "value": "Succour.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8bf026d-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "b85bc3bc-f0dc-43e7-be5a-ed2c6b41c65d", "comment": "Malware payload (PureLogStealer)", "value": "83f3e96a9decf048c8de074bca588012", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "a6dc3e17-842b-452e-8ad9-1a5e4ff42687", "comment": "Malware payload (PureLogStealer)", "value": "cbac844a67ae6aa2edd9e0fbde09c6df414000f0c99cfae18822e25747d4d5a4", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "9bd17656-9c8a-4b8c-aca2-c30e10bf242e", "comment": "Malware payload (PureLogStealer)", "value": "5a7a2c364ba036e6d2e05c52e2add1f698c71b49", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "b69370d2-1574-4b70-b72c-db9bb8821e14", "comment": "Malware payload (PureLogStealer)", "value": "9bc3d257dc97cda40adcccbc7e9524e1a064f96ca440f9fc64c0a2afe83e63358942b40f7201d4cc3d932d54174e6b14", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "e1dcff18-fafb-43b0-b173-b14adf444fd5", "value": "T1C20533E33BD30B34CA89AEB2F4B17BD430B25B9D1BC46E549C689086993594D5FF12B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "086cdaf0-dfd7-4c57-ab14-258d01dfcd24", "value": "24576:HTOUlQ4ivzjPxyuSIMkb/lnSUMr4u42tOpKl:zOUlcbb5SFkxSUfgtOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "3712d999-7d87-4acc-ac39-b9a01171d8fe", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "24423e0a-c1e0-4292-ab29-a3ed220b38e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "b790b59a-7e6a-45a4-8494-d18ce7799464", "value": "17123252450b6940bb17921cc1c4c132d68feb5fb35a62c3f278257a9a33f53f8183a1769e413.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d63f13-f35f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712330155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330155, "uuid": "7f4087cf-de2a-4d8b-a76f-b4f023c4dacf", "comment": "Malware payload", "value": "1f5e6ed5583f8d98f95f3e0ce94cb753", "object_relation": "md5", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330155, "uuid": "f7d2fd41-8922-445c-b991-dde8516ce1cc", "comment": "Malware payload", "value": "cfcf77278696787246aaa744b043bad0a3168806485a38fb3d628f2039686657", "object_relation": "sha256", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330155, "uuid": "4aa5a0af-02fb-4203-a3c8-dfcc75586d8b", "comment": "Malware payload", "value": "2ed8057934d8ac4a392d1efd194df2ce679a32f8", "object_relation": "sha1", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712330155, "uuid": "5dbbf5be-2f14-4eb5-9fd3-2f073f097ee0", "comment": "Malware payload", "value": "a4a04ebe404c22266aa2ef37b0644001928b506b548b18ac7571f21e7ca7b80760936d151f4e0aa235b20ae7f0800fa5", "object_relation": "sha3-384", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330155, "uuid": "ff9d9cce-4fac-4bbc-bc84-b5ee95b0a83a", "value": "T196083318F36BBA21D825F9F66EB46670E561B28733F5E0B37B515E40BC64702BA160C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330155, "uuid": "c8835dec-e71a-4833-aa7f-48d9e12a4421", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330155, "uuid": "fd9b6771-7bbb-4994-a35b-7d0c7e638cf7", "value": "1572864:Z2J39KPh8SoM89MXY5B8ceyIS7nqYdd6hIEhSmnJZxRByudPXFPF:ZdZ8SI9MA/vP7nMhJnzxRB5dPXdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712330155, "uuid": "65ecb39c-45bd-440b-a93e-be1ba1734643", "value": 84188460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712330155, "uuid": "a4468f2b-2d4f-41e2-b317-56c4a7c93363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712330155, "uuid": "2f8ea187-5889-4c5c-9fdd-f5f32c47f947", "value": "Sky-Beta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c042dc-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286618, "uuid": "46438b31-8891-4fe2-8ca8-cd7a2a11f1c5", "comment": "Malware payload (Gafgyt)", "value": "0cb1aa458d3850dd53b96437e579a2ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286618, "uuid": "b0eaa691-c2eb-44a0-8fec-ddb73e345778", "comment": "Malware payload (Gafgyt)", "value": "d0696de543a6bc8b9e1aff6b376b27c9cba81934a9d46c14450b2a17958ad6c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286618, "uuid": "06dd1216-5bf8-47ed-a83b-42d800a308a6", "comment": "Malware payload (Gafgyt)", "value": "e77526f19aed403973ab85e3c90046331f83830c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286618, "uuid": "c1b37d6c-ef18-4330-b982-696f0894e91e", "comment": "Malware payload (Gafgyt)", "value": "6c1cf3d6b85167d08c007430b99731f4c7240bc9a25799173887f1a47459f73a6cf5a76b3ce7eac97214413f61994174", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286618, "uuid": "675cb2bd-b505-4c93-863a-4e25e7e4ef12", "value": "T14D244C24E5404B57C2E323F9AA8E428E3B3247E573D773154A389BB43FC2B9A1D71925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286618, "uuid": "9fdfdb81-0e1b-4db2-9453-3a57c5ad6c91", "value": "6144:FZzyacCwXJ4DbpW0vs5hbL6+uM/9Ocgym0wfB5RyAn:FZzyacCwXJ4gH5hbvf/dgym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286618, "uuid": "cd1aad25-d448-4a87-80e8-11a86e398cb8", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286618, "uuid": "668c394c-e704-4d76-afc7-b506dea1fba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286618, "uuid": "00b56f8f-98cd-494b-9bbc-191e6bb6c14a", "value": "0cb1aa458d3850dd53b96437e579a2ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d0859f-f344-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712318390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318390, "uuid": "71bd2621-0887-4e21-9eab-c34dfdedb04b", "comment": "Malware payload", "value": "c74719b880346b9dcf5eab02da14d960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318390, "uuid": "e3947dd4-4540-4f99-8b9d-c4b9d136f919", "comment": "Malware payload", "value": "d121e1a30778f806349f58ba738aba8378d011f99f5595abdf60df763070e9a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318390, "uuid": "79f7a538-6a4a-444f-8e5d-43bc2695177e", "comment": "Malware payload", "value": "e08a57fdb58d6aeb1a4f666b8638c974d2714ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318390, "uuid": "e541cda3-cb11-44c4-81b2-07140c231b3e", "comment": "Malware payload", "value": "71863cefae82901829bb4878cc55e475f17a241c75f0a19af8bdc6e88c8206ab06d83eae705b3fa273d30bddfe6bbb50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318390, "uuid": "766c1410-872a-4115-8bbe-e7e6c18450ee", "value": "T1B7F4C092BED0A9B1D02224333A24AB3877FD7D205F6149EBD386E95DBD321D06231B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318390, "uuid": "a87fa246-96c9-49a9-b10a-a2de72d57fdf", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318390, "uuid": "9432930e-a759-4182-9e18-1f90c245fde1", "value": "12288:GubsNSOetfARQAPyGUu7zAubsNSOetfARQAPyGUfT+tkrOMT/cTm/0:GubsnafAPyjSzAubsnafAPyjZrHc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318390, "uuid": "bf58fe4b-dd58-4d37-a40c-3ff6f616c8d3", "value": 782639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318390, "uuid": "2d227d36-6467-41e1-a628-d3cbc4596a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318390, "uuid": "3d963eec-78e9-4ffb-aa11-e27d5456a6e1", "value": "c74719b880346b9dcf5eab02da14d960.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7788de91-f38a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712348653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712348653, "uuid": "c98dbda7-4433-463c-92b4-0fd0bcf718d3", "comment": "Malware payload", "value": "4f086340341fe991a7df4e94f77e2c03", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712348653, "uuid": "d9f33118-927e-42ef-9830-bc3ef1a87c8d", "comment": "Malware payload", "value": "d1b80ee3f842da321cd91d9e647ea412d2fc9fa25f7a4729c40ee31655e51da3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712348653, "uuid": "3982738a-914e-42b0-968c-a1f0fadfcec3", "comment": "Malware payload", "value": "6a2beb53c80fdb62f444da7c3bb4d56991cfe18b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712348653, "uuid": "047a8257-14d3-4062-b3ad-e9538beac79d", "comment": "Malware payload", "value": "0f29141452c8c651426b7035b58a0215961d346ea61b1b25c80fdd7032b1480b5fb17514775084031281a4976ab1beeb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712348653, "uuid": "035aa056-197f-4b9e-af99-982e4fe18214", "value": "T11A9533A29734C3E424A80AA77A4360610EBEC6DAE1456FA8DCF0F41D05ADBB5FD1F11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712348653, "uuid": "2dfa07af-407a-456f-ac3c-83a3e49a96e8", "value": "49152:hVrc187skDStTQZzPryjH2rc1rEBCoM3jzJ/qbM6JYm:+8AkStsZzPr81ru+3jd/EM6JH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712348653, "uuid": "1c38aaa5-813c-4258-929a-3d1430614a72", "value": 2023420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712348653, "uuid": "87fbe310-b0d7-464e-9907-ea8ca9d4b3bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712348653, "uuid": "4047624c-7fc5-44b7-a6d3-614829d983c0", "value": "Update_Accounting_billing_details_dtd_0026032024_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17877391-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712321004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321004, "uuid": "074d9da8-ce85-40f8-ba19-575e7e23aaf7", "comment": "Malware payload (Mirai)", "value": "06d57c064797a8df2e37419267c1dc5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321004, "uuid": "3e809ece-57d0-4368-bd88-8b6b41189102", "comment": "Malware payload (Mirai)", "value": "d2448baaf46b13d3d5e11d37c1d5294b7b7bf725ca928ce2f3d866716904493f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321004, "uuid": "3cad458e-eb85-46dd-9f94-8c236bd10aa3", "comment": "Malware payload (Mirai)", "value": "d6d3d2d7f86846603a37e9b47d9ad99240d3bf4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321004, "uuid": "7eb1d546-f2e5-4e1a-aca0-bff543773579", "comment": "Malware payload (Mirai)", "value": "36b51f89ff6dc10614fcf4342e6cddf5db7b4dde3be72b1ee8f898e4f75412cc87e9eef2d9bf3a097337a975cba715fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321004, "uuid": "5837ce1d-0fa6-46e1-a3e7-bf2bc49d705d", "value": "T134336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321004, "uuid": "5ea5ae2c-aed0-4ab1-8cca-af52ff40e228", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321004, "uuid": "434c750d-75a6-48a2-bfa8-66c19fcd4d44", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321004, "uuid": "008b0c4b-e4de-4688-9317-189438f92157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321004, "uuid": "08133acc-09ca-41d1-ba8a-b36e39962e75", "value": "06d57c064797a8df2e37419267c1dc5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b511dc-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712286914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286914, "uuid": "46fce0e0-f518-4852-912b-5504ae63a231", "comment": "Malware payload (DCRat)", "value": "3a320c1c60a4c3f1b21f44a6dfd1ef7c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286914, "uuid": "c52a04df-b422-4955-be16-50766a83c778", "comment": "Malware payload (DCRat)", "value": "d297f9df259ef55fa220e34eab0a5dfdfad7909775a7b04c09f3292627abf808", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286914, "uuid": "1355c256-91f3-4277-b9c7-515c189f8e0d", "comment": "Malware payload (DCRat)", "value": "8a20f0ecb013e2ae2988e3b085c96292e23d8f64", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286914, "uuid": "0bae4fac-d01d-4d9e-a8ff-8ad51bf41ef0", "comment": "Malware payload (DCRat)", "value": "9a79d8468d8c658c4ecb47e88f48dd9f15ad6cf71ed326b18a09c6fde412a4cdb070a71b79e326afa8b3c092ebc68199", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286914, "uuid": "03cc7aed-dd97-4c2a-a5af-1e5772d8719d", "value": "T1E94538017E44CA11F0191233C2EF494887B4AC516AE6E76B7EB9376D59123933E2DACF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286914, "uuid": "abaff0b1-2926-4b4f-a457-59e20dde3729", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286914, "uuid": "8594c6e5-474e-4011-9f6c-125398ff5901", "value": "24576:U2G/nvxW3Ww0tDxOh02EkLY5sQqAjQZBnRi:UbA30PaQSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286914, "uuid": "b450a7ac-fdc4-4f58-98da-8ad48746687b", "value": 1164386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286914, "uuid": "a0e97f86-0159-4733-9d29-cae6ca37ae55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286914, "uuid": "3f8be30f-62e6-42b3-9e5c-ad28d4d78449", "value": "3A320C1C60A4C3F1B21F44A6DFD1EF7C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8191dce9-f32f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712309585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309585, "uuid": "38a64cb4-68e1-4c20-bda0-ed9e4dc14595", "comment": "Malware payload (Mirai)", "value": "6fd8efbf3c774b8a3696b3d8e854e5eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309585, "uuid": "a0fb1361-0ee0-4008-88a0-c11bd8400d88", "comment": "Malware payload (Mirai)", "value": "d2faa18f016f2cb3db8d5b40214105884ca335b08a9f805f164b82d8c1419240", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309585, "uuid": "d3744968-4806-4344-830b-ede7e1ac3f63", "comment": "Malware payload (Mirai)", "value": "69aabe73992451fdfdfb74d9ab18804fcfee1301", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712309585, "uuid": "063d5523-607d-4e9b-b74f-177a023f6191", "comment": "Malware payload (Mirai)", "value": "83d06734e74523aee1ff3d42c35e7cd10e32dc12d761a0d6f34cfe51dbc1bde3eee57e15642a9f678d6260bbd4020dd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309585, "uuid": "cc167d72-f387-490b-ba3f-61908efe7b23", "value": "T12E0419C7F801DEBAF81EF73A48530415B130B7A248825B373253797AED7A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309585, "uuid": "f27948cd-d11c-4134-b48c-02370afa823d", "value": "3072:R0dN5oGwLeY2qqxS+7zhTjfJjVZ4RUGDEDgBpgklFfe6TlpZ8VCjbi0Ly4i+yNVI:Irzme77zhTjfCUGDEwlpZpZjLycyNQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712309585, "uuid": "711c4996-5c82-4ecc-8721-109b35611a39", "value": 176448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712309585, "uuid": "18b63bb1-184e-47d2-adae-58b23a573bf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712309585, "uuid": "a72928c5-ecba-43d9-ab88-7f46a4c68296", "value": "6fd8efbf3c774b8a3696b3d8e854e5eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86a9924-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "1c52556a-c16d-4be3-adcb-20041720c4df", "comment": "Malware payload (RemcosRAT)", "value": "a2559743b14ba6fbfdb54112ec7addf9", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "d5cdd0b9-f3e1-48d2-a9da-63e62a291c7a", "comment": "Malware payload (RemcosRAT)", "value": "d32356d6005e4b696a0145ec295b706c008c42f48beba21f6203094faf060229", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "6ebfd31f-0ed1-4846-95d4-5dde5c87aaa7", "comment": "Malware payload (RemcosRAT)", "value": "ec6f6ac62ab4098735ce7d355d123ab125c8c596", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "ce917706-e022-4d98-b466-efaebdfec99f", "comment": "Malware payload (RemcosRAT)", "value": "3645c328d52a096fa336da7f02b5b98e324758e979919cc453e8109353ce440094c4e412f3547c707bd35c5ba41137df", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "ccd2fac3-ae13-4ca4-8e6f-df1e11845fcc", "value": "T1CCB49E01BAD1C072D57524300D36F776EAB8BD2028364A7B73D61D5BFE31190B62AAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "6d4433ca-1a06-4601-95fe-b59295405151", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "531695dd-4821-4f8d-9b87-474e372eee49", "value": "6144:cXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNM5Gv:cX7tPMK8ctGe4Dzl4h2QnuPs/ZsVcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "ce1176ea-3469-4b9b-80c0-eaa2fc8cb9eb", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "c1a9b92f-3cd0-4e61-9427-4135ee474acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "40576d1f-57c9-4e11-bbe0-42ec6df96064", "value": "1712325245cc226d51885ef77b1cc5f09859aff0054330432691c1328fbdf88199018a7f16240.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b7b165-f334-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712311517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712311517, "uuid": "6ba63a43-27a3-465d-8488-1758a45a6411", "comment": "Malware payload (RedLineStealer)", "value": "08351b82ff3f0f7954820a2dc454c73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712311517, "uuid": "e8d6b8e8-8a4d-4102-9124-a6c2c1086c53", "comment": "Malware payload (RedLineStealer)", "value": "d477322f8d90be3d37d78ab73d97d59e0ae6ca7ac32e2fdefd5668f67cb1fb62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712311517, "uuid": "9d7fa3ed-6048-4631-b799-e4a31aaa34a8", "comment": "Malware payload (RedLineStealer)", "value": "8ad1f8ab47fd38e66e83e8d94912cb9507beee97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712311517, "uuid": "f7542723-aa5c-4dd9-8d16-28ccf947c924", "comment": "Malware payload (RedLineStealer)", "value": "59539273669cc3ae76834d6c796b69b28c4e0d808133948e0a75a2eaec6ed21d839c60e4246f06078985fb972c0cbb69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712311517, "uuid": "9ca6d8f1-cb8e-460f-b69f-5d1330b87c4c", "value": "T18D05232466909C2EF5C6877060B86B37AF21B75636B4C3835358D960F6A79C03F6F2B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712311517, "uuid": "0e7bdee3-d6ea-435a-b0db-e7a7db1ea3e1", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712311517, "uuid": "09ca3079-d383-4f1b-9a24-92d1d7bfe11e", "value": "24576:BfLvhthNFbZT1IMYNF+/lHg3cv5//n5EkhEtxbeIee:NTbhNFZ1HTmMvN+khWbeIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712311517, "uuid": "5f4097b1-0a7a-4641-980f-85932a23e821", "value": 834428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712311517, "uuid": "f7968fd6-8d0a-46d0-a16b-e547ace3965a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712311517, "uuid": "e5239c36-d165-42a1-aa2d-81774b4e5ac8", "value": "08351b82ff3f0f7954820a2dc454c73c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3378cd09-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344243, "uuid": "f1e434db-b578-4106-b778-e761baea1fca", "comment": "Malware payload", "value": "daf5ddf2a53dde0a2398973fc6ac93e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344243, "uuid": "2ca00e6a-85e7-4be0-86b9-f8b2a8df43c1", "comment": "Malware payload", "value": "d4ff62f78b546c2e181f819abc1f17736ba27c6630118f6d6f772b7d34d5334d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344243, "uuid": "bf0fa3dd-2d08-4563-b5f4-f538da04fa47", "comment": "Malware payload", "value": "a225fec587cb4763eba40943c88396a86e74c6c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344243, "uuid": "329455ce-21a2-4675-b520-4c0ff7faaa5b", "comment": "Malware payload", "value": "667dae6e68d9081a0d5ea296a1caf3a8da46f72cecd77cb46d52c105b57c9e9cea556a42f8c852d1229757525254a602", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344243, "uuid": "ba4fd304-2636-4712-bddd-d85475d7844e", "value": "T168055C23FBC4612BD87385F158626165BB213D231B52DC4F76D1AA8A29B1743B1B332F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344243, "uuid": "d5d4ad51-8e31-4a69-8cad-d83e262f7428", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344243, "uuid": "819e0b5d-cda8-4565-b708-953a03c2b5e5", "value": "12288:zENN+T5xYrllrU7QY6/5xYrllrU7QY6vaLo3K3ahaMcqDJXKuJUsENN+7:Z5xolYQY6/5xolYQY6UomahakN6uJUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344243, "uuid": "a6286699-50d3-457b-8a14-3f697562c834", "value": 824300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344243, "uuid": "740e976e-60d6-4d30-bc06-dd051bc3d8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344243, "uuid": "92873e3c-823c-4a10-be76-e584883e83b9", "value": "d4ff62f78b546c2e181f819abc1f17736ba27c6630118f6d6f772b7d34d5334d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9043685-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.OpenInstall)", "timestamp": 1712323476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323476, "uuid": "b59cd952-3e0e-42d6-b4a8-53d3930112a2", "comment": "Malware payload (Adware.OpenInstall)", "value": "2d98cd979f2101fc7f4f6607355ba9dd", "object_relation": "md5", "Tag": [ { "name": "Adware.OpenInstall", "colour": "#AF2C66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323476, "uuid": "7bbb9670-42fe-4ffd-ad40-f0aa9ad265af", "comment": "Malware payload (Adware.OpenInstall)", "value": "d58978d1946eb023ee24c2657970fb731a1a012236b2c4418c98aa628f22ae1e", "object_relation": "sha256", "Tag": [ { "name": "Adware.OpenInstall", "colour": "#AF2C66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323476, "uuid": "7eafdc25-4f6a-4e4e-ac5d-84eb95a9cc2b", "comment": "Malware payload (Adware.OpenInstall)", "value": "6beba75e99baa35e7e623d051f1d90aa054e3dc7", "object_relation": "sha1", "Tag": [ { "name": "Adware.OpenInstall", "colour": "#AF2C66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323476, "uuid": "48500ea9-e153-4eda-8574-3f6feafc1bc8", "comment": "Malware payload (Adware.OpenInstall)", "value": "2373ef0dfa224b636bd56822d46bcf73a89e0d1c77a8d8ae5d08062344378947a0961c0bfac2d25f3225666957fe47a7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.OpenInstall", "colour": "#AF2C66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323476, "uuid": "9616890b-1eef-40fe-a1b2-e418af72c018", "value": "T1C17402403A41C841DBA11B30AEA5DAB11938BDAD5BA15E3BB1997FEFBF37217E581100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323476, "uuid": "8e9b80bc-f367-4895-8b99-e04005b890ef", "value": "079b239ba78e14a522d1a098212cd2c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323476, "uuid": "23c188a2-407d-4e45-8fc3-e25d498067d2", "value": "6144:ASQfhYCjILkOUvJyWRJFLnWOuqWGK7HneaUhKl24vCHD98YVyYb9ja:FQfqwuUvJyWRf7WZLoh/1j+YVZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323476, "uuid": "c1e12537-b87a-4a65-a177-db067396cfde", "value": 341072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323476, "uuid": "effd6ca1-49db-463a-b554-c73f788cf388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323476, "uuid": "120c98b5-16d5-4caf-8d1c-ae707e37a050", "value": "SecuriteInfo.com.Adware.Downware.13763.22308.6191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83cc424-f30e-11ee-a120-42010a9c002e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1712295530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295530, "uuid": "ec90e8d2-e865-4de3-8866-2d1c12376f65", "comment": "Malware payload (PrivateLoader)", "value": "858bb0a3b4fa6a54586402e3ee117076", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295530, "uuid": "d30a794a-0b41-447e-829a-783cb832d4ef", "comment": "Malware payload (PrivateLoader)", "value": "d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295530, "uuid": "909d38eb-b00e-4f7e-9aea-8846cafa002f", "comment": "Malware payload (PrivateLoader)", "value": "997c31f043347883ea5ed2323a558b6cc5ea9c8e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295530, "uuid": "d29255d6-af23-44e0-8827-b961ae161b81", "comment": "Malware payload (PrivateLoader)", "value": "867226f97336663d7df37ba8fea74d1f7a3ba40e783604fb89ea92c0702e9807d32e3bdce578e5e3aa3938928df2d837", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295530, "uuid": "692119a9-80de-4be8-b30f-092df244abe3", "value": "T1C12622DAE34C8D4EF17D027EECE642789167BAA2B1D2446D754D188182363C27EB3F64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295530, "uuid": "fc2a0696-9c65-4be2-b886-c6cecd692242", "value": "bedb96d8a71f9004abf64308e680fcb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295530, "uuid": "e1270f80-1899-46a8-aef7-a20bed3073f5", "value": "98304:n64KjpOZP7Gf8oC4felvJoch5wET9ItRmeFa6vcuEDAm:nBKlSPaMlxocM8+tE6kuEMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295530, "uuid": "fb75a5b5-ad08-48df-abd4-8b1e95176182", "value": 4505392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295530, "uuid": "69151d13-79d9-4adf-905c-2da86342289a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295530, "uuid": "758cd7d2-f285-47b9-a69e-501a56e2e181", "value": "858bb0a3b4fa6a54586402e3ee117076", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d537c8-f353-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712325247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "5cf5dd41-b1c9-4b41-9716-390ab7021473", "comment": "Malware payload (RiseProStealer)", "value": "558e1c2d15a5be8fca9e27844e5b1aea", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "7848e2d9-3563-4a2e-8fbd-bac2f6e01426", "comment": "Malware payload (RiseProStealer)", "value": "dc0c2c25bc5a983bffdadfe65e3e02e409bf9c5ee9dea1cda474429a2c33762b", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "6e37dd02-4679-4ac5-849c-5b918f12ec21", "comment": "Malware payload (RiseProStealer)", "value": "aa35f15af5dbad8fa15fca0593220972d6c1ac40", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712325247, "uuid": "324f4528-b679-4bed-bd2a-e75be290ab84", "comment": "Malware payload (RiseProStealer)", "value": "b4a36e590604ab851e731fd732c4e61765c8d0541e7b93f15a97bdb5e112249387b545eca749781b9ce7f4af47ce91c9", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "011997fa-c7b5-4162-af0f-c86d058f88f7", "value": "T150558D71B402D037E1A101F5A67E9BA611ADBA3017AB08D7B7C05E7D94F19C36236F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "f89dc371-dabb-48ce-929f-a3918864f53a", "value": "25c8ae30cd1820a1b5b2591280c2ac98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "b670fad6-8fdf-41de-9f0a-98152b2fcb8a", "value": "24576:MF9uwNfSKYFODIbxDtU9jyuSmsLNvwqsbQJWBMFbSFv/XsTRY09W54KycnnC3:qgKal12UpkbQJW2FbSFXXsTt9W54Kycm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712325247, "uuid": "8b898c42-941a-4b90-b6cf-e2f3dc42d3d7", "value": 1315328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712325247, "uuid": "e38e2b4d-e76c-4eb6-9ba1-a39ebde9fdf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712325247, "uuid": "b0917308-95d6-47e7-98ee-3e78ba5c5b68", "value": "1712325246bbbf6f1de2af242e599680d3f96095835a7a7584ff1f1f967e4c2d3f319cbbe6606.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d5a1c5-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335070, "uuid": "35c5774a-02c2-44ee-8611-f7b32a824668", "comment": "Malware payload (Gafgyt)", "value": "8da59994df48e19fc40b98c4d2911d55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335070, "uuid": "c762311b-754a-4f40-9e48-6a5830a03cd2", "comment": "Malware payload (Gafgyt)", "value": "dc77aad4fb65c2fd261dfa46d80cd636ca9511f83f08a1a047291dd11f9aa7a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335070, "uuid": "a85f527a-cdf9-441e-8a7f-79f3127ccaba", "comment": "Malware payload (Gafgyt)", "value": "22d109fb20d14b7d8315e190c7b6db84df24e80f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335070, "uuid": "51d2e5e8-1110-4ec5-9a88-a3172727c9e1", "comment": "Malware payload (Gafgyt)", "value": "f04e0bba494685111dc9d4fc5baeaa9245d7802e5ab2f71af992d14f8c10bcc3dbe48c54c90cc252caaa494cafaaa0c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335070, "uuid": "8f7b214f-7119-407e-bb85-2e4e2f14f0fa", "value": "T1D8833AC1E642CAB3C8430BB60697966A0631FD3B4E1A9F49F31C7DF4AF224D87216756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335070, "uuid": "66cbd584-8bfa-4108-b717-ffda962251dd", "value": "1536:B5WKd4df4WaM6KwNHXyzgiADiN7oSHOd1VDAIPhxxTxDKQ7P:B5mddx6KwNHizE2N7VHsVDjPhxxlDKQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335070, "uuid": "4733468f-1b2a-4ebc-bfcf-43b99de10ca6", "value": 84204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335070, "uuid": "539547b3-ee00-4396-81b1-557ebf5ba019", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335070, "uuid": "3b3dec1c-4fc5-4b8d-a107-ecdf1cbc1fd0", "value": "8da59994df48e19fc40b98c4d2911d55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35261ff5-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344246, "uuid": "994d8002-12cb-43d8-9eb8-006a3bd40006", "comment": "Malware payload", "value": "eb05e6c9605f07bd1273cae32a63e651", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344246, "uuid": "8ec0b657-faa3-41ac-b3a9-edc271e1d495", "comment": "Malware payload", "value": "dcfa407d3bdc09aadf1641835ad17947cc73b80d06373bc929fe3d3d759dabb6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344246, "uuid": "13b84dc9-e0b4-49bb-9f92-75bb4847e3d7", "comment": "Malware payload", "value": "e4501f6e52f156bb7abdfde445ea8150f6b5b70c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344246, "uuid": "db0324d9-3683-4b25-b05b-89141504420d", "comment": "Malware payload", "value": "81756b35ad5006374b711bac946a44ed7d93b0a64a6b24d9aae6eaf19afb7311edb333429d09a6abbca4aa77cf149797", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344246, "uuid": "2b992ebf-f5b3-4f01-b14e-b6cdc50c95d6", "value": "T1C785F541609DCC32D42F0471A8686E7B55A9AC257BE005F7E2C43D29BBFB382EF35616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344246, "uuid": "b5553c77-07c9-41d3-8db8-966d91c8bb6f", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344246, "uuid": "22904335-e87c-426d-b12e-b5ea90f87157", "value": "6144:k9WN/ycwcZIp5rW65DyH5pIWgIWkAOUs70ha2xcU2mZK6K8p:vIcKp5P+t+s7R2xcU2EK6Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344246, "uuid": "de86e591-a4ca-46bf-aee9-28c0c9f610ca", "value": 1852576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344246, "uuid": "4571b8f1-1b11-4808-a849-b60fa46d99b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344246, "uuid": "04213754-896b-4228-a11f-885cba96fcc8", "value": "dcfa407d3bdc09aadf1641835ad17947cc73b80d06373bc929fe3d3d759dabb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1132e4d-f342-11ee-a120-42010a9c002e", "comment": "Malware payload (ModiLoader)", "timestamp": 1712317933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317933, "uuid": "2eaa9053-fca6-4abf-87f4-66f9f6800407", "comment": "Malware payload (ModiLoader)", "value": "b43bf728fa41d8615d035785a84a0381", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317933, "uuid": "9ea3895c-04bf-47eb-aeb5-c1315a10784c", "comment": "Malware payload (ModiLoader)", "value": "dd1dfdb0cdacb011fb6033a31a6f7f634a380d071da2ac2f6253a1e896cdbc1b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317933, "uuid": "d8908fd8-c29f-4045-9b6e-ecc0c65ca460", "comment": "Malware payload (ModiLoader)", "value": "c25d44d9043767e751f2a1390eb578e618b0d797", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317933, "uuid": "f4adb42c-4673-4db3-bd37-9097b733380a", "comment": "Malware payload (ModiLoader)", "value": "f3885ac81321f35f3f8e5c3ef0a6215b0143f1f6e526ae734fb6203c1e0e7ab046e497b91130e45ab60c6936bf1eaf37", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317933, "uuid": "b8a60950-1045-4a31-bd1c-fd15ec889623", "value": "T18B1673D33FAE068EE706F35B574FE5C54A27CC2D0BC2AE9441C62589443A74B29F099B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317933, "uuid": "70cc421f-679e-46b5-b83e-b21ed9380822", "value": "49152:g5Qu3q1bUt56zJ6PGXlYQe0HvNwqX4qle:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712317933, "uuid": "4751d1d9-489b-4e8b-ad7a-a89f7f71ca53", "value": 4154434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712317933, "uuid": "68beb59c-871e-4711-8b6f-0107a26055d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317933, "uuid": "e8290ace-51a3-4e83-aade-e35615802f44", "value": "PO.2308152006128.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af71297a-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344022, "uuid": "bc80bc50-b374-4b2b-92f0-274f5b940290", "comment": "Malware payload (Socks5Systemz)", "value": "773ee7c6340a3b637f1d469c10753895", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344022, "uuid": "21cde341-312a-448a-a86f-5b1a013ec051", "comment": "Malware payload (Socks5Systemz)", "value": "de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344022, "uuid": "b89f8820-d639-40fb-965b-f9a342d21891", "comment": "Malware payload (Socks5Systemz)", "value": "640999f3973a354e6bd99ce13ce5936802644679", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344022, "uuid": "079feed2-976d-4b64-8c80-0ec810a5ca2f", "comment": "Malware payload (Socks5Systemz)", "value": "6d3628ca2ab70d99f2a7720ca5c0e2b5bc54c83b70487611318b73816234f5479b18cd068de23004eac92400a905218c", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344022, "uuid": "e22a2896-e975-4692-bb12-0e7a631b782e", "value": "T127E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D9789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344022, "uuid": "a44b9064-8205-483f-81eb-58f37e99744c", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344022, "uuid": "6e00405c-789b-4259-8e35-974173a8fb6e", "value": "12288:HjsgiZdvAeRwz+agHL50cCJeBqWycvpWwXkmvRKLiTOksRpFHDIkGiIjcBDQg5Ey:DsgwdvAKrr50cCJeBqW/vpfXkmvR+iT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344022, "uuid": "e27127c5-4c73-4bbb-94d3-c1b457512f1a", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344022, "uuid": "6069e371-35db-400b-a2c4-0b85c5cac66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344022, "uuid": "78ba2881-1fd4-4fc3-9887-204ba2622049", "value": "de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dbbdb1-f33d-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712315761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315761, "uuid": "14bd02e0-7d99-41fc-bb95-2793552d4ed1", "comment": "Malware payload (Rhadamanthys)", "value": "a344b567076691b5cd838512c99bc884", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315761, "uuid": "4e2d42aa-35f5-4617-9d1c-b4ddc51a20b6", "comment": "Malware payload (Rhadamanthys)", "value": "decbd662ecab295cb2c060232a6de8218843d671b7cb628aaf769ba4bcdf126f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315761, "uuid": "2d25c7d2-7bb3-423d-b47d-c402cf2297f6", "comment": "Malware payload (Rhadamanthys)", "value": "0de4ad8f9f127c0c444bb7db4459d0977b1f6506", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315761, "uuid": "6098a2cf-7707-44f0-911c-91f7e4ae9c9b", "comment": "Malware payload (Rhadamanthys)", "value": "8e587ca044cafb0d40b34ea0b404e024a00532e2374bf6ed5311fbfe3c4e9555a0593eddfe4bc3a65ffefa7b8b6e6ca0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315761, "uuid": "6dfd8bc1-27fc-4c55-ab0a-5d7ec3a372bf", "value": "T1BA129E240EF873DFD1B75C7A67D972B12553DB1AA8DC82E4244181016223952B8FAEEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315761, "uuid": "9b3731c8-fb58-4ed2-949b-a59cbb189bda", "value": "192:8z5phm3MSBfQbxE4l2g9FWV4FBno2dzSkbP43O5yrf68g493f61hVNeXkI:u5fcMS5Qb6EouFB3dzBbw3Omf68Zp9XV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712315761, "uuid": "6c518bbd-bac5-4e57-bc7a-1ebff0917a71", "value": 9701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712315761, "uuid": "fba0fc5b-3744-404e-ad6e-ea93fdeefbde", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315761, "uuid": "fa10c7fd-2555-43b8-a2e3-b098547e8dc1", "value": "DOC692-692692.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7c8b50-f343-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712318007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318007, "uuid": "3c59fd50-207e-4fb8-ba5e-263646ae54c9", "comment": "Malware payload (Formbook)", "value": "92467b1d000c97fbdace25534278e295", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318007, "uuid": "1adb3588-881b-44d9-a883-339561029369", "comment": "Malware payload (Formbook)", "value": "df8a1a2a8dc57d2c75819ff2cc38d28b4047d688f0ed86f62bc391b3e9fa5ba1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318007, "uuid": "332c4a3e-71e2-4de8-b81e-7c0a8a0a7937", "comment": "Malware payload (Formbook)", "value": "e5aa5c46654b13115c46a0306bb419ca4b1df44a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712318007, "uuid": "524262b6-b16c-4322-97ad-a067358147db", "comment": "Malware payload (Formbook)", "value": "0a8dcee447efcc1460a85367c847faffe15e8f0c5e47068a12c7648bd4ac3b5951e1ea7ead256e676aaccde56fbd345b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318007, "uuid": "6b9421cf-c763-48fd-8624-fe95803eca5b", "value": "T1A736E8E339FD278617063F5B974FB5940A1FFD394BF26AE440C72588014A58B29A09EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318007, "uuid": "831a7aad-4ec9-4477-9b4e-77ddc6a63b82", "value": "49152:xezOW2/puR1S5LyWb55JBnZkRidEiXTqdiMTOciC1UMIr1u6zYDMJhlJ48pDug:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712318007, "uuid": "16fea3b5-c510-4981-8a9a-2b8a0157e2a7", "value": 4945728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712318007, "uuid": "52e0ad67-aeaf-43a7-ad66-55a108319711", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712318007, "uuid": "37db11f3-7ebe-485e-a1b6-82ae3aad8d73", "value": "CONFIRMATION ORDER1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf726df9-f37e-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712343619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343619, "uuid": "5856d2d3-230b-4974-ab10-92e5aa7bbd97", "comment": "Malware payload (RedLineStealer)", "value": "a16e53282562919f363a4a198e1235ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343619, "uuid": "3b464441-f66c-42f8-afc1-f3f786502016", "comment": "Malware payload (RedLineStealer)", "value": "e266e47b3217cf61995fefdf946e42222061614db9b3aa16318da5ca0eb73ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343619, "uuid": "bb234eb6-4749-4135-9975-8333df220979", "comment": "Malware payload (RedLineStealer)", "value": "384087d120bf0acfa6793747781029dfdeefc124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712343619, "uuid": "7cd7764c-e8fe-4db3-8a1b-ef2a810ac9bb", "comment": "Malware payload (RedLineStealer)", "value": "5b09307935f4a43a6b42f0ca57492afff9e30386ce30a4ce2330b1431748b7fb4dbeacb587f47e5d44a82d099ae241ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343619, "uuid": "6af7e6ad-559a-46f6-97c6-880c2938f752", "value": "T107463317FB56C5E2C2023B7BD4E3141443A9E880B62BDE4A294C73DE6DBB7A75C41607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343619, "uuid": "3ae0596d-204d-4247-a050-3e30a92ffbc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343619, "uuid": "facbe8c2-c19e-436b-a843-86ea719a407a", "value": "98304:pTdhh+XvhALVFBJZLg8ryMTNrg7CeXkLQA4xeuiLZ6MnxOAsl2+exWxUfT:pdWoVvJZLDK7Ce0L8QuFAslXeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712343619, "uuid": "3afd80ce-6328-4ecc-b909-003886b0f6aa", "value": 5507072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712343619, "uuid": "4ad81c13-f357-4689-b136-fad2991c36dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712343619, "uuid": "1eeb6a7e-a320-4e46-9de5-223052dfd892", "value": "a16e53282562919f363a4a198e1235ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3545787f-f33b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712314611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712314611, "uuid": "0bd18e13-432f-496f-9c41-3f23b58dc552", "comment": "Malware payload", "value": "d3a662c526964693ea76782c8ac88431", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712314611, "uuid": "bafdb7f5-6c92-4633-9fbd-27fb268eb70b", "comment": "Malware payload", "value": "e2865c5c5a1241163988bde5c9910f2b47b8485491a985f602d7ea85019d6dda", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712314611, "uuid": "54c49534-b5bf-47ce-8a32-3601fd8eeef7", "comment": "Malware payload", "value": "921e5ea881fd96947eca80692674e65bcd492081", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712314611, "uuid": "66b3d679-1901-4874-9533-c8e40925e2cb", "comment": "Malware payload", "value": "b2b1c9f2a98008752a3a2fe36b8b906517cdc1b054cb3f632a948c2572f7b63f0fe0bfa011a15cf9286bcaa5bdf3434c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712314611, "uuid": "c318e7ad-c7d1-4605-aead-d15efb75ca08", "value": "T125E19E7CDA60AB66E62449FA776C3376421C8EC5DDF4431B57C793C4AA27502B0AEF01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712314611, "uuid": "071c38fd-6c94-4580-9b68-bdb4209e6cb0", "value": "192:hmZ1NoED8/XBIItFIuXNapojXg7C0aVK/QLW/yI2BLJ:OzDaBhIudapkMCZVZLW/sLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712314611, "uuid": "0ff6feaa-b385-4915-9f72-ccfb3519236a", "value": 6983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712314611, "uuid": "17f0539f-4895-46ca-a6aa-daaea648bdcb", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712314611, "uuid": "8ff2b3ce-cc26-49cd-8ea3-370699105278", "value": "sample.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36230ad6-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344248, "uuid": "8c1d1575-a0fa-4d37-b24d-78d8a3064915", "comment": "Malware payload", "value": "b8685d3f8d71e36eaea4f90d68e7d826", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344248, "uuid": "746fe2dc-4c52-409c-b57d-0f512fdbfa38", "comment": "Malware payload", "value": "e38574e0d3c5d13be54931474871f59b53388eebfaae47c72d3602edff79f60a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344248, "uuid": "eb83ed09-77c5-44cd-9168-e83cf5b61feb", "comment": "Malware payload", "value": "467f7a5d85cb7b8844b6e9c4a9346d2e5ad7b462", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344248, "uuid": "35b27068-8e1c-43f9-84c9-d41042522e1c", "comment": "Malware payload", "value": "a303b6abefd3b872a80a4af0c02ec2d8361cc49eeae1d5bad84635783e4bbc27444cb92b62ea5651c7c6cd41c70e1171", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344248, "uuid": "5cf42f6a-3a90-4393-add4-bc0af5fcf01c", "value": "T17C741998FE5AB461E81FAD3CCCA2C465DFEA7C21FD209473B154F7688A706811A3493D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344248, "uuid": "155466a1-4cd9-4d7a-9406-3011dfa62100", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344248, "uuid": "33d76530-de44-4b64-90db-a343595b619d", "value": "3072:sr85C8tNDgti3RZJMp6z+XwBg+XwBy5fwU2WRnfUnVJteMRvyw:k9+gmzTBgTBVU2KnKXfJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344248, "uuid": "e7749f51-63d0-4aff-9ec2-56dfd65ba582", "value": 337776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344248, "uuid": "3b13491d-1a9b-42ae-976d-4f88e8847656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344248, "uuid": "aac3bded-9ff0-4dc8-bfe4-5276c49275cb", "value": "e38574e0d3c5d13be54931474871f59b53388eebfaae47c72d3602edff79f60a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398a41c6-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344254, "uuid": "2a14d391-d119-4ad3-b12b-1a8a97b37243", "comment": "Malware payload", "value": "0380a23d87eb12bca5e73882558245d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344254, "uuid": "f47bc576-5d88-4d6c-97e9-752eb9c40ac7", "comment": "Malware payload", "value": "e3aa21dc9ee707579e3037b0482ac4ef838b1c7364fddd76bb41f247707d04ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344254, "uuid": "833f1642-a6d5-4e07-8629-7bfae6def46d", "comment": "Malware payload", "value": "bb04d919836591d68240dbca7881c31f46cbb309", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344254, "uuid": "df433312-ed1a-4e55-bd2f-68f7af4466e1", "comment": "Malware payload", "value": "7281a6049419b51361f5dd70dde9c3c2a1856ef08fb3882873a717fb925d6ec788a5380109fbabe637cd04646f7979f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344254, "uuid": "79d47bfe-df08-4851-9561-2bcba89f655d", "value": "T1B236CF1D616422F5C16A8A30A5D75D0ADB72FD650730EBFB8750362D0E3A6D21B3AE33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344254, "uuid": "88e8a5d4-e933-4ee1-8caf-3daf52171327", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344254, "uuid": "1c0cee2b-deb3-4ffa-8d05-a10bbe200bc3", "value": "98304:ey2MmzwQjh/2ZCZWE7cRGo8sOgZT00a9CIL8Gbc4tGsqO3mH6b+kau47rT4Ph049:l2RwAh/iE7cRGo8sOgZo0aH4GbZtGsq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344254, "uuid": "fb71cae4-6bbb-44b5-adf6-f148ba13fe45", "value": 5337184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344254, "uuid": "628d922e-8a5b-48b3-810d-24f4d8cd3608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344254, "uuid": "753ea784-4f47-409b-94c5-45ab02cb01c6", "value": "e3aa21dc9ee707579e3037b0482ac4ef838b1c7364fddd76bb41f247707d04ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3218cde-f369-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712334579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334579, "uuid": "77532e37-9658-4086-a5e6-e244953a0b0c", "comment": "Malware payload (AgentTesla)", "value": "a704a47781612c6c01dc0c6e42a47a92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334579, "uuid": "825dcc60-ff4c-4375-a4a1-19e552679f92", "comment": "Malware payload (AgentTesla)", "value": "e5d2a19d86cc1ed1a2b79357b2d629ad018881b6a000d4c7244138affbbb3cea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334579, "uuid": "78c9c0d4-7fd9-44c4-b8e1-f40d54a335c7", "comment": "Malware payload (AgentTesla)", "value": "c4d715a196c7df1f43121f2688d8483856ce0023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712334579, "uuid": "a0a92400-5791-4a51-bf2e-4dfcc9cef4bf", "comment": "Malware payload (AgentTesla)", "value": "c3e4ef4c20e19f4456c7522c2835575593e0599a3f37966c210154e4945c1337f3d116ca2897f12c798343adea3ce75b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334579, "uuid": "3ca726ec-1c4c-4cf7-9fe8-6ec1e4a170f0", "value": "T15E0501A3D3965992FD1A277084334D5D2967BFB6BE70E06D241DF53227733C3180AA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334579, "uuid": "4f2bb575-380b-4f15-ae00-6986f2969810", "value": "12288:9j7Pym/NSsFF0LO3hQbIGOyT72tPKjLSH4QeQcImIkm+oKl:d76m1jmU8VORyjLSxe1Mkmhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712334579, "uuid": "3b68c01a-f325-41d5-8a55-bf305ca39d91", "value": 821360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712334579, "uuid": "cc27a57a-5e83-4216-b466-f255170f01d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712334579, "uuid": "167c1f92-9b71-4248-9b77-fe1d7673ca07", "value": "SecuriteInfo.com.Trojan.PackedNET.2787.11371.24231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24612665-f326-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712305563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305563, "uuid": "8f9ea234-8a0e-4418-a9ed-8111b418b321", "comment": "Malware payload", "value": "252fd67979a6e44c4b8371ba75c6c321", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305563, "uuid": "f6f6b279-bf13-4339-aed5-0cabe4f8ec57", "comment": "Malware payload", "value": "e7bc083730cda0106d491019ce3ab96423922cfd1953c4818fb7f71a9d8f04c9", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305563, "uuid": "dd9e7e54-f3ff-453d-851e-0d59681b155f", "comment": "Malware payload", "value": "297695e9b14c01f6ce0248292c06455d9df3ba77", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712305563, "uuid": "e742ff89-fc61-4fc3-87a2-3f6a0ce05a60", "comment": "Malware payload", "value": "a77186d9ac8673f88d578f96af6218c477e60f12d6a49358fd1a0024f182c7d390d6e2855be7dcef38e051c808d098e0", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305563, "uuid": "073d621f-bd73-4ce4-935d-f65b41b8130c", "value": "T158C433771637B68F0A733F735BB624CDE4B6ADE601D1E07B0B6C643605B02AF629011A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305563, "uuid": "83667f8e-c96f-4c52-854a-29a6261b2958", "value": "12288:/MptdDcKRXLMLQwxxEpzNHq4HoSNqI+E4O3zZYMv:atd4wQ5Wr7+E/3zZYMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712305563, "uuid": "b45e2b93-294b-4b67-94a4-7e00eb98d923", "value": 559848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712305563, "uuid": "2906c66e-1c6e-4843-8a64-18fff857f5c1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712305563, "uuid": "43315b5a-fd4b-41a4-9ba5-74b790f08a6c", "value": "Dokument-99373.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bf9dad-f30e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712295578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295578, "uuid": "a217eeb6-a442-430d-b79a-4a13447c6f09", "comment": "Malware payload", "value": "65025d2c4c683c3119cf240ce6a824d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295578, "uuid": "3e83c3c0-b84f-4537-9d08-b575d3e38a20", "comment": "Malware payload", "value": "e8f59d0a0b1bb607b1760c45afd1aecbdf4dec0eec50ffaa4b4435af482615a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295578, "uuid": "3859f53c-8a77-4f05-a00b-4667e90d682e", "comment": "Malware payload", "value": "d885294ff5772aeb4647b2a87f3083580cb10573", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712295578, "uuid": "5f683528-959d-4c51-a171-6a22ce7d7ef3", "comment": "Malware payload", "value": "830b1ac961453697992e272ed64db285cd1b71c99c93206cb3cb3d88d44c5eb1e13bae28b143a0a839c004a0fec10f92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295578, "uuid": "78281752-fcbb-4312-b590-8376b9109a2d", "value": "T19C268C05D4618062C2813073ED2EF7358B607E2D5BF642EFB6957CE76B709D23A79282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295578, "uuid": "a59ec059-d4f3-4270-a7b4-c5f50807324f", "value": "224f7c709bbe989ade2d7ede1bc05f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295578, "uuid": "84c1776a-1de3-4b2b-953b-f2481a5e3241", "value": "98304:RszKnK7RZKZk8AZ1ushgTsOTb1W5gmTKuCIUMPaUownZCICDQZ:RRZkB1kqgmFPaQCICDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712295578, "uuid": "86a048df-b080-49e4-81ad-0b9c2d44795b", "value": 4555088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712295578, "uuid": "a098177a-a659-4bda-9074-2d500247d108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712295578, "uuid": "8581b263-13a7-4c7c-b18d-80bd4a6b125c", "value": "iepdf32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e90cb8-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712321030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321030, "uuid": "e42d314c-4891-4e3e-9751-1bc844bffa61", "comment": "Malware payload (Mirai)", "value": "339eacff54e81820e266a5fcd3ec5b49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321030, "uuid": "c83c8fe7-06b5-45b4-a3a4-e94ad49c0754", "comment": "Malware payload (Mirai)", "value": "e961b5c496c3333751464b14d5a82312887efefd1c2f0f3a245fdbbb12c7b8d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321030, "uuid": "5727676a-b0c0-4d66-8bf6-6bb1a2449235", "comment": "Malware payload (Mirai)", "value": "1509be6e3f25aab50c4cb7b73f53c540627a6d49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712321030, "uuid": "b1be32bc-33a6-49eb-9a1f-838f39045e06", "comment": "Malware payload (Mirai)", "value": "0de20a530b410dff7ddd0d7998698f1c8b82920af906c24264e5446ab6610c20c98ce4c6407ff9442e251aaf1560c263", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321030, "uuid": "f92b2137-26e3-43ec-aeee-7df846df3ed0", "value": "T1BF33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321030, "uuid": "f6be3f81-3b04-482c-bb49-c5e2eb5f79a1", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGw:r/hqaJMeteqK806MHdkfQX6HuCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712321030, "uuid": "be53157a-bcea-48ee-9782-df0cb347e791", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712321030, "uuid": "c8188331-ee25-4169-bc5b-9e64e87fc067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712321030, "uuid": "d080587f-2cd8-4082-8b4d-12a8b4a01947", "value": "339eacff54e81820e266a5fcd3ec5b49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e56b404-f303-11ee-a120-42010a9c002e", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1712290655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712290655, "uuid": "73fc068e-8593-4938-9a90-10a25620c36e", "comment": "Malware payload (RemoteManipulator)", "value": "f429810f03b2e5472f51f22dbbf6f165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712290655, "uuid": "4068f29a-ee2c-4ebf-9bd6-7decfe3c15cc", "comment": "Malware payload (RemoteManipulator)", "value": "e99121de906a1fb921f1f4388fcffd3424000340a49d5d4f45f3aa912f1eeb55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712290655, "uuid": "e8b6059e-e5d7-468e-8020-bb23abcb8741", "comment": "Malware payload (RemoteManipulator)", "value": "361572f7729f71af2d77c2db0d352d6eb3b11cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712290655, "uuid": "facaa75c-0234-4aea-9188-004981b0ad2b", "comment": "Malware payload (RemoteManipulator)", "value": "04fe4fd00b1a9e4ec89ef74584269735104ab0395c95c3fa7b347004cedcae1a8990c789562d8595a0f7cc676daae6e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712290655, "uuid": "6acb3d37-8371-4415-9ac7-b2e1b25cfa1a", "value": "T1E6073357F7E24424D8FA8BBA0DFD1B10077BBC9916035B8C03A5F1296DA63816CA57CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712290655, "uuid": "37bff6d4-7f0c-4d65-a78c-6471620877d3", "value": "51d1f6a548cbe091a440204f9bfeb14e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712290655, "uuid": "212d70b0-b47d-4e75-9a75-c5d257422843", "value": "393216:BMlU2nBTLv7A1J9mA0Z8h6B3LhmNm4S0JWeG7PX:ByU2nBTLv7A1OAO7B3FcfSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712290655, "uuid": "031cd63b-3abd-4c77-a1b5-3401b3c024f0", "value": 18140472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712290655, "uuid": "50e73da7-2b89-4a3e-8a8a-95358b8c3671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712290655, "uuid": "8c05e62d-31c4-4dcf-b18b-ab001f8c7f2f", "value": "SecuriteInfo.com.Unwanted-Program.00578aef1.32765.4895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fb5d32-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286608, "uuid": "d1bc2197-705a-495d-96d0-16e28cd45e5a", "comment": "Malware payload (Gafgyt)", "value": "7701f9c6b32417cf6baf79f38d33fa2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286608, "uuid": "39d63419-f00f-48bb-9cb8-fa14d8b81af5", "comment": "Malware payload (Gafgyt)", "value": "ea09279a019ec45255ff5de1f10808d8eaa17c5ad9ce8ffc57cc90c44791927c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286608, "uuid": "b4960f51-039d-40ea-aadb-3c3b8db8cdc5", "comment": "Malware payload (Gafgyt)", "value": "2f2f610d898d5f4c5ccc3494b8767b058fd9f1f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286608, "uuid": "9ff1a116-7a53-45f2-9c91-45a993fcdc02", "comment": "Malware payload (Gafgyt)", "value": "39bb3b3e5e860d1af9405450ce2bda0ad1aaf708c7955d2783fc3456186341631f64c87204d6d96495f0fea4897cb795", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286608, "uuid": "df35fdbf-afdd-4a7a-b018-a2172e0f2613", "value": "T1B9D34A37E4518F73C0836BB11C6AAD310F1595D31BAF268A267857F08B4F5CA744EEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286608, "uuid": "89ffe3fd-158c-4919-91b6-8d5051ab4b8e", "value": "3072:B1E8x83QHjqmgjHmhQXnp5hZttT5I7mAK0qW6MyoQ6:/E8q3QeXrHXnp5hZvT5SmAK0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286608, "uuid": "25262ebb-8e70-4df4-98fa-ad88759191cb", "value": 140225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286608, "uuid": "48df4cbf-cbc1-4a59-b29a-8441362c10c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286608, "uuid": "c7930c05-aca9-4928-9c76-a605c4ba0a2c", "value": "7701f9c6b32417cf6baf79f38d33fa2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341d4ca4-f34d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712322340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322340, "uuid": "d77f2247-b752-4998-83ca-df098984db9e", "comment": "Malware payload (AgentTesla)", "value": "8ae7aed9e002e195c6c93e949800ac01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322340, "uuid": "b85592c2-77da-42d9-a302-be816fd481ed", "comment": "Malware payload (AgentTesla)", "value": "eb340b02a8183e4bbe0b709097560c1018e33827e81765429dad3a0e11c1ec9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322340, "uuid": "7cf79a4d-b550-4c17-ab0e-8201d0e6b0af", "comment": "Malware payload (AgentTesla)", "value": "4bb2ce52b24ca9b8f394e332d04eb3272ea35514", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712322340, "uuid": "8c0c3058-3475-48f9-9519-c25a456827b2", "comment": "Malware payload (AgentTesla)", "value": "3d54c72b3aec789f8994c056896f9d8693accc2511c537b1d86ac46063629a1774b09701dab4e56c7c0bd9c25ce62b40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322340, "uuid": "95f7e1e8-3d69-4e93-a3d4-c57b3274145d", "value": "T19935AE027392C03AFFAB92B35B69B20156B97D254133852F13D82D79BE701B1673E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322340, "uuid": "e4e4a544-a104-4d1b-9b0e-d6d4e5142645", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322340, "uuid": "34183355-62be-4da7-9640-c675c747b3a3", "value": "24576:NAHnh+eWsN3skA4RV1Hom2KXcmtce4VXqU7WK:sh+ZkldoPKsacpxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712322340, "uuid": "c1c8f612-53f9-4e30-b5d6-d754292f738c", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712322340, "uuid": "b7d39f41-2e69-4f52-9b6a-3359c448cff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712322340, "uuid": "e2c1dfc4-df20-4bdd-b51e-84b0f40b0570", "value": "eb340b02a8183e4bbe0b709097560c1018e33827e81765429dad3a0e11c1ec9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf28df4-f33d-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1712315753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315753, "uuid": "adecede4-2fc1-4725-b2b1-01539faa452f", "comment": "Malware payload (Rhadamanthys)", "value": "dec2ee189e7b882fd5059db29646d4c2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315753, "uuid": "6dd42499-e443-4b04-9b83-33955411ee2c", "comment": "Malware payload (Rhadamanthys)", "value": "eb64ad37414cc8937627a687e9c37e485053140632e4977c19b79180adb080e0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315753, "uuid": "ac96ce8a-948d-46ed-b0ad-60a1d2d53c96", "comment": "Malware payload (Rhadamanthys)", "value": "d7ae2f7991fecf19f24c37c3b8034c98f1b3f12f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712315753, "uuid": "7c9339ee-e8ba-4015-8c98-55cf9c39f3d0", "comment": "Malware payload (Rhadamanthys)", "value": "651e0db06e60a45835e876831fed1074156612dc1fd471aa40a5631d1ba09a7d1135b2397271d77040df93858cc0ecb6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315753, "uuid": "0f57d416-887f-48bd-ba9c-c0e4967492a3", "value": "T15B22A0006FC15648D5635738BBE932E08F2BEA65A6C34B7C3185B72067231C94841B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315753, "uuid": "d406a3cf-d798-4cca-9519-88d0ac68ea65", "value": "192:8z5z9h43MSBfSW7rD6N+7yURE5sJloSR6wVlZevESj0s+l2UeU/poOEDhK9Mtd:u53+MS5hrDqLiJ/R6kn0n2kU/p0DhHtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712315753, "uuid": "29d0eedc-8063-495f-9baa-1803ef8ec032", "value": 10777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712315753, "uuid": "53c41ad9-5338-4d5b-afe4-75ef2c8765c4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712315753, "uuid": "f9b9a24e-6342-4de2-9674-dd97ae1daa8b", "value": "DOC5723-57235723.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b58c41-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335119, "uuid": "d33effc7-32d2-484c-b16d-9bca7257c76b", "comment": "Malware payload (Gafgyt)", "value": "bd4fc72f80864ebb891a20bfb7a1ec4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335119, "uuid": "3e5ac4cc-636f-4d41-bf55-b75237be588c", "comment": "Malware payload (Gafgyt)", "value": "ebd61334e09258c632efcfc2826d06c6f035237042c4c676e29b1b2933cb544f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335119, "uuid": "9e80cf83-6917-4646-b4c9-9c438ddbc137", "comment": "Malware payload (Gafgyt)", "value": "dcc6ad04e97b3070a73c44e9b0c4a6489fce456d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335119, "uuid": "4d67c445-0ba9-4d59-b128-b8358928fa74", "comment": "Malware payload (Gafgyt)", "value": "e2289b17bb0a69e593d048630d48ab1dd52ee1150fa28a556650c82c14632882019a713387c1341359d15ab40f81e744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335119, "uuid": "f8e1b0ea-2c2f-4e38-aebb-db68a4bc480d", "value": "T1E2B319277B270E23C0CA147111E30332A7B5D75938BA5797BAD02DAC6F1BAC439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335119, "uuid": "3a47624c-b5d6-4749-9ee7-e384cdb27fc3", "value": "1536:QYtL21tDSNM51qtZXoyVIMLQiQ7Dc1khR0TWNKr5ux:QD1pSN88LIMLQ5Dc1khR06NKlux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335119, "uuid": "100f27eb-566c-45b4-8043-b9a990fb849e", "value": 110067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335119, "uuid": "492bd9ec-cc53-47f8-b8e2-1aba0d4f3181", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335119, "uuid": "df0d7e7e-b72a-40a7-90f0-b32005815c53", "value": "bd4fc72f80864ebb891a20bfb7a1ec4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8220bc5-f345-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712319179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319179, "uuid": "5d6df9b9-c0ad-45ab-b922-213c12d21985", "comment": "Malware payload (AgentTesla)", "value": "9ab0e40a22d40514428c5fdb4b4e1f72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319179, "uuid": "e44ea3ff-0687-4f41-abcc-8d259512b87e", "comment": "Malware payload (AgentTesla)", "value": "ebfc63817af46ecb8d6356a8d4ec200240d3c37b650870e7093389a354707877", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319179, "uuid": "60902f7a-0075-4e40-b459-7fbc0b9a0cf2", "comment": "Malware payload (AgentTesla)", "value": "2f0e351bc52bfce2029ae5accf8751277c791f99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319179, "uuid": "744c993f-c472-427c-a676-f3966ba7ebe8", "comment": "Malware payload (AgentTesla)", "value": "d1cb4c46cdb93981878711f29016ca086c40e5f251c99f5e8e445b1d39158fc07bff396ffd91ddcb54968416b61e27b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319179, "uuid": "3725c1d9-1887-4564-b1ac-7e0bfe56f346", "value": "T1F845AE1273D2C07AFFAB92B35B59B2015AB97D250133852F13D82D79BA701B1633E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319179, "uuid": "244b6986-6f24-4ef1-81be-3e221c8e1104", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319179, "uuid": "bcb580c5-9f89-4d0b-956d-6b9a97d94a46", "value": "24576:tAHnh+eWsN3skA4RV1Hom2KXcmtcT4uWx9W4mZ:Mh+ZkldoPKsacc/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712319179, "uuid": "7633833e-7b23-4444-9147-aaee776c1d55", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712319179, "uuid": "f489600b-ebe3-4b64-aa24-ba725c065b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319179, "uuid": "154a840d-8e27-4f7b-9ed3-14b013d6e955", "value": "ebfc63817af46ecb8d6356a8d4ec200240d3c37b650870e7093389a354707877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7e8e3e-f347-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1712319854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319854, "uuid": "dde8107f-cfaa-44ce-9dfc-18ab1dbfd057", "comment": "Malware payload (Smoke Loader)", "value": "a3ff800ba91a6a567f854274dcdde460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319854, "uuid": "af02cf96-ca13-4fea-9707-8949881b9a73", "comment": "Malware payload (Smoke Loader)", "value": "edfdb10a739d1951f076ba691d2328a51d7187e93f7c26197c471a30cd6d07f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319854, "uuid": "e8437a3b-2b17-4cd4-8700-005c4662127f", "comment": "Malware payload (Smoke Loader)", "value": "d90e34d52d909ea2bb02956d83072dfb44d6214b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712319854, "uuid": "31f3eb5f-8ec3-4b3f-9af0-7cb3f71eeff8", "comment": "Malware payload (Smoke Loader)", "value": "b7162a426a70735b1b304e36af8c9f53116bf6b9df0573beead7bcbee617d9d5d9d433c6f6cf81386f757482a699e280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319854, "uuid": "2d792df9-a9b2-49e7-99de-334ee8b09f02", "value": "T15744BE0279E2D471FAB38B311D708A54163FFCB35A718A5F33C8261E68B16C15A76B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319854, "uuid": "4f1416d5-7217-401f-a935-018451ff67c1", "value": "989804a60ff39e5f1db724908b106936", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319854, "uuid": "620cd2b9-fc26-46ff-8e99-3cf41bcc983f", "value": "3072:1jIqoLA434t8a+bf/X2oxoDVd7s8xHQSeaBJDK0vxXKVurs6GD2l/IpAKIA:1jvt8aKX2Vd7bHFeaBlvlzs6V/IyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712319854, "uuid": "a9e971fc-3d54-4afd-9995-c56d69f420cc", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712319854, "uuid": "e7a9e57a-8cbf-4d0a-965d-ba5dd7b559e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712319854, "uuid": "b1fd10a5-6c66-4bf7-b69f-2c588604a9c1", "value": "edfdb10a739d1951f076ba691d2328a51d7187e93f7c26197c471a30cd6d07f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffa5ac2-f3a4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712359887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712359887, "uuid": "7f46f448-3e5d-4ebd-8758-9ef291b76f41", "comment": "Malware payload", "value": "3bcf963206e745b9d9f84405734db6d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712359887, "uuid": "124b322e-f64b-45d5-b7e9-5e7656da8dcc", "comment": "Malware payload", "value": "ef33320fa6791bc877bcc41b5142568f85fcb028ac45269688e6b1a049079e9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712359887, "uuid": "9dc6b8b7-ae15-4305-b18f-eea9de443cae", "comment": "Malware payload", "value": "66670638aa36a75605c48586c1d8c1a5f5dab1f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712359887, "uuid": "89b80f01-726f-40df-9cce-93cc68b60b93", "comment": "Malware payload", "value": "62e36df0007678b2980c80b18a4422ec62f62cc52afaeb4582a0a650d39f980b238590554a314794b43c2cc53ab2b3a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712359887, "uuid": "023ecb6d-4421-4f08-a4da-8c55a16ce160", "value": "T1A2E75A243AEA501AF173AF798AE4F9B6996FBE333B02545910D02F473633981DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712359887, "uuid": "055b4219-68d3-4d32-9ab9-e91f8e230b57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712359887, "uuid": "6cc9783b-9494-43cd-aeb8-c743f6f57178", "value": "6144:+tN64GZbsVEroX2n7YaImzWxsTwMt4PewPON5zRIrldF:EA4GVsVErW2n7YAzWxmwEoBCzR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712359887, "uuid": "f824e632-f68e-4bf4-b557-36b18c49d4d2", "value": 66096256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712359887, "uuid": "9ce7301d-c91d-4b74-a59e-19cd8db9d1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712359887, "uuid": "56e90f7a-abee-4d0c-a012-2816cd6f85dd", "value": "AdobePS[CRACKED].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e4318b-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286643, "uuid": "120dae1a-565a-4ddf-944c-e09d84a32284", "comment": "Malware payload (Gafgyt)", "value": "130b135d69f50e96400719471911ed0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286643, "uuid": "6149da3f-5b83-4367-b6bf-17f989a92df4", "comment": "Malware payload (Gafgyt)", "value": "f0f8226186a851be280eef4bffe84ce4707961e1b57b908ed8c7aaf88d40d5a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286643, "uuid": "1d285183-057d-4c5e-981d-5643eed66dbc", "comment": "Malware payload (Gafgyt)", "value": "14e0ee026f5371b030354afb76b20b78b5765bb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286643, "uuid": "6f7b6424-00f1-40b2-8666-1a0533a465cd", "comment": "Malware payload (Gafgyt)", "value": "a2ddc40ec4c4e23df09845d1da771a36cbd0d94056d11e07720d84fecf162546b85a4c6ce880fdd2f821aabf94033ac4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286643, "uuid": "f0bc14d3-557d-4550-8007-cc4e599f8f6b", "value": "T111D3E876F401DFA6F00B96B104D78F216E30ABE30B9225167366356B9EB31D63C63E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286643, "uuid": "4cae1f8b-9ada-4b43-9abe-ebcc94dbc448", "value": "3072:VLAkBYJjsod+AswTuyDXrGSrQ/MyQ1IJ3STgEmzj0qDJNYyoPe:VZoxTuyDXr7yQSJ3STgEmzj0qDJNYyoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286643, "uuid": "251b804a-c65f-43be-8540-7d9ade18b81b", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286643, "uuid": "cd89d6a6-e946-449c-bfad-97b59d9ec18f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286643, "uuid": "7a68c6f0-fbb2-4fb7-a58c-8e77cb53460f", "value": "130b135d69f50e96400719471911ed0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5f47fa-f342-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkCloud)", "timestamp": 1712317740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317740, "uuid": "09642842-2586-4b1a-a411-95c48aeea89a", "comment": "Malware payload (DarkCloud)", "value": "e6859111b51782c782f63f54b6bd519b", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317740, "uuid": "6c36f06d-3e53-41eb-ae02-9621068352b7", "comment": "Malware payload (DarkCloud)", "value": "f1101d43abcac048c04b315cf7346b17451f4e8e040804c0d401edf4fd0bdefc", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317740, "uuid": "182e11fa-4c34-45c2-b01f-f74ba99fb582", "comment": "Malware payload (DarkCloud)", "value": "58c615408ad90894c8ffd710152307d1bac10e99", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317740, "uuid": "85662418-365e-4025-b89d-59199efb9640", "comment": "Malware payload (DarkCloud)", "value": "b8cfac799cc28ae5ecc810aaa1161e521e17b36a8754a28d7fd86ae59fe42436674c14adb18348610f8cdcc58f0255d8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317740, "uuid": "0373ac70-7c5c-4381-a60d-69fb729838ad", "value": "T15D55D0027381C022FF9B96334F56F6514BBD79260123A62F13981DBABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317740, "uuid": "a929e5f6-7bee-4fb8-8674-bf92412d279b", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317740, "uuid": "6595c13d-09e6-48b1-9f34-83b37c1c9ec3", "value": "24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8axUoO9SV3o+0tMzhg1K0sgACk2w5UsZ:aTvC/MTQYxsWR7axUoO9SV3JAM1mLDru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712317740, "uuid": "e62ed9f0-26c6-44c0-8c01-02a247353b0b", "value": 1394176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712317740, "uuid": "f1a34cc9-76bf-4559-879c-690394db8025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317740, "uuid": "f97e1718-706c-4f60-9c8a-beee02dfe22a", "value": "f1101d43abcac048c04b315cf7346b17451f4e8e040804c0d401edf4fd0bdefc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09fd257-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344024, "uuid": "a465ca17-bf87-4564-8629-41bbb5da9eb0", "comment": "Malware payload (Socks5Systemz)", "value": "6238dafe5e6bbc23835504143fa9dd78", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344024, "uuid": "b2c58f4d-369b-49cf-b4d5-6a40aecd2d97", "comment": "Malware payload (Socks5Systemz)", "value": "f202b475e7b144f77925952bb5ceab1085f1e95dc03afc6501d8635cbf7bb6bb", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344024, "uuid": "e8904442-9db8-46d2-b5e8-c9834494589d", "comment": "Malware payload (Socks5Systemz)", "value": "af75f5d6250f6a1c0712a531bde37da1d827ef6e", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344024, "uuid": "8d18e856-73ae-4563-9ec1-a80e400e5e0a", "comment": "Malware payload (Socks5Systemz)", "value": "2004ea859e821b07450184585a06fa5ddcb96115188229bfb65a5e814e5f771755a04405c488d9eaa1af4e0fd33a48b5", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344024, "uuid": "883201a7-a7d8-4d45-8e99-7f553d04f7f1", "value": "T175E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344024, "uuid": "e1c7860d-4a4f-4ddd-9cab-afed91c73c06", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344024, "uuid": "c7cd28d9-c434-4dd9-b9e8-3b9f199960ab", "value": "12288:HjsgiZdvAeRw3+akHp50cCNbBqArcvpWwBpmlRKLiTOkYRpSHO+k7iIjcBDQg5Ea:DsgwdvAO/J50cCNbBqAAvpfBpmlR+iT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344024, "uuid": "8bb188b0-9f9f-4b25-942e-34bb961af6e2", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344024, "uuid": "09852dbd-79d4-4761-89d3-cf4d994ddb08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344024, "uuid": "1725e175-f089-4bd2-a42d-51ef8d1f24df", "value": "f202b475e7b144f77925952bb5ceab1085f1e95dc03afc6501d8635cbf7bb6bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5410ef21-f341-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712317240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317240, "uuid": "058e813c-966c-48e8-bb64-0278513632f8", "comment": "Malware payload (RemcosRAT)", "value": "cafb43c9227c12d667df390b49f0055b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317240, "uuid": "5003a2c8-828b-4929-87a6-f85cfa032428", "comment": "Malware payload (RemcosRAT)", "value": "f31a1a4253e9c3ba4ca22968b9f6f805984346464e10910bb8c3dfd84b028558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317240, "uuid": "2cd3fd06-d179-47e7-b878-e56e0aa766dd", "comment": "Malware payload (RemcosRAT)", "value": "fdfb4d5ef58f1571abf9c58a5aa653b6c17db758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712317240, "uuid": "fe9cb1e7-06be-4a71-be35-ef5f687919b2", "comment": "Malware payload (RemcosRAT)", "value": "5b11b424af584afdd4e9d45e2f8f6334421e1417c1af657594d03525ef96cc4fb6b8b2cf1e3e5f1943033c326d1fce9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317240, "uuid": "61e23bf7-ca23-4cc9-bf2d-1f72fa68b4b1", "value": "T14665D00233D1C062FFAB91734F5AF6115ABC69260123E62F13A81D7ABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317240, "uuid": "c4093e06-abe7-48b2-87c8-f4bebef53804", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317240, "uuid": "d68b5675-aa75-4548-b9c0-c1cbbcc2c0e8", "value": "24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8aeBTNlITfqKm/H5DwIn7hWiQGbSRTw:uTvC/MTQYxsWR7aeBT3SYHSYbSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712317240, "uuid": "ee02bb2c-180d-4bcd-8533-5bb675382758", "value": 1458688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712317240, "uuid": "7fe66abe-b4db-4aa8-a8da-33045100b29d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712317240, "uuid": "2b0b6685-969c-42d5-b6a4-3e800eaf9213", "value": "f31a1a4253e9c3ba4ca22968b9f6f805984346464e10910bb8c3dfd84b028558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11585455-f34a-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712320993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320993, "uuid": "ec18bd51-83f9-411a-a7da-f8f9478b744c", "comment": "Malware payload (Mirai)", "value": "b0efae4b4bbfd1f62b39d5fe7e8432cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320993, "uuid": "f9153447-b00b-4085-8a5e-29cfef765702", "comment": "Malware payload (Mirai)", "value": "f34704b2100ba629880d28b7c38bfb3d7359e79687d53158b9e7471dca6eee53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320993, "uuid": "266c6ad7-f1aa-4d79-898f-8862da3289a4", "comment": "Malware payload (Mirai)", "value": "0c6eaa13828f417f2f7114b1650a354dc8f7b51a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712320993, "uuid": "9e466a1e-5611-4c72-aa9c-59b700bfe211", "comment": "Malware payload (Mirai)", "value": "0ede197e5982d3d08bb1e2cdd4702fc7fd2a6587ce3a056b4ea4d424587f381463c5f5e6a3753948f7d818d86a96f259", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320993, "uuid": "ce6b84ca-8aa5-4f40-a63d-1410dbd2b7a8", "value": "T1D2A2D028E345AEF4DFAF9CA453C1D3C277E943C6678AC8F240EEAF016506042B789D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320993, "uuid": "52e826c2-0bea-4940-a470-2ce2ce8005c5", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5V/DM4uVcqgw05VxJuY:9RxsSVsMD6xiJJE5zRWND44uVcqgw09P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712320993, "uuid": "8dd96372-861e-439f-aab9-ef3fa9b2d6d8", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712320993, "uuid": "d9d931b4-d884-4ccb-beac-2d7089a61871", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712320993, "uuid": "bf9f8e49-bb6f-4e3f-9795-9adb4534cc2a", "value": "b0efae4b4bbfd1f62b39d5fe7e8432cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20de64c-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344026, "uuid": "9c22d419-9c3c-4e1b-93d8-a280f1d48e84", "comment": "Malware payload (Socks5Systemz)", "value": "7759b65ccae3900b371e1f9a52f381c2", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344026, "uuid": "a39f7342-0124-4f50-973e-0a05be644174", "comment": "Malware payload (Socks5Systemz)", "value": "f4035725be76cc7505d0d70087b3adc1ea86e3d457f95c4973907ad40b1f6698", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344026, "uuid": "27a6dce6-6e87-4c14-844e-ca53f59e8d71", "comment": "Malware payload (Socks5Systemz)", "value": "02ce0b126625778e0736af18cf21367e50c09b68", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344026, "uuid": "2a04010b-b35f-447d-99c7-9f7df83ec7bf", "comment": "Malware payload (Socks5Systemz)", "value": "01c3fe8fdc0e6f292fa4f59a2393281037e09bafde031ccfe2f18d75dbe512489d2bbcef53d2798c57213c591c9334b3", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344026, "uuid": "3395a46d-f224-4a66-9212-986c95fc9464", "value": "T189E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344026, "uuid": "13a4ec93-b45e-4306-89d0-e541bc953f2c", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344026, "uuid": "17a7d4d0-9e96-4ca7-8b27-6d874e3c9a0b", "value": "12288:HjsgiZdvAeRwb+arHf50cCdCBqCycvpWwX8m3RKLiTOkERptHn8kSiIjcBDQg5EK:DsgwdvASA/50cCdCBqC/vpfX8m3R+iTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344026, "uuid": "2a794168-37bd-4f29-91c7-9dcb62a42b85", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344026, "uuid": "9ea59239-f5fe-4bbc-9bed-b8c007e2f1de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344026, "uuid": "2d94f866-fc69-4ea9-952d-b38b89258535", "value": "f4035725be76cc7505d0d70087b3adc1ea86e3d457f95c4973907ad40b1f6698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4da6416-f34f-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712323469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323469, "uuid": "6bfb9ec3-efda-454e-9d02-474ab92ad599", "comment": "Malware payload (RemcosRAT)", "value": "365611c6c550f6b4d41e017b7f658975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323469, "uuid": "d9371800-ab61-4482-80a2-ebfeed5807fd", "comment": "Malware payload (RemcosRAT)", "value": "f486a970c3228b346008eb169500d373560ea047084818b77357ba68bfa960af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323469, "uuid": "2fc33de0-9953-4582-873a-4d02d09373b0", "comment": "Malware payload (RemcosRAT)", "value": "b31644d9fb613abfcb0bf7a801db77b4d7fd7ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712323469, "uuid": "2134b898-5574-4f03-ab08-b09ada2c263d", "comment": "Malware payload (RemcosRAT)", "value": "6243fffa804bc271fd3a1dfbb9de3a3438d95842f7a346212d7e291072d16e78bfedb9c4241dde7c144a22f8d776a5ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323469, "uuid": "e0dee078-2754-4cbe-96d2-4132ef969309", "value": "T11C15238423ACCB67D8BD47F869109421537BBF9B27E2E58C4D8391CF1771B448632A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323469, "uuid": "6c708fb1-f03d-41fc-a26a-02afd0f5852c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323469, "uuid": "b239f042-77c7-4ac4-8245-abe636103855", "value": "24576:Ig5HJmx9NoiP7+J7v8Dlco1AtasmkDu13xXD7:1Jmx/7zYv8BJ4a1kq1R7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712323469, "uuid": "9eee797e-be7c-44c4-bf3c-b692679dcbcb", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712323469, "uuid": "943d2393-d622-4843-b9f7-6012ac41e6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712323469, "uuid": "ffc794d4-23be-4947-8e78-bc408b2afc52", "value": "SecuriteInfo.com.Win32.PWSX-gen.19953.22926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060663cd-f328-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712306372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712306372, "uuid": "ee447afa-cd8a-4129-a039-29e32b7b6c75", "comment": "Malware payload", "value": "62a94d299c06fd32995866ec09349aea", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712306372, "uuid": "5a5733e6-375f-49e4-8133-668ae4e5f35d", "comment": "Malware payload", "value": "f4a49dc76b964ee6ccd1fb0a05c1010551c00a9f5f2272bc742c242ad0659968", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712306372, "uuid": "67790665-1f5c-4b1a-a6e4-61fa13f96c93", "comment": "Malware payload", "value": "54b986756904b445eda753f29280da7374bae76c", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712306372, "uuid": "643fa743-0a91-4ca0-8f09-3a39e1d2cbeb", "comment": "Malware payload", "value": "66b9aaa34f7b35bd3b448b2bd83031d2c1ae79e5d3a7e279bbabce8bd62b75dd009b14896286842a4a8bfe61ac096f17", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712306372, "uuid": "630031a6-7bb8-4055-b010-fac7c77401e6", "value": "T1AC72169CCC0E5BEB9A473B7CE601B98649648654223C2071A4AE37F574C7D9C1E3F2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712306372, "uuid": "c79d4c8e-649b-4706-96ed-f8ea7dabb81d", "value": "384:zR7phvYL8bnJ9JHYG8mv+9p35MkTCgL4U1nwTXO0OmaC07MImu/FQIUP6VN/HeN9:zR7pNYLInJ9JHYG8mv+9p35MkTCgL4UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712306372, "uuid": "8457d7ab-bd18-4e76-ac63-3ba49a1cf402", "value": 16786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712306372, "uuid": "9821cf82-21a7-438e-9087-bd11ff8e66d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712306372, "uuid": "dfa05c72-e2cf-445c-9dab-42a608acd5ac", "value": "UJ2024-180222\u00b7pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef07007-f331-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712310655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310655, "uuid": "545b9c15-289c-454b-8a5d-9c70d12949ac", "comment": "Malware payload (RemcosRAT)", "value": "b195643d6d8c3f81c7409533ad14726c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310655, "uuid": "5f1a3577-1edf-476b-a7fe-ff98448faaec", "comment": "Malware payload (RemcosRAT)", "value": "f4eaa74eb268a58cff6f5d37607758bd49cc00af060da799857ae10cfd59efb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310655, "uuid": "a2733dc4-790a-4c32-b08d-9bcbd90ba1e7", "comment": "Malware payload (RemcosRAT)", "value": "c09b56928fb1f448ed9b3610a0b930f77e2ebcfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712310655, "uuid": "202dba93-de38-4ee0-8ef3-edae398002ae", "comment": "Malware payload (RemcosRAT)", "value": "7c8da154a72e7f5378f6087f81ceb0764fdbc054328534f90065e4531af173358991bc41f2f5bf837f0274aced3e4a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310655, "uuid": "0bc2503b-3fa8-433c-9e29-a2c9e1900657", "value": "T150152245BE1C4B1ED4B88BF9E0345B110B766E65E490C0D95F93B8CAE6B3B80598DE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310655, "uuid": "32ddf011-e5f3-4ce5-a8bb-998a9efba905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310655, "uuid": "0911dad5-9bf7-4eb9-928c-3bd831b5b4e8", "value": "24576:JgjHr6DLW5Gaxs00MUVXdtS6seDmw+Op8lCua51:WrpDxclG65mg8lCuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712310655, "uuid": "8884279d-1a2e-4430-9bb4-97f736757511", "value": 944136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712310655, "uuid": "a02c382a-4c32-47be-bb53-34f743724501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712310655, "uuid": "321fb8a4-6bf5-4900-9496-c6c06c671d57", "value": "TSTS 0005A.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2336a4c0-f2fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712286664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286664, "uuid": "2c71548d-3021-437e-bd90-38ec233a5d08", "comment": "Malware payload (Gafgyt)", "value": "26a43038d408a7f397d7b638873f8d81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286664, "uuid": "825dfbd8-4d31-4212-96eb-96e3918deacd", "comment": "Malware payload (Gafgyt)", "value": "f51dc62b2a93b103af00c46f9a1a815a502d05aef08659c9b2eec5ff9c43f380", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286664, "uuid": "9154bb17-2b81-432c-99eb-3ac9cb2d1fe2", "comment": "Malware payload (Gafgyt)", "value": "e5c142f34bcc2e5e51215b595e29cc1f762c85ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712286664, "uuid": "1d19bebb-e4dc-40eb-9f63-c3b9ec47320f", "comment": "Malware payload (Gafgyt)", "value": "9c17965f8bc7814be14c5dd3272d8a6b5f83ac550c386686007ce9f42cc8cd4ccd8859c56614a4c05abf20b156bf5b7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286664, "uuid": "4175a5b4-8d43-48b9-acca-f9318b3f9b63", "value": "T1A6E31814F801476BC2D323F6A65D879D3F3517E623DB33115A38ADB02FC2B992D299A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286664, "uuid": "512bf7e2-027e-4e05-a6dc-54f6cd246f98", "value": "3072:Oh8pDxLxO0PXW8/2lMq9z5hBke+84FmzZQQAhtRq6AAe:lm8/2l9z5hBkeWFmzZQQAhtRq6AAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712286664, "uuid": "9b357e49-2cf0-448c-b55d-3fe039f713bf", "value": 156077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712286664, "uuid": "35e65d55-1dec-40f8-87c7-017be66c5e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712286664, "uuid": "489e8788-e260-4544-b16f-6016d11f3a49", "value": "26a43038d408a7f397d7b638873f8d81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3477480-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344028, "uuid": "62c7a857-434f-4b2b-8393-e2ff8c416f61", "comment": "Malware payload (Socks5Systemz)", "value": "33f05a045b73f5824786895a00500d38", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344028, "uuid": "6112fc79-cc31-4ba0-94c9-2c57f570000d", "comment": "Malware payload (Socks5Systemz)", "value": "f80670eb55a324153bd366bec50ae030a2443741fc7e6e756b23dc6a9212b583", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344028, "uuid": "e2a294c8-2e40-484d-9080-8bfe4f2d19f9", "comment": "Malware payload (Socks5Systemz)", "value": "fe956d021890f81565ffcdb1911ebca3d3037c57", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344028, "uuid": "144d9151-87f4-4214-ad70-bb5d136f9e67", "comment": "Malware payload (Socks5Systemz)", "value": "2b00e4be88f182c698eabce838beb539645662b2b2970d8051c2fd906d60c072fcb5c53b73a0a3a7fa8f5e6056b88795", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344028, "uuid": "2b218566-758c-4874-aaa7-0d5e3a5c5e26", "value": "T175E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A471D9789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344028, "uuid": "36d1b482-1b52-4467-942e-b7764c2d62fc", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344028, "uuid": "1b13eb54-562c-496b-83e1-9af6c9e32e10", "value": "12288:HjsgiZdvAeRwk+aqHZ50cCBnBq0ncvpWw11mhRKLiTOkERpSHumkDiIjcBDQg5ES:DsgwdvAJN550cCBnBq0cvpf11mhR+iTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344028, "uuid": "42ed4795-8f79-4efc-8626-0f13609c6c37", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344028, "uuid": "c38f481b-7af7-4561-8996-007a24513ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344028, "uuid": "1648082f-c6c2-442c-a708-1790f0a568c3", "value": "f80670eb55a324153bd366bec50ae030a2443741fc7e6e756b23dc6a9212b583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b453afe7-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344030, "uuid": "441dca45-ad06-4c5c-81f1-6fb031ea5ca4", "comment": "Malware payload (Socks5Systemz)", "value": "880950908d87bd478827a1b1a5baa9f9", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344030, "uuid": "ed35cc1c-e96a-4a20-9d63-40f9adbe1ae2", "comment": "Malware payload (Socks5Systemz)", "value": "f8ee1c5162c78c9ffdbf27268e8d6f0c04351f6e11ffef27afa66fd3fc84978e", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344030, "uuid": "62017d90-4fb6-45fb-a415-264a52b2ddd3", "comment": "Malware payload (Socks5Systemz)", "value": "445bd73ae2ae85ef3064db7d3b590d51081a33f4", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344030, "uuid": "82c240ee-f522-47ec-8aad-cd9cb8935b04", "comment": "Malware payload (Socks5Systemz)", "value": "8305ecc151cca2a927f05ef2ccceec5c5037ce09319f655f032358fa697d57b4585306a31dac2ec8619de9d7ec588a7a", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344030, "uuid": "9bf8c8a9-eb94-4f50-83c2-1780f25347fb", "value": "T195E49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344030, "uuid": "2b80141d-118c-4db1-b594-44f7711800f2", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344030, "uuid": "9967ef26-177e-4008-b6c6-2952caf710e9", "value": "12288:HjsgiZdvAeRwg+a7HX50cC5MBqSEcvpWwXOmzRKLiTOkoRp/HNUkQiIjcBDQg5EG:DsgwdvAl0350cC5MBqSlvpfXOmzR+iTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344030, "uuid": "e52b5288-913a-4b6f-a455-3b9f871f0fc9", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344030, "uuid": "4c7d5001-351f-4798-95e2-3fa1dad7b73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344030, "uuid": "4011e2d1-f52e-485e-b7c9-572ca67c3751", "value": "f8ee1c5162c78c9ffdbf27268e8d6f0c04351f6e11ffef27afa66fd3fc84978e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8f9b0a-f36a-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712335075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335075, "uuid": "6ea03f67-89c9-4071-9264-cfe766d30152", "comment": "Malware payload (Gafgyt)", "value": "5793bc29a281e79ef76ba51c095abd8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335075, "uuid": "08382d8b-d455-4ca1-8c43-20ed88860943", "comment": "Malware payload (Gafgyt)", "value": "f969cc3333d6f7f27bbbb074bd2c3784fd4f5c1379aa436f13b1ffe901a72687", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335075, "uuid": "ab7fccab-0af0-4934-9631-5cd2a4a54ada", "comment": "Malware payload (Gafgyt)", "value": "627db05284fe31074c1c3db362a76b307f0b6c98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712335075, "uuid": "7dbddd9e-3f86-4d99-922b-d5816367031b", "comment": "Malware payload (Gafgyt)", "value": "37e0dd08862d6f9fc7e72925623568d12cbd36e2badcfe71eee8b36a7e9c954f2e4bb609aafcb15754de81278904681c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335075, "uuid": "6b28a359-fd4d-4af7-af3a-1ab5e53931a2", "value": "T105C3A52A7E22BFFFE568863107F35F70879521A227A19385E26CD7081E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335075, "uuid": "2cb1ef85-da5d-4aa3-82bf-ba62ac2aecb2", "value": "1536:iZ2OPwbjByODMYs2rK3CmOmQBySbJMx20eMSxul1IHgkRsa7UDgSsAxuuOnT+1x:i9mywysmxCx6IHge7UDgSsAxuuET+1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712335075, "uuid": "1a83ebf3-1d72-4388-95d2-ebdab4f077f0", "value": 126787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712335075, "uuid": "4f5cf0b7-7562-49f2-87ad-d715da4b812a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712335075, "uuid": "c57736cf-b8e3-4c67-95b8-46c78b5c425f", "value": "5793bc29a281e79ef76ba51c095abd8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565e7e6c-f398-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712354610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712354610, "uuid": "59cf04c2-acd7-4789-a398-04daf033f53e", "comment": "Malware payload", "value": "7f49f7a154d31e309f1ca0e83e8c6315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phemedrone", "colour": "#553FE2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712354610, "uuid": "c709797b-5367-448e-b7de-b20fb0552f39", "comment": "Malware payload", "value": "f9bba25adc0c0506f5833a4ccb3c429e3e460bf194dbc5ab14c78054d7640f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phemedrone", "colour": "#553FE2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712354610, "uuid": "84425de6-ba6f-40c0-a4d5-2c9dc32c0713", "comment": "Malware payload", "value": "9b91a45407fcfd6bf645baab7dd5b38e8f999c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phemedrone", "colour": "#553FE2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712354610, "uuid": "34421a0a-5bce-4ab1-8da1-f3a52a51c724", "comment": "Malware payload", "value": "9cdcf81b9073363ffcb8f25993229283286cbeeacfe7f91eb382963b18b40d8ca00730272683a3c36a81a85503d21406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "phemedrone", "colour": "#553FE2", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712354610, "uuid": "3811b3cb-03dc-4495-8b22-95a3a291559d", "value": "T1473692307BEB9839F073AE758AE4B596995FFB633686145D109813460623E42ECF183F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712354610, "uuid": "80c71301-777b-41c8-8117-3235b0fc1f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712354610, "uuid": "7f52db67-3bee-4bfc-9b7b-11082bb709dc", "value": "12288:Ufbh2x/HsPrx2766qvB0azE5eDBIDLLPuIn:iTXvduDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712354610, "uuid": "06891bb4-f4c0-434f-96ab-c848638466a1", "value": 5182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712354610, "uuid": "79f18c79-1b38-45b6-9a83-49cdd63fae36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712354610, "uuid": "07a65b08-b3c2-430a-941f-9c72bf47044a", "value": "loader666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa9f9eb-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344256, "uuid": "a63188c7-dcc6-4fa4-9333-e839fbbfe6ca", "comment": "Malware payload", "value": "b93d95271dbef3398cbedc69f0569e0c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344256, "uuid": "175213da-614e-49c9-b983-1ea3f4a5669c", "comment": "Malware payload", "value": "f9e9e7c0480f96386969fd01fb31601e95fac8d2d7e7c07f04a7ea9522c2efac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344256, "uuid": "3bc9c6b1-e425-4253-b8fe-16b5ed918922", "comment": "Malware payload", "value": "fded27f9d463776c4747c019a5e91dcbb2915213", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344256, "uuid": "3c0a326b-0b87-47b2-b2b9-234d10870243", "comment": "Malware payload", "value": "5036db7f19014f5c56c7b48eb6511533d64f1cb5cd32a73b8fda8c0ffd759f9a0ca8ca172b8c40deed2599bfc9911396", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344256, "uuid": "781dffb1-d282-4316-966a-04e760e6ea2b", "value": "T14EC46B92F9D4943ED43E0EBC4B1BD6711A3A39E13B6609AD6F90390D8C397C2546C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344256, "uuid": "a18139a6-c081-4132-abcb-c07fe3cd2b81", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344256, "uuid": "e019830f-c2db-4530-a571-e88983b051fc", "value": "6144:k969DEsaVheNSPUP7focas490uM9W9N9N9P9P9P9:Johe+Ub/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344256, "uuid": "bb2160cb-694c-4ed9-82f5-3e72e000b674", "value": 586720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344256, "uuid": "56aa51e9-3ccb-4536-8397-99832023ec5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344256, "uuid": "3b61ff01-7eb2-46ee-8523-33306d78b7b3", "value": "f9e9e7c0480f96386969fd01fb31601e95fac8d2d7e7c07f04a7ea9522c2efac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a858a85e-f39c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712356465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712356465, "uuid": "9854f81d-419a-4b40-b8b2-6be907a10eb6", "comment": "Malware payload", "value": "9d7f799067e3a1bf3596c7b693e912a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712356465, "uuid": "ac747aa8-bccc-46c3-81f2-0fa34b77237b", "comment": "Malware payload", "value": "fbc526c8f283b181391aa13ca98e82a99859aeef3f0fb7ef7a0ed155392663b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712356465, "uuid": "61b778fa-203d-4196-8a56-1e8f0f1b7e45", "comment": "Malware payload", "value": "f461a01547e439e83ae02a4ca8da6a7c2efa753a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712356465, "uuid": "8ea83030-a118-498f-b351-2190d9bafc5b", "comment": "Malware payload", "value": "223c4ff488c5dd757a9f7ebb871aa177e0a1d662f944fe493844c4fd0052cba77a047c78c99f3ca329e4266ad786b2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712356465, "uuid": "94f9dd51-5bd3-43ca-938e-ded8a5897e91", "value": "T158749D5773A8D53BD1FE073AE43246144BB0D843B627F38B5A2C56B96D223868D523B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712356465, "uuid": "a9e4ee6a-0559-4db2-940c-53b7b59200ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712356465, "uuid": "d6295f2d-e170-4500-8a21-b6f29fc6a8c5", "value": "6144:77qQ4i1FFiEKLJ5aMEb2lEyg77CukNnEwTWhFF+:npliN5jC77Cu3wTM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712356465, "uuid": "6ac0ae21-b07f-40eb-b933-23a3e495682c", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712356465, "uuid": "0783d2c3-cc25-4575-be3e-80df2936ae80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712356465, "uuid": "4a056a2f-e5f9-4bd2-9992-a9991a77af0f", "value": "xUPyFH4lXPsU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b80c8b9-f380-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712344257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344257, "uuid": "b561f604-c49b-4be3-ac57-b7d624315cd8", "comment": "Malware payload", "value": "ba74ebd7dedafcb380356630c12f3098", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344257, "uuid": "1b8b4c65-35dc-4194-a674-3a16d36447a0", "comment": "Malware payload", "value": "fd0d28aaa381a2c518c1353c1ccdb7c9245a6a599f07622906f21c5d7be2718e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344257, "uuid": "fbd0edf6-fd9f-4757-b034-9c472b9956f7", "comment": "Malware payload", "value": "f3c4c1cd6a077600444fcb10c2365767b2ce1372", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344257, "uuid": "fbbb1b1c-3329-4a65-b05f-c74987dd99de", "comment": "Malware payload", "value": "12d2535b86a8a653a4c79305bc921075c8bc621305395624188d741564742a3b84364c37316d2561ba2aa2c12e765058", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344257, "uuid": "208446a2-df01-4a30-a98b-977b6302ed4d", "value": "T1A7136BD6F7D188B1D0201EBD8C39D266943B3E393D692AB2B6A93D4ECC7D3D1181C54A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344257, "uuid": "58a20be1-73bb-4340-b412-4291ffd5b60b", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344257, "uuid": "f0d2ef5b-d7d4-453e-b858-6d5a8988d135", "value": "768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJZtvn:JxqjQ+P04wsmJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344257, "uuid": "099de706-7148-4d66-8b6e-2d38d4a1a699", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344257, "uuid": "58f16605-1b13-4d0d-afa6-1464150348fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344257, "uuid": "3c8eb0da-c958-4749-9ad2-404a53f58d47", "value": "fd0d28aaa381a2c518c1353c1ccdb7c9245a6a599f07622906f21c5d7be2718e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5647a60-f37f-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712344032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344032, "uuid": "22139d9d-33e3-4d7c-a3bb-7348fa6fac25", "comment": "Malware payload (Socks5Systemz)", "value": "39e3083c992620d870e0c7b74eed8d96", "object_relation": "md5", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344032, "uuid": "dbf1f8d9-dc43-45dd-9c90-09f81c6cfbd9", "comment": "Malware payload (Socks5Systemz)", "value": "fd90116814ad7f5b975ce254cce260b99efceabcce77fc677f30032230f7b83c", "object_relation": "sha256", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344032, "uuid": "0c2aefa6-3f74-44ad-bb87-af10ecd2ce67", "comment": "Malware payload (Socks5Systemz)", "value": "a7e0c6cf19ea13d1be3795c0bb29c3702b5aacf8", "object_relation": "sha1", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712344032, "uuid": "554873cb-a11d-4325-8953-ea8a782e0c4d", "comment": "Malware payload (Socks5Systemz)", "value": "1c60929867f2bda090fd51476743aa6a3002ecb749882b18bf6f147b03acbc53b9d061f29c62808a209d90a1092dc0a0", "object_relation": "sha3-384", "Tag": [ { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344032, "uuid": "f0c334f9-04ea-4d7d-b643-3b7a91a6030b", "value": "T1ECE49EB13A0BC1FEC35A0474E853A603C57867F18B64E646EE6C7C7CCAA34A571D8789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344032, "uuid": "93c8b9d2-f2d6-4bf9-8dbe-f200b9b9db6f", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344032, "uuid": "3218f0a7-8731-4302-bfca-12f4939ca20f", "value": "12288:HjsgiZdvAeRwo+aFHP50cCpIBq6QcvpWwn6mTRKLiTOkIRpDHZMk0iIjcBDQg5E+:DsgwdvANev50cCpIBq6hvpfn6mTR+iT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712344032, "uuid": "bd6ed430-374f-4228-a735-4bacfd733cc9", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712344032, "uuid": "7eac1276-9d39-40b7-957d-03761e927708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712344032, "uuid": "918b564f-a412-4964-b997-460ca84bc305", "value": "fd90116814ad7f5b975ce254cce260b99efceabcce77fc677f30032230f7b83c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }