{ "Event": { "published": true, "date": "2023-08-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-09", "timestamp": 1691625781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "eaf8791a-9d98-4cb4-9788-65db31f694b7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b00922-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571940, "uuid": "3f038ba5-3798-4119-95f0-e0c52254ba47", "comment": "Malware payload (Amadey)", "value": "8800a284eefa83c0031f216199793275", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571940, "uuid": "02dd1edb-71b9-436e-8c5f-dac9a763c8d1", "comment": "Malware payload (Amadey)", "value": "015a97b162ecd21c0e8532a0d006d8a79ab012575960b69ef334cb89e32a4ea7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571940, "uuid": "ff98ae85-a007-4134-b74f-6f7f17026dfa", "comment": "Malware payload (Amadey)", "value": "6b378060499e56686dbb6c81898066ba820b63c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571940, "uuid": "bf3acd04-69da-42e5-8a38-c4173ea77596", "comment": "Malware payload (Amadey)", "value": "aebe9bc800ac591ea6ffac02fc2baddf2cd25ff2ea8b4ef475c386e2d2d5b079165344d00a12e77a320480cd0c647c40", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571940, "uuid": "76f2ece5-dbfc-4848-9dc6-b9121e32aab3", "value": "T16BE41212B7D85132D8F64BB1A8F606830A357CE19D78925F778B582E0D736D0A93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571940, "uuid": "57733f9d-7456-43b8-a069-ceed1533e9b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571940, "uuid": "d22e9a4c-709a-4449-b6dd-6001e73e9057", "value": "12288:uMrky90brI9cLZ2UHa5fGNrurU2s7IcRezH+W1asDIXfDj79m3:eyOgwVHThqUf7EbJaiIXfDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571940, "uuid": "ac559a12-f68b-46b2-9e63-fba1a120dfea", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571940, "uuid": "074ba265-c8d3-47a0-8a66-a51d7c05bec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571940, "uuid": "ccc7a1cc-508e-4682-b7c8-cae9e576c09b", "value": "8800a284eefa83c0031f216199793275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c15618-366d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691555418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555418, "uuid": "66a2b49a-6a8f-4763-9b03-1c455c41ada5", "comment": "Malware payload", "value": "17fa51ab98322fe44a5a87ee4b3a3e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555418, "uuid": "2e8a26dc-df01-4e31-84e2-f3332c2107d8", "comment": "Malware payload", "value": "016c82fc8cb22b38d929ecabcbd03d26730d36686c075927252e05fc1982e29e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555418, "uuid": "3f449893-104f-49ca-8332-1e78142bd92d", "comment": "Malware payload", "value": "719dbf8d781203f4a7b12624226320f00577376b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555418, "uuid": "1b77c1e8-dded-401b-90d8-e0463b204fe4", "comment": "Malware payload", "value": "bbfa349cabd02c31b1793d47302f1d63b25366429aef51e60cf6555e3f1b8347ac8c9c30232ca88067b6c9e99138e2f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555418, "uuid": "3d1759b3-ea30-476a-a6d9-64d56893bfad", "value": "T10021EA946E610EC3F412D0BCE638232D97A8E8B530ED435708C8D43D6079049EA5A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555418, "uuid": "a0cc5194-d875-49c1-a6ec-f315c0abb64f", "value": "24:A4iGbY48hNcHEHBiSvKwKNyzkoUWNBtoX6LAFlqUiC2Ly3kXj7uZGa:A4JY7UHEHBfvKw0yYoUM7Cbl4LLyif6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691555418, "uuid": "20ddf110-f45b-416d-8735-8f73d349aae6", "value": 1310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691555418, "uuid": "dedc0c7d-30b4-4ace-8979-2c54d19fbc18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555418, "uuid": "cd0d4e2b-ac67-40ed-b8f7-edf06ee46088", "value": "SecuriteInfo.com.Backdoor.Win32.Berbew.9425.1396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b303e555-36fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691617804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617804, "uuid": "f0025c64-01b6-43a8-8cee-f124db739a30", "comment": "Malware payload (Mirai)", "value": "be98a372cc6a31f92ac714b4983b7824", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617804, "uuid": "15e4c720-5284-445e-8262-b4c9e2d7a7eb", "comment": "Malware payload (Mirai)", "value": "0193292f66ec42d09b86c50e62daa8186cad84cccc25fd4f6d54430fbd9e9b2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617804, "uuid": "109f9cd6-9f72-4f1d-adbc-591c61c83247", "comment": "Malware payload (Mirai)", "value": "61ccb4fdff183798ce3b85124c200ed2ee5f5209", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617804, "uuid": "1ea5fd32-7130-49b2-a2c5-1d2e79a4a42b", "comment": "Malware payload (Mirai)", "value": "e02bb41643e8b74a484d23ea305c34e6a4f040c61d9769bb86a0bf84d2584c686eca8bcd344e9c06eb55b64a510ab3be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617804, "uuid": "67874226-6e8b-41a1-b2ac-6bdfcf61168e", "value": "T1ADD34C46FA418A13C4D517BAFAAF4149333297A4D3DB730699185FB43FC676E0E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617804, "uuid": "a2196ce7-40f7-4fbd-8e02-782c028ea987", "value": "3072:JgauByoyut54A17i5tmFz7rRUQ0Iq0DHUAYM/9kbYj:WauB3yut54A17gmFz7r2Q5HUXM/9sYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691617804, "uuid": "d794ba46-6bb9-4d88-858a-d64d29c6657d", "value": 136306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691617804, "uuid": "2fab35ed-7fb9-44b5-a52c-dd1dffdba245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617804, "uuid": "d8008442-9383-4df6-817f-325982b6bcbc", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8992c0-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691583967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583967, "uuid": "cfbaf039-3ca9-47f7-9601-1aca833b270e", "comment": "Malware payload (AgentTesla)", "value": "d961ed9205c46cc0ce2b3dbd7122ceba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583967, "uuid": "3068e3b9-13be-4f34-920d-bbd63f7426c2", "comment": "Malware payload (AgentTesla)", "value": "0208bd67126a78dbb0fa2f7ddc65495796a6228d4b31f60de86acdc5bcd1e1d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583967, "uuid": "010a793a-2044-4ad7-9cb1-cd4517789620", "comment": "Malware payload (AgentTesla)", "value": "3b88b18f1b1708a95b04f637ce79dd9a38b92d31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583967, "uuid": "166f0268-9195-4cf2-8f41-d0c7ee5d1132", "comment": "Malware payload (AgentTesla)", "value": "316fede0671d99c552dde7ff4887e1f39167db2dd14182e041831ae2e82b4b994e4afc0022ba9c786bf875e6c86aa554", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583967, "uuid": "2ca1341f-467f-44cc-b1ad-adb84bce0ddf", "value": "T14FC455432A8D4088BABA790343DD16BCD36FB1C5C93FC975B8819A1E2B8FD04D9E5761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583967, "uuid": "c5bcd00a-1485-44a5-acf2-d07ca04d6b0a", "value": "1536:NuIv4yhQhNCVPITdjdfCGXwFEyiX9biGNIMPomlZt:NXv4ymrCVQfCGXwB6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583967, "uuid": "7b794dbb-170e-4970-b63e-9b95a633fac8", "value": 546892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583967, "uuid": "295becd8-6c1b-4edb-a994-6cd140a09877", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583967, "uuid": "4132cf1d-ff4d-4a28-9649-1146d834de6a", "value": "qasx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ddf902-36eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691609483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609483, "uuid": "9cce7c43-15e1-4501-8a2f-b94742a54c31", "comment": "Malware payload (RedLineStealer)", "value": "1f458f847fb02f1be979b4df130cd979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609483, "uuid": "7e939930-9674-4cf8-bbda-907fe906cffd", "comment": "Malware payload (RedLineStealer)", "value": "0294faa68b618c5cb0869e7406143a0c88bff12f088c971c18c08f02402fc547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609483, "uuid": "fff55171-36ab-4d9d-9a27-bd1b97acd543", "comment": "Malware payload (RedLineStealer)", "value": "7e7d38993b2f323de243e69752ce64d97bc5feca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609483, "uuid": "471b1c46-e43b-4b22-9aed-f071826ffeb8", "comment": "Malware payload (RedLineStealer)", "value": "a3dc83f40d4e4b5d53d7f52978f34cc3f37852186ac7dd3fd1aeb73dfcff70dec3c4f28006aaf945261e51567d53f5c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609483, "uuid": "6a100baf-1c27-4d36-b711-54e44ae8699b", "value": "T1A203F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609483, "uuid": "0735ab85-4cdf-4800-bd3c-2bc10353da2c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691609483, "uuid": "c9283510-32d6-488d-933a-abaafe695719", "value": 40725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691609483, "uuid": "a0b2650b-a840-4f8d-b28d-551076591f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609483, "uuid": "252887dd-050b-45dc-bef8-ca9576193975", "value": "1f458f847fb02f1be979b4df130cd979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741c1723-3673-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691557999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557999, "uuid": "7ac8972a-84a8-45b0-a36b-34857822131d", "comment": "Malware payload (Mirai)", "value": "94e3b23cfc42d97315ae0dd737df2a2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557999, "uuid": "4247075f-270e-4bc8-b273-dd5de9461803", "comment": "Malware payload (Mirai)", "value": "03d389aff3f982bb181bac3041d8e5028dfc035cc8254cbf1a53754ee7a71b2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557999, "uuid": "02bd997b-bfbd-4edb-b370-da7c2af75d93", "comment": "Malware payload (Mirai)", "value": "315afa2ed04850e3e1336064b50e60e7b5c18756", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557999, "uuid": "af9bf937-959d-4316-ada1-30af6c4b181a", "comment": "Malware payload (Mirai)", "value": "fb40862d240e292aea68defedf6a4db310af2e86b31c45a869f6867a35a141840a04c8be1e145d80b43dfd95ee81c215", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557999, "uuid": "8965448d-333a-4a0a-abc9-cf1a5bc0b09d", "value": "T1FA23F187A0943943CF4D0D7D802B07825909F0D0729B8F1F6B6DE985A985D3ABADC53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557999, "uuid": "4f820fad-4488-4220-8333-c361219a1b03", "value": "768:wzCoIYfQd4CniOEHztpTLjXBBy1PqH/sO3UnnHTLoOPcdQeXAZTFqEPPGWMqS:wz6jdpnihHztlzBBkOkHTLLcm7ZBlP3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691557999, "uuid": "67845d88-5e4e-4ce7-9583-1abefb9c5f7b", "value": 47072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691557999, "uuid": "8878436f-3002-4e3d-ab10-c6aa274c9a4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557999, "uuid": "9c6cbd74-7ce4-4003-acf5-2e13509d55ac", "value": "94e3b23cfc42d97315ae0dd737df2a2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27e7c1d-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606288, "uuid": "f7ebd5b7-4f52-4d89-802f-debdfc3ada4c", "comment": "Malware payload (Mirai)", "value": "ab29f6b22da61380a0840944d11227b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606288, "uuid": "9a582021-e9c7-4f77-ad59-60e2e7696b6e", "comment": "Malware payload (Mirai)", "value": "03d3ccdfa95ee0d7089bed188ab6ebd033479294e517c8bd14c8d64d06b74834", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606288, "uuid": "37412cb9-ad61-430d-a8ac-34aa9467336d", "comment": "Malware payload (Mirai)", "value": "48202fbf343a7cc590ec9aeca3b55241dd9ff961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606288, "uuid": "4094bf51-193b-485c-8d6e-4af7d4cf24dc", "comment": "Malware payload (Mirai)", "value": "92b17876649bced17e8541a32cafc92710be74b3bc198cbead7772a3d1b3e7fe15eff8d5775e9a262dc7043809381a57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606288, "uuid": "c78e9b19-ad49-42dc-80a5-067215fc897f", "value": "T176533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606288, "uuid": "843d0e8a-ff0d-4033-989a-3dc8b11fe711", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpoz8yU:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606288, "uuid": "8e6fa4b4-24c5-48af-a0ba-2839d520a793", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606288, "uuid": "a9022a5f-1512-4740-8a19-24ad0ce20eb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606288, "uuid": "29be4deb-d0f0-495e-b210-1c188fa033c1", "value": "ab29f6b22da61380a0840944d11227b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c561ed-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602882, "uuid": "14270af4-ebeb-4389-a6dc-c1784073f86d", "comment": "Malware payload (AgentTesla)", "value": "9be9908dd6ef9b65a5c2e6b5a8f05789", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602882, "uuid": "4ca39680-e8c1-4735-ba86-752d33bb8bd8", "comment": "Malware payload (AgentTesla)", "value": "0432b62b226056b540dea3ec016a862521c3191da87f99ad5a02a1f633f9b947", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602882, "uuid": "8dd8b28a-fe4f-441d-898b-5a7ff299b061", "comment": "Malware payload (AgentTesla)", "value": "dd97a47d8cc01f8652f5200b08417faa99b3aa52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602882, "uuid": "2caa538f-5aaf-4ab9-9e0b-0d4e71dc45c9", "comment": "Malware payload (AgentTesla)", "value": "8a5daf1ca379c61f908611976d43e7a094b04919ccd564102daaff3ae8c07acf399a53757a2c4b83e77447468da20e63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602882, "uuid": "b1312fa5-444b-4a52-bdcb-a885553ad2e5", "value": "T1B915383C15296E4CF3A486FCB6708CFF17A5692F80BBF9F3885CA4D706A97D05502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602882, "uuid": "f5d63825-f55c-4523-a50a-6d942630cf84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602882, "uuid": "40efe771-e95d-4f2c-995b-c486756570cc", "value": "24576:GhHpEO6YTSxs7ON9Khuy2dlLDRfSLWGwe:GVpEhN9KhB0lB+NZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602882, "uuid": "138331f2-953f-40e9-afcb-69e72c0ab067", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602882, "uuid": "5cd4a309-1b0e-409b-a8c4-6fc404293118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602882, "uuid": "1df85194-6b71-40b3-a6e8-d092dd326874", "value": "2023-08-10 to update QCC RFQ no. 23002547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829118d6-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691549433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549433, "uuid": "ea12e3a4-a3f2-4133-bc97-e74f9ebe7ec9", "comment": "Malware payload (RedLineStealer)", "value": "1cbba3db59b76f64edca04cc162c13a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549433, "uuid": "e72c9b70-166b-454b-93ee-ccf35776eec1", "comment": "Malware payload (RedLineStealer)", "value": "044ba38b24d5f61c945222c413f25e270f4ee6e0a9b4e63f7f290a14f35ba6fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549433, "uuid": "61f73e77-9e4b-475c-a224-fa96fbe69622", "comment": "Malware payload (RedLineStealer)", "value": "109452ed76003d6ffde3d733ec18970ecfe74873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549433, "uuid": "5364c444-d784-403c-9772-1b9cc012f56d", "comment": "Malware payload (RedLineStealer)", "value": "5a6f000b8b6fe1be032e3b45c568427b4975703c7cc75123ef671b582e9d0ba7b058a71394dcfff35d052ad9b6378103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549433, "uuid": "5d9593a2-aa43-4c00-9271-a1439bfd2e81", "value": "T1DAC4120AA7DD8472E8B923B079F606930A367C7259B8C61F278AC95D5C726C0B47172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549433, "uuid": "d06e225c-319e-4ee5-ae41-ab963b2ba76c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549433, "uuid": "47b9fea5-a2d7-4c5a-b897-403ae67a548a", "value": "12288:DMrcy907kdDM8zmqW+NcI/+P8EpgBYCmUkHIxZC5OP:LyCYzmqWy/+PVyzmIxI5OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549433, "uuid": "d9789fc4-d900-4b17-9246-94fcfb6bff3b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549433, "uuid": "d74c3463-b5a1-4389-94dd-5b1d739361eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549433, "uuid": "e331265f-5af0-4566-a5a3-22ad098afb33", "value": "044ba38b24d5f61c945222c413f25e270f4ee6e0a9b4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53327529-3695-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572546, "uuid": "6c129f7b-5990-475d-a9dd-fe7bb54a57ab", "comment": "Malware payload (RedLineStealer)", "value": "271804beff8d531357b105dd944e53f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572546, "uuid": "b5c5d7f2-8654-47b7-8546-af8c58c60436", "comment": "Malware payload (RedLineStealer)", "value": "04d8be61a8b012c831badb24423faf73b96157e40f0324056b62894fc5dfd832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572546, "uuid": "8e0a3f89-98e0-494c-a2dc-9a02b944ff85", "comment": "Malware payload (RedLineStealer)", "value": "a4473953e78dcd6547a01746bfe6beb5584effcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572546, "uuid": "4c0ef484-b158-45d0-9e3d-6cbdbb5db9d9", "comment": "Malware payload (RedLineStealer)", "value": "6998628453ca50c0473ea418d957d5f3ffdb54a6e062ad0b71632542e7d1d0940aa38c4b8633c8e67b1b56b0ee5133f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572546, "uuid": "548b1a1e-5d7c-49a0-a028-8466d9e0e8dd", "value": "T1D313F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572546, "uuid": "4845394d-0e0b-40c8-9b88-f177cbcac197", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572546, "uuid": "7c98f35c-c916-459e-906f-e54f25e49e48", "value": 41723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572546, "uuid": "6b09d735-2776-4e01-ae7f-8959b16995ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572546, "uuid": "02f5c3a5-c6d6-4df0-ad1e-aa0d9617d339", "value": "271804beff8d531357b105dd944e53f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5faaa656-36fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691616376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616376, "uuid": "a3f07a4d-8b7f-4f5a-af40-9dd5220f9492", "comment": "Malware payload (Amadey)", "value": "29746db8407236877088a7db4a625734", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616376, "uuid": "e731fd63-fea4-4a77-907d-40562c14be13", "comment": "Malware payload (Amadey)", "value": "0548deea9bd26dd357066757f4643032827f3cab02f5edabdea8300ea0d24417", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616376, "uuid": "feb8a7db-6c96-40df-a91f-454c1f694639", "comment": "Malware payload (Amadey)", "value": "6fc8c390a7468bcfc15e8803b2de58f30b298002", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616376, "uuid": "f44d1cf4-dc7f-454b-b3d4-53e74fc1711f", "comment": "Malware payload (Amadey)", "value": "45d9bd3f8ff000e98a82a8d9bd189f86464a531512e0760def7450340ee6eae19acbd304caef52b7260ff7ea73730e7c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616376, "uuid": "739560c3-f34d-4956-ab57-3fc9c88308ed", "value": "T11413F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616376, "uuid": "1b5dac56-783e-4a9c-a7bc-ec4db5e5d409", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691616376, "uuid": "254a1415-384a-417a-b11b-7faa0f27d1f7", "value": 42563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691616376, "uuid": "704f0fd9-3dfd-478a-9045-e948d067202c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616376, "uuid": "39a466a8-ac24-4c26-9a21-cefa1079ade6", "value": "29746db8407236877088a7db4a625734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069a41d4-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691602912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602912, "uuid": "e29b2f37-00d7-4960-95ec-9631a24bb32d", "comment": "Malware payload (RemcosRAT)", "value": "f63e9f9ea3f9581cff99bbde1edd804e", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602912, "uuid": "dbdf0216-30ef-4243-8efd-8d6236c97a19", "comment": "Malware payload (RemcosRAT)", "value": "06d90c8eed570e49ceaf1a1c2562480773031e5891c4138a72917399db299250", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602912, "uuid": "169ef514-00a5-435a-af89-b543d3cb1191", "comment": "Malware payload (RemcosRAT)", "value": "f625f9aeea7927e90ffb80f773a665fd083cf115", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602912, "uuid": "e80ef460-6b69-4ce4-a0f8-80367a65b600", "comment": "Malware payload (RemcosRAT)", "value": "e561416d3b3eb13cf8966a71f60b20ecef2ff4c6ebd0fec10c1a2cefd303d8adab1e1f9d33e71201b44042c0f6801897", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602912, "uuid": "51ca2649-2583-469c-893c-38042cac200d", "value": "T105751201376C9F62E6F1A3F91879506007F1346925EBD6A82DE630DB1AB2F108E53F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602912, "uuid": "99f765ce-972a-4069-abb4-c1564e13a148", "value": "24576:wMTidR676FI7fx/QxJP8xHo7728a5pr4HrqO7QOzu:wMTieeY/QxV0HoWL0qv2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602912, "uuid": "78492f2f-73ff-424f-9a19-f074f69e714c", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602912, "uuid": "1c81c2d9-9019-40e1-b719-dbd71ffd9e6f", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602912, "uuid": "04ef36bc-02e0-4b76-9cb5-3331449bf816", "value": "nPO260.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd585d1-36e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606600, "uuid": "603bd478-8218-49ee-9977-5232206509bb", "comment": "Malware payload (Mirai)", "value": "8f01f18aed6972d9b672c88faebed4b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606600, "uuid": "7abfa61a-7e1b-4909-9b13-8418089be197", "comment": "Malware payload (Mirai)", "value": "08846761b8906946e0b83be0d36e795efaadd4a24ba8c78efad9d5dcff2889fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606600, "uuid": "ad949a03-9b1d-4956-bcd5-7cb0bc35d814", "comment": "Malware payload (Mirai)", "value": "863dc0c28d9fa29ea77c2021ee8e62da007456fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606600, "uuid": "7045dd4c-63f5-4779-9395-a5a2b9260fb7", "comment": "Malware payload (Mirai)", "value": "95f6bc8fcf6aaf9e75ab6ab9075bd4e802e4d1bc17e53cff97f2281b97ecb141386c1ee70b8c2732caada2f338d49306", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606600, "uuid": "9c34602e-d589-4b9a-97b5-b209951cfee4", "value": "T1FD735D24A9792E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606600, "uuid": "fce284e2-24f6-475d-8807-b5c902995277", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8z:YwfdNu4cmZvFqI3w7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606600, "uuid": "ea98b63d-310c-424c-a59e-095b0c7efb36", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606600, "uuid": "36790c0e-5007-4d83-8335-ca89f836f210", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606600, "uuid": "2b0e0849-b9f4-4324-87b9-a04528b24dc5", "value": "8f01f18aed6972d9b672c88faebed4b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8f89ef-36d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691599276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599276, "uuid": "d9e96088-d4b8-4af0-8d83-9ff60f3d2610", "comment": "Malware payload (RedLineStealer)", "value": "b686629e493162f3f18fe32908e4eb62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599276, "uuid": "e0100aef-3520-4852-927b-e351b002dbe0", "comment": "Malware payload (RedLineStealer)", "value": "0914ce25f29edb31fb4288c8b22916ee2c65082659c41b03067c2685338b4bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599276, "uuid": "8c4099c9-8972-4c96-bb7c-c0ba82b1aed5", "comment": "Malware payload (RedLineStealer)", "value": "39b96713b94272d41c3da3c6c7415baa88ede12b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599276, "uuid": "1d2361b9-2683-4da8-9ae8-ffe24b0d6f47", "comment": "Malware payload (RedLineStealer)", "value": "311da71ca00f6d1cdd747fa55e183455001116fc07f0e213d39f27194865efd8d07e1ad5c395bf5945542d07cb3489ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599276, "uuid": "81ede4cc-fa95-4663-9006-6c3cd7b48ff0", "value": "T100C41203A7E88032E9F02BB059F603930B367DE26E78575E2387954A5CB1694B67173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599276, "uuid": "a9670359-8318-4016-828d-cbb5b4fdee35", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599276, "uuid": "3b833bb2-aa8d-466e-8032-f128e7eb7e75", "value": "12288:gMrAy90D6WfSW/c/JMYk1kaOqqGeS1o5gBYC9GtefQIqV:wyfCc/JMY+j4GeSzzxQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599276, "uuid": "22242f04-3f1e-403a-9dd1-8965ee39421e", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599276, "uuid": "e38cfb6c-c372-4e07-b14f-59d81483ebe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599276, "uuid": "fc53be1e-6828-4587-8df4-c0a36b1d2936", "value": "b686629e493162f3f18fe32908e4eb62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d953d4-36c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691593058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593058, "uuid": "4209e77f-965e-4f58-9b55-36597cfd13c7", "comment": "Malware payload (Formbook)", "value": "34a5deb851f292c65c8a1a64b938ca5a", "object_relation": "md5", "Tag": [ { "name": "duckdns", "colour": "#4030B5", "exportable": true, "hide_tag": false }, { "name": "duckdns-org", "colour": "#B573D6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SCP", "colour": "#156AD6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593058, "uuid": "af7cbb63-4f91-4f9d-b565-c159d7446cbe", "comment": "Malware payload (Formbook)", "value": "0a63a026e4d61223130c89396ff28a081deeba614640f703aadaf7661715a12f", "object_relation": "sha256", "Tag": [ { "name": "duckdns", "colour": "#4030B5", "exportable": true, "hide_tag": false }, { "name": "duckdns-org", "colour": "#B573D6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SCP", "colour": "#156AD6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593058, "uuid": "8dcbb950-3797-4a90-9ae4-0db3a120c60e", "comment": "Malware payload (Formbook)", "value": "ee7fe3af7b4a1bc601adeb0e7a5054fa46929d51", "object_relation": "sha1", "Tag": [ { "name": "duckdns", "colour": "#4030B5", "exportable": true, "hide_tag": false }, { "name": "duckdns-org", "colour": "#B573D6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SCP", "colour": "#156AD6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593058, "uuid": "6b2df086-0bb5-4016-9343-20f912f24443", "comment": "Malware payload (Formbook)", "value": "d6b0ba7aa3644090c9f9467243f6e684e5185ae63bc84e94178ab8ce3e4e30c6f6b50e7cf86367157e1418795ea4f47d", "object_relation": "sha3-384", "Tag": [ { "name": "duckdns", "colour": "#4030B5", "exportable": true, "hide_tag": false }, { "name": "duckdns-org", "colour": "#B573D6", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SCP", "colour": "#156AD6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593058, "uuid": "4a54d83a-e17f-4c96-8885-9cbf1190b890", "value": "T15C012392155E9632D68E433A08FFC24AAB8E71927740D127C545D0661FE35B0344F569", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593058, "uuid": "e2681b56-6da8-4c3c-b830-0f297b40d1f0", "value": "12:5jwBwc0pQIuJ9E/hHtS3YHqB+5hOQ04lnH6VkfCEiox+1y1gdrbvjyzYaB:96wTpTm6NSoHzmX0HEkacEPrzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691593058, "uuid": "ffa9038a-1232-4c7d-9551-41994b89fd0d", "value": 687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691593058, "uuid": "0a862ff6-b5aa-436a-bfc1-2c2384693601", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593058, "uuid": "ce26867c-74a8-43d5-8b69-fa1d4636e20d", "value": "Request for Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ffb39e-36b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691585761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585761, "uuid": "4fc699dd-a30a-4761-8140-0eb2cd058098", "comment": "Malware payload (RedLineStealer)", "value": "970e257689c9a124577eef77d337bde1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585761, "uuid": "25279bed-e9a0-4fdd-b97a-73bd18106368", "comment": "Malware payload (RedLineStealer)", "value": "0b6277ca6f3a4bb4ce33bf6d2fc2d5f6228bf5965a635c663c9b06e96feef5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585761, "uuid": "4282856d-1317-4df2-a80e-37354d444a4a", "comment": "Malware payload (RedLineStealer)", "value": "ab2ff7d63478ec0389af8dce34db153ecf5c069d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585761, "uuid": "17dbfd71-dbff-4274-b948-eda28fee5fb3", "comment": "Malware payload (RedLineStealer)", "value": "5e7daf9fd872ef95113ab2d1a3f524d62c322a99c336deeb117efcad2e9c7a10e69b44d0437d9bee537b545533ab75de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585761, "uuid": "7b2fbf57-cfdd-459e-af36-a05cb60f5802", "value": "T14AC41213A7E84137EAB62B7088F312D31B327DE15D7943AB3344995B0CB3690A5B176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585761, "uuid": "6e55eee9-c0f8-40cf-8f09-93549fb23f32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585761, "uuid": "2060fe11-1850-4b5b-9327-39fc2ee59ea3", "value": "12288:qMr8y90ddv0XpEWTW37r0/MohmGBMJw/PJx:iyAd8XprTWv0mkMKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585761, "uuid": "9cc2889a-34c6-4a0b-a6db-ae04b853b24c", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585761, "uuid": "95c8b284-4cfc-4e5f-a2b5-d2b875db4d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585761, "uuid": "67c1a6e0-d913-4531-9035-bd2bf415a606", "value": "0b6277ca6f3a4bb4ce33bf6d2fc2d5f6228bf5965a635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25374bc0-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602964, "uuid": "9fb2a473-4172-46e7-a0d9-e17cc5c6da97", "comment": "Malware payload (AgentTesla)", "value": "7f761b2c8a8734fc8f14acae5c50345e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602964, "uuid": "342524de-f525-40e3-bd60-a22a70a78613", "comment": "Malware payload (AgentTesla)", "value": "0bf876e699fa87af9e2169d8afd1b61956e11d8949c8b52b3be86a76b6bfa29e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602964, "uuid": "1938498a-7296-4b4e-b7bc-7e92c34d48e9", "comment": "Malware payload (AgentTesla)", "value": "f93c215e5c708c4cf9b4a74d9aeb6a4407374090", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602964, "uuid": "bb0602d4-b8ca-4606-b478-7b3f8e982fac", "comment": "Malware payload (AgentTesla)", "value": "a028a2fa9b0e882703fe9bf57254b6bf5892df0e99c857e359f6755a41a46ce7be09c2428b761277dd9199a5b4826f9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602964, "uuid": "961b6f46-24ac-4f93-9550-956e65b71c25", "value": "T16A250204720CE226D7DC3678AFB1D1B403B8ADED5D2182737DD82E8B7BED6A72510265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602964, "uuid": "77ff9d29-c132-44bc-b0db-59701c7d700a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602964, "uuid": "f9b070dd-5173-49b0-948f-e008b4eba076", "value": "24576:P3x+97CPO1zUnpho08erFvZ3A/OYsbypa:/4979zdxuNZ3Zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602964, "uuid": "73a3f27c-da71-4267-b0bc-22730b91eeda", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602964, "uuid": "a802fa6a-9c43-457b-ac1c-6edd07c24c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602964, "uuid": "60faed2c-6d67-4187-b3db-ade7ce34bbde", "value": "d\u011bkovn\u00fd dopis.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84064626-36a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691577353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577353, "uuid": "88526778-e5c3-4c41-831c-de51d79aa5c5", "comment": "Malware payload (RedLineStealer)", "value": "0b9794fa910b958a26309b74027b5169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577353, "uuid": "08d3b96a-3356-4c6c-8431-9bfa9a1b8cb4", "comment": "Malware payload (RedLineStealer)", "value": "0cdef8b1a793d533891ff34a6815d371015c7e47773736c98824e7e878c7ad85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577353, "uuid": "a28b3766-8463-42b7-8bf5-8e4b9de6379b", "comment": "Malware payload (RedLineStealer)", "value": "dcba2317b131c5017bd5db18b504df885cb8a590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577353, "uuid": "1ac9214d-b059-4b2a-987b-c37c49456875", "comment": "Malware payload (RedLineStealer)", "value": "04209cf0c323c847fb64f33b29ffab0040a4206e510d45c34c53426a16bdadcb630db577e45d9280535c3cda78dc256e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577353, "uuid": "7c710211-f996-422f-b66a-0554b578c633", "value": "T14CC41203A6E89032DDF66BB068F613831F357D911978836E2346DD6E0DB3780A57672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577353, "uuid": "99dc577e-6aa4-49c4-9b80-1f3e7f97b713", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577353, "uuid": "4c65f85d-bfaf-48d4-96eb-66b04012e6eb", "value": "12288:VMriy90aJSruddnqEyo1dDYfg1gBYCCh5S2xEhp+yQupW6ayYGz:TyYrApviHzSS5hASp8yR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577353, "uuid": "afd720c5-cd9f-487d-80d8-967407dcb31b", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577353, "uuid": "7d98e4bf-a16c-4a8e-b13e-ed9705481d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577353, "uuid": "16f26e71-f081-4b47-b854-897eb6562e60", "value": "0b9794fa910b958a26309b74027b5169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fd7157-36de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691604003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604003, "uuid": "43a19a4b-b1dd-4f1c-b636-192ba0f77cbb", "comment": "Malware payload (Mirai)", "value": "dd1cc689273072fa11160ef48036c941", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604003, "uuid": "de86fd9b-fdd2-4fc5-b6aa-a0fa5b80f8ae", "comment": "Malware payload (Mirai)", "value": "0ce1faa8d1e80902694742c6be0294e402a7386167a775df6b39dc28967adf96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604003, "uuid": "ac91329d-7cd1-4e81-af76-63c8c7e734b6", "comment": "Malware payload (Mirai)", "value": "4b6a2b9c411b698846f3120ce8c3a523321af82c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604003, "uuid": "587918f5-edf4-4ea8-88c0-a74200af99e4", "comment": "Malware payload (Mirai)", "value": "c9b3f91a8e7f4f362a084ba3d9d2e06465f9b20e5d3f41be46bae13fcc5fff6365f5b546c6e40ef9e9369bc6406f5f27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604003, "uuid": "1b275f40-b22e-483a-9aaa-c6368d2612b9", "value": "T145330113B315FDA2DE762C7962F98D8E3185062DD4ECA82239C458A0A3C215BFBD55E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604003, "uuid": "f03e703e-dfd1-45aa-85d8-81863194e75e", "value": "768:CfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbwj9q3UEL2qEK5J6OAsNTGjf2tl8XOY4:tPtQjiZVcykHRDtL15J6RN2tAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604003, "uuid": "7f0ba466-c879-4bd3-afdc-45246fb86cae", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604003, "uuid": "9f80e75f-0192-4411-b29e-cbeb6abbd428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604003, "uuid": "8b29a55d-4c54-4f75-8767-a517e4f466f5", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb66ca0-36a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691577689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577689, "uuid": "ec1ffe59-9460-4299-bf2d-b9cda990279b", "comment": "Malware payload (DarkCloud)", "value": "a1ca8c7246dfa1c708ac65b3030b0ce8", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577689, "uuid": "55a423a1-4c18-40ad-91be-a03df1ad2745", "comment": "Malware payload (DarkCloud)", "value": "0d751244ca0254757b24c0e1b37d8531a7731d347294edef3f43df6b2b3eb879", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577689, "uuid": "5aea917d-8ccf-40d3-886c-e7e66f68ca10", "comment": "Malware payload (DarkCloud)", "value": "3908a7f4412c77a49c54980ce2ab961f9c117fec", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577689, "uuid": "af36df18-8fd6-479a-b0f0-a5f6acbeb5b8", "comment": "Malware payload (DarkCloud)", "value": "ac23f346302b96cde43bf7e56ec98a7adefaa8aca3027737d055a30b9e8402a2481f15041ce6251bbbcdb584c6869706", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577689, "uuid": "6141678e-d59b-4801-9218-d93c34f9fe84", "value": "T1F0943926E611702FF053C8B16AA4525BA8256E366285AC7BF7C19F4B32315D3B4F432F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577689, "uuid": "54732a40-737e-4b32-b1bf-6fab88469b24", "value": "f1f5c47557b41e4cdd647d1ee610bfc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577689, "uuid": "aa78efbe-33c6-4e03-bc32-1897909ca024", "value": "12288:IHp6Ok2h1Bv3b0H1zVVdN/jbCREjYKkJj6GmZU:qpP1uVv/jbCRaYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577689, "uuid": "0aad61ac-a4d9-4436-bede-a012db2bce39", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577689, "uuid": "78b7389d-0a4c-4971-b53e-13ec782e4a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577689, "uuid": "61b61bdb-5f8e-4318-9518-311031efff9e", "value": "0d751244ca0254757b24c0e1b37d8531a7731d347294edef3f43df6b2b3eb879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f8750c-367e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691562564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691562564, "uuid": "ea6093fb-42b5-4f19-b6ba-73c0a9d4a882", "comment": "Malware payload", "value": "ebb8caa9957e0984f6f38d994c7c091c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691562564, "uuid": "86d134a8-a4ff-4f06-ac4f-482db161b9f7", "comment": "Malware payload", "value": "0df2d2af779d7d2818145eec503dcd564db1d6a0a1a9b2fcf2f217127f014e50", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691562564, "uuid": "f7a69ca2-6e04-4f74-9f2e-627c9d56db03", "comment": "Malware payload", "value": "92f0ed5113dcf0945b20902ca2e6e82288f410bd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691562564, "uuid": "23eae1a3-864d-424c-9453-31f25e9c4e49", "comment": "Malware payload", "value": "7494b18bde5ef17919ce66158eecfae88dc323a63bfdb9e4beb5d0dc1ce800c0df28eef93cbd5b832c42380aadc9b23c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691562564, "uuid": "6d358b4b-3aba-4d2d-bd86-c2ae6792c98c", "value": "T13C42A210B3F2C666E1A56E318EE6F5EB3735BC119D20C70B3184731E2C3AA50CD62B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691562564, "uuid": "5866d981-05b4-44e5-86d9-e3631b34c877", "value": "192:yAZutS7oDSmxpVdFIcI2I1yXEZ2SyzQa:ySuo7oDzxpVdFIcI2I1lkS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691562564, "uuid": "b7d65222-e1ad-4fcc-bdd4-e43d88e36f0e", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691562564, "uuid": "6bd95476-63ca-4728-991b-a04380cd6b0c", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691562564, "uuid": "3740b554-c4f3-4d4d-9af3-6f3596e42fbd", "value": "SecuriteInfo.com.Other.Malware-gen.32745.8398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8659a1cd-36f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691615582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615582, "uuid": "43ac1049-69e2-4061-9a14-36b656a0ea32", "comment": "Malware payload", "value": "4cb1a7cb21db24824c33bfd995dae81d", "object_relation": "md5", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615582, "uuid": "f37fbd8d-a7d4-4065-9791-2f369212de9f", "comment": "Malware payload", "value": "0dfbfd429529d8ce274ecd35f1e8faa55e7bcfc16a93968fe6fbb109f7955654", "object_relation": "sha256", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615582, "uuid": "7b62f67d-c268-46a8-b7d9-502465acc2c9", "comment": "Malware payload", "value": "59739c2f8186e20bfad09eb029df6688c673ea3f", "object_relation": "sha1", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615582, "uuid": "6ea045a8-4752-4087-925f-0fdc50969b44", "comment": "Malware payload", "value": "ea4558b3d59646f7691c5d01c302255e79f776a74b845e9ea67f1dee09bd1e74a7800889426f17b9226d6fa551c81482", "object_relation": "sha3-384", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615582, "uuid": "dd9d4981-3223-4092-a834-dfd61c7afd32", "value": "T1A7E07D8E1A17C2A4EE515B31A04384C5D10FC0922C74FC340D03C44E006C160C36E2F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615582, "uuid": "117e80a5-ce62-42aa-8dae-467d7a70c86a", "value": "6:VtGTicwuTg+7yN03mtV5HPrtsoGRmIV55Aw5mIV5FG3HBU93xWioEbeGs:VtzBuVC55HPQbhFyitozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691615582, "uuid": "8066e19f-f868-423c-92e6-7d13817b8639", "value": 354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691615582, "uuid": "a9f38319-e46a-4fe6-b0fc-fe82d3dd4a6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615582, "uuid": "e6bed2f0-7131-4ebf-96ec-d0a82f57693c", "value": "launcher.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d334479c-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691549139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549139, "uuid": "5c070dd0-5d40-48f3-8d45-807e6e2626a7", "comment": "Malware payload (RedLineStealer)", "value": "58b53f462a632758c1e24c15d7714525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549139, "uuid": "7c6b4e24-d4ae-44eb-bf48-d19d3a517676", "comment": "Malware payload (RedLineStealer)", "value": "0e8f861e6bee75e0b586f2247c6c499ce6f410cb944de424c11623d220233cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549139, "uuid": "26f718bb-06b5-4a2f-97bf-6b9d0afbf83b", "comment": "Malware payload (RedLineStealer)", "value": "a6bcdb94e46db8926d310dc112a5aaf6d63e1187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549139, "uuid": "a086b5ca-9721-42c2-84a9-98267496419d", "comment": "Malware payload (RedLineStealer)", "value": "f7bd6762242816e1e0ae5061bf9bc43f899457e32afc5e11876e7b48d0a8a39892615028ff1325be417134c30566d015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549139, "uuid": "88771678-177d-4f91-b244-cae43fb526eb", "value": "T1A4F40130F6C584B0E4A61D341EE1B771AB7DB9310B7A8EDB5B400A5E8F705C09A35B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549139, "uuid": "b4ee8903-1d3f-4b7e-b5a6-70c3f6db611f", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549139, "uuid": "95b65447-3ac9-420e-b8cb-bb8dd02f2cd6", "value": "12288:f3DkEGDINi1EwkG8vb3NKjjIH3YJ28lJC5M7lJWbOP4rujY7OuwOgaBFXXChsHW/:/DkUNi1EvGwIXyKJQMjWbbrTwOgmXXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549139, "uuid": "d591399c-ca96-4899-8035-17e812bdae64", "value": 769207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549139, "uuid": "49ded9a6-01b4-437b-b9c5-02a1cb82aadb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549139, "uuid": "ed0c3aab-d296-415c-aff2-e1b3957b16b3", "value": "ORDER SAMPLE LIST.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb353f8d-36b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691586975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586975, "uuid": "ed8208b4-62e5-4b1d-b8e9-fb2503c2217b", "comment": "Malware payload (njrat)", "value": "b05e5d6143d9d2c3f596909174db9799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586975, "uuid": "7317f41e-7851-4319-bd81-e47d605e742d", "comment": "Malware payload (njrat)", "value": "0f4725b32cccc869792e78f7ba4a2546f0aab248b74d9598a991d6131b960f01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586975, "uuid": "7c12b4ce-4ed2-4824-98e7-694453c5589f", "comment": "Malware payload (njrat)", "value": "a547be917732da484516a818d0127148be4af456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586975, "uuid": "50943c5f-f5d8-44e0-ae7a-f6d77dc7ee22", "comment": "Malware payload (njrat)", "value": "f20fa28c46dbe26665386660db4085eb7b831924378d9457574f4d35a439e3a31494543abd1d7742f79e0fdf9d87abc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586975, "uuid": "38563903-e6b2-4826-be31-4a9c73b744a1", "value": "T10EB21A4E3FA98856C5AC1774C6B59A5003B491870413EE2FCCC954CBAFB3BD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586975, "uuid": "a7368fb2-4c75-4ac7-bffc-fb3823cc33cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586975, "uuid": "e16dd849-a539-41d8-bbd1-79d8ef00c187", "value": "384:vQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZ7R:w5yBVd7Rpcnui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586975, "uuid": "813ee144-384a-4719-86f3-fe14edbe53ff", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586975, "uuid": "11ac196b-a1b3-4612-956d-401ebbe077a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586975, "uuid": "ca37375e-7877-43f3-b5bd-e2303edf005f", "value": "b05e5d6143d9d2c3f596909174db9799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8091aa14-36a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691580353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580353, "uuid": "a207ecec-c844-4c67-9635-4d7c48a2f80e", "comment": "Malware payload (NetSupport)", "value": "a9d1dd12cb4c7c485f4966ca9963106f", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580353, "uuid": "3f4f933e-6c0e-4a5e-af05-ee1d32f4f0bb", "comment": "Malware payload (NetSupport)", "value": "0f60de2be1866531b161938db76c3aaf16a199ecf99675160bfb6c93336918c4", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580353, "uuid": "af5c7bfe-1faf-4592-9197-aa29ebc43a1b", "comment": "Malware payload (NetSupport)", "value": "7b7a3f4c2d0488fe4cc23419e50407919843fcc5", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580353, "uuid": "f69015c4-44dc-4f87-a4a1-c4bd98f9cd65", "comment": "Malware payload (NetSupport)", "value": "8311a5c9a33a3071adf619b303dad946890f29a0ef62ceaf486a4e458b3b251fd570fef9bf3d03848aa439f6cb43645e", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580353, "uuid": "b8370ac7-16a7-4b4f-a985-3790140d2532", "value": "T10045DB34397A7C2443EBDA1334F14B961CD9564FD1703A3B1A9AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580353, "uuid": "af31e2a4-53b5-4009-954f-309a81f91b9f", "value": "1536:ipo88IuUwWkypa+8bCCYq/P6Oitao1Af69gdeSBU9Zmv8xi4GIm+lIWFq0y78DU9:ipo8gHWTpa+8dYMMko1o69Uej9YvYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580353, "uuid": "e7e20248-3d29-4640-b5c9-836deaf00129", "value": 1252186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580353, "uuid": "ed38eec9-3aab-41d8-9519-95c7eadd38e1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580353, "uuid": "810996a1-531b-4b86-9b7a-4d9427dc838a", "value": "independence.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2577389-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691574961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574961, "uuid": "6d66f52f-7267-4493-b0ac-75ac41982a7c", "comment": "Malware payload (Mirai)", "value": "e899cc60546e1ab152ad3ac5396098df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574961, "uuid": "af2387bb-0f2f-4127-866b-401889d66ebd", "comment": "Malware payload (Mirai)", "value": "10e09660b2956daf14dc6e72b4c57fa95a0fbe06bee2e15ae948bd67f2e21b0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574961, "uuid": "1479dca7-3a1b-4fb1-8146-a9e718c96b97", "comment": "Malware payload (Mirai)", "value": "9b9d2f67be5f1c4e979fede6d3a124c4656d7266", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574961, "uuid": "08c38f00-22da-49ea-921a-4bd75534d7fa", "comment": "Malware payload (Mirai)", "value": "6a929fe0ca023c20d952346ae8d64c0f265778a37e9af3b1e4d89b51cc1cc0277381e7a7c3703752b3e3e9308f26632f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574961, "uuid": "58475551-c130-4bbf-bfa1-20973911b16f", "value": "T1A5230220D7C945B9FAEFFD784AAA86E10BD309CB1179EC711342D99E617C8214D02DEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574961, "uuid": "a4d6f5ae-8c04-4bf9-af25-f573a6d42f7e", "value": "768:euAsZFr2OWNH7RTC/c/ENTGEQgIvIHcDRQ/QMURGsFKkNfjdHNrQT4uVcqgw02T8:eZWFKnNHE/vxGEQDu//URGmbRhVa4u+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574961, "uuid": "77b0b076-a0db-4c53-a681-056b98f50b7c", "value": 47132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574961, "uuid": "eef693e7-c489-40ca-8075-e97d8888c157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574961, "uuid": "7ec42a3e-2a71-4dbd-8e36-f7b19d7949fa", "value": "e899cc60546e1ab152ad3ac5396098df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65694690-36a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691579019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579019, "uuid": "b5efce0e-6dfb-43fa-a7ac-c02fae01068b", "comment": "Malware payload", "value": "89727d0f73607d83ece6e782af14016d", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579019, "uuid": "740812ad-dd30-49b1-9843-66e7c1766f9a", "comment": "Malware payload", "value": "1126845e909b7c776e5b48bf64db24f19b0183b7204f50aedfb8ecba52c8dcbb", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579019, "uuid": "1637f2e8-4588-4c1b-9ae2-fe2966f54287", "comment": "Malware payload", "value": "0e16a20c0e9dc020faa5df28a16a24ee9d5c19c5", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579019, "uuid": "a38c739b-2e05-4dc0-844f-7e38c78d5406", "comment": "Malware payload", "value": "b1289e9973443ec2caaaaa8411974f9c5bce9133622103ee438f6883f35aa321c6b7ae446950f16cefafcfc88bab0d36", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579019, "uuid": "ec64b7e6-cf85-4bd2-bee5-707c04eb1148", "value": "T164219E141BF54709D7B68B39A8B2B325C97BBC45EE019FCE129083850C25110F85AF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579019, "uuid": "9d8a716e-b197-4fa2-90dd-2022de2a7943", "value": "24:8mo2OglP4CZvaMcKZrhW8YxbhAcWmk+/CWby1TpXl7aWyImdab/2XT:8mOglJZUTWB1H7aIuab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691579019, "uuid": "d4710e0d-64b6-4620-bf02-550f6666acc5", "value": 1370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691579019, "uuid": "45a6e29d-7376-4a45-83ba-0aa27fbd15e9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579019, "uuid": "ab87d986-e23f-4edf-83c3-aee7c95caaf2", "value": "revenue-en-local lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d9b3fa-3688-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691566860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566860, "uuid": "86d240dd-da20-46cd-afa0-9eba63507d8a", "comment": "Malware payload (GuLoader)", "value": "049b9014e6f8a2694db9e0a2d22b7599", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566860, "uuid": "e98f792d-c81e-4607-a743-4209b456ad73", "comment": "Malware payload (GuLoader)", "value": "119a8db677b0d17dddfa22a63ee173517caaab0d36605bb0f36b6dfa6c118f0d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566860, "uuid": "608790b0-a0e7-4aaf-9aa3-53899b8af37e", "comment": "Malware payload (GuLoader)", "value": "789da03f8239f32de6c79e548727d1a9026d8b1d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566860, "uuid": "5fcecbee-0ba9-4d40-b528-debc4c0a6de1", "comment": "Malware payload (GuLoader)", "value": "39772956678b2fa15dfb296aef4a0585c4daed8389b2c1dcf3b0ff6085a5cd2d5eb46300a5fd0609fc747da0f89fd195", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566860, "uuid": "bfe14330-a6f3-43a2-94dd-7468ac289e9d", "value": "T134725C949BC601350E3716B258074364F9FB5CB78871DCBF2948B2681BD270BAA7B53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566860, "uuid": "53efc5f0-045b-4e77-9f97-4e4550a24d08", "value": "384:eMerf4wOykhi+eRvezHGDx6xpuMcFrh/zzqRBwb:evrwwOyX7z4YFVrzRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691566860, "uuid": "8a4223f6-76e7-42ff-be9b-8c8248c4b561", "value": 16293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691566860, "uuid": "68fbe6b9-a331-4494-a5f0-dc8f6ae2a606", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566860, "uuid": "fd4a5352-e88e-405f-9b80-d4006c4dfba2", "value": "glicthed_toilet.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edc3162-36f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (OskiStealer)", "timestamp": 1691613690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613690, "uuid": "5b4787ab-7c6c-4eba-984a-10757dab7cd1", "comment": "Malware payload (OskiStealer)", "value": "a9173de71087efdd86e903af04eb8e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613690, "uuid": "b7f81afc-d543-4fff-b8a4-c32bc3d6c91c", "comment": "Malware payload (OskiStealer)", "value": "1214ecff163eb393c89cdf5d4623b40eae8150af6ec578bbb26a535b66af822a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613690, "uuid": "5ce0aaee-4213-44cd-8ece-dcbd7cec0e3c", "comment": "Malware payload (OskiStealer)", "value": "52c9d2a0b2a930070da73df07de39bf7c2f16691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613690, "uuid": "2b5ef867-9afa-4b4a-9b06-9b2b6a9112e4", "comment": "Malware payload (OskiStealer)", "value": "73043a2c8f0e9b13450cb0df067dce416626a46297d574dc235172238a37f40b20fd0e2be98e56886c313444455892d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613690, "uuid": "875d7882-556b-4316-8477-c3b7cee2203e", "value": "T1AD444B31B961C035E8522178E9AA87BA7B6C7D311B1600CB63D87E6A1F732F17E31617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613690, "uuid": "ac7b274f-6da5-4273-a5ef-c41c75d9e2f4", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613690, "uuid": "2eccc0a4-2925-4deb-ab04-a617d3a723b1", "value": "6144:AfUauY68uSWCx+XA7mg2pNv1LjCei8TI3c:4wY68u1Cx+wm/pP7TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691613690, "uuid": "0f58b7ef-760a-47bc-b5d9-e3cc3dd83c13", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691613690, "uuid": "1d045c3c-b3bc-4860-9a59-f46ba37fdefa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613690, "uuid": "70a05bf8-eea6-41e5-9c97-ab85243f8c7c", "value": "a9173de71087efdd86e903af04eb8e2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53d8631-36b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691588200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588200, "uuid": "70320d40-6748-40ae-9383-67435cc882a1", "comment": "Malware payload (RemcosRAT)", "value": "a87b117a16b72275496d7966eb5cafc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588200, "uuid": "3e0789f2-9d35-48d8-8158-0d4573a099c8", "comment": "Malware payload (RemcosRAT)", "value": "12a5309b110e495c50dca3f04195e1f0395874f6103e0fb67e3a1f4f9ad142ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588200, "uuid": "922c977a-2ae2-40f6-b83a-ec972f495709", "comment": "Malware payload (RemcosRAT)", "value": "262982d1d688dfb96b77bcb2fac91b16a8750a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588200, "uuid": "ee395594-74ac-40bc-8dec-0ba72689db6a", "comment": "Malware payload (RemcosRAT)", "value": "a17c6edf0a699eb35e911198f8f694a390071f6531af94e3c3b043ffbb3468069b42242664542e43a37378cf426d6c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588200, "uuid": "7f2b6ffe-88ba-4abe-a0f7-81b6e317e0d6", "value": "T1982523023B8DA526CBED067B95A371450BFCF3B37C55D28B6DE0E8141E96390A065AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588200, "uuid": "7848664d-cb36-462a-9ac0-c914401ae7c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588200, "uuid": "f3eb59f1-502a-435f-b931-b60bef3776fe", "value": "24576:oIOu0YkTsMvF6dub1jo6ok1DfGQtiokwBXYvIRBfI:bQfs+8du5HDBtrbqwnfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691588200, "uuid": "fe4b37be-1de7-4335-afd5-c5c32cc16216", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691588200, "uuid": "56392819-f559-44e4-bd8c-2a4d9f1ca95f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588200, "uuid": "31cf9bf8-9741-4bd6-bc49-e40a1ffa935f", "value": "Absa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10820c4-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571952, "uuid": "bf16fbcf-3b23-4993-a9e7-bd067fe5515b", "comment": "Malware payload (Amadey)", "value": "8bc90a9b88bdc326d2ed9176e5f7331a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571952, "uuid": "6c0188db-b2d6-46b0-aa2b-f5d8506359d9", "comment": "Malware payload (Amadey)", "value": "12ba42d4bf7fcbfd62262e59e5f4ee9f1632154f2effef473967eda66ec11115", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571952, "uuid": "cc642a9b-de5e-405f-ace9-97be8fd47da2", "comment": "Malware payload (Amadey)", "value": "66cb05d6f12caee160ee8636d020b3e2213abfde", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571952, "uuid": "5b4e18e4-83e6-4201-9c14-4d8ede46ae9c", "comment": "Malware payload (Amadey)", "value": "b4ceb83351dd6ae3da3786aa13b19e18056b69c600545f6a94870850ea78a00fcaf03309fcadf955dcb75be49933e150", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571952, "uuid": "96ff6dad-3ee6-4171-9ca1-25540e5b2f80", "value": "T14DC41212BAE89233C9B50BB00CF603571B3AFDA54934432B2B51E95F5C73694B572B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571952, "uuid": "e136d5be-760c-4399-b8df-8fdbd36db917", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571952, "uuid": "c9fd9d9e-8177-48a0-8fde-629f15723ae3", "value": "12288:5Mr+y90MP1BL7gv+RSwPPLKETJiWplGpKQAc:nyTbLKGJb1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571952, "uuid": "3997e857-793c-476d-9491-9730ccc17a10", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571952, "uuid": "3edf3bb7-3f66-40df-9dcb-1139106608b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571952, "uuid": "3f9c2fa5-7b0e-46df-b83b-bcf2641d1a77", "value": "8bc90a9b88bdc326d2ed9176e5f7331a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2fe5d3-36e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691607005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607005, "uuid": "d04f7f69-09b0-4445-b373-d23498c1b4cb", "comment": "Malware payload (Mirai)", "value": "4b48dea1fe627bcccfb0eacf8b93245c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607005, "uuid": "3f16ca28-44bc-4037-938f-c8c1602b8160", "comment": "Malware payload (Mirai)", "value": "13320c7c70c1cb23b48923f9405ee26590cfeecb69767399ec13507dd475fdb2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607005, "uuid": "e70903b7-590d-4e89-aa66-34012115bb95", "comment": "Malware payload (Mirai)", "value": "e2efad0c9ffc1d62ca341a2204279317ff8c964b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607005, "uuid": "d81ad994-d7a6-4538-a168-90479d292dd0", "comment": "Malware payload (Mirai)", "value": "465edf436b73b8a7ee51bb585202f7321f488b43105a539818d12b547654ae5b0c256bd70a44bdf9bebdbfee6afcd7b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607005, "uuid": "33139a45-ff8e-424d-b96c-3204a003b0fe", "value": "T12A730846B8918B26C5D023BAFE2E018D33235BB8D2DB3207DD146F2077DAD5E4E67952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607005, "uuid": "05d64f34-1247-4651-b195-212b6c862e9c", "value": "1536:fqnD2/DDSILgSp+oNgis1l/ZdfuWRbSZBxEvOZzin1Lzk8rEW5hBNYIJ70vOJt/D:La35hRbSZBWWZzKBzNrE69Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607005, "uuid": "09416849-62b3-44ff-9648-3d1638deec2f", "value": 75168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607005, "uuid": "77cf71ad-1431-4b0a-a401-14d6c1e62867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607005, "uuid": "4c3f7a50-49e3-4532-ae00-dd8f99799919", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cf7fe2-36ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691597171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597171, "uuid": "073e66a6-6a5b-4a04-8a5e-db18fed116fd", "comment": "Malware payload (RedLineStealer)", "value": "3d180ac03c7fecca34df3343603b81a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597171, "uuid": "e92ff866-67fe-4b6c-b686-6f877903bd36", "comment": "Malware payload (RedLineStealer)", "value": "14a42238363dad075d6fe2c0ce8dd5ee5047988a037a2c705ff4dcef874128ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597171, "uuid": "282e2965-0f07-468c-ab6e-e82fb911dc57", "comment": "Malware payload (RedLineStealer)", "value": "4d0891b7055427527e5f918008b7bdaeb6a6a0ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597171, "uuid": "b395e8eb-427a-414e-817d-368f8b3a95c5", "comment": "Malware payload (RedLineStealer)", "value": "ae8dfb16f85d6542d595f86fa3677c85d15c59419daa48d338d83fa1d4eb9f669e2e1a612b4c8cb9a4527cbb193b1ae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597171, "uuid": "b1b39e2a-d3e1-4001-8842-e89bc8697f7e", "value": "T1B6C41202A7E84073E97527B02CF712C31B3BBDA2947443BB7759995A0DB3A907872727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597171, "uuid": "ca33373e-fdb5-494b-8ec7-b615e780d97f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597171, "uuid": "5faec6f4-80ca-4764-b2a8-7013f41c621f", "value": "12288:XMrQy906qAz7Rnvs/VY8Y0Shkx+xISy61e4:Hyl7RU/VP9xlTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691597171, "uuid": "df9dcdcd-2800-4200-a319-3128c70c3d92", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691597171, "uuid": "207cbf41-3503-4564-ab12-e567ff68be63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597171, "uuid": "21ee31ac-8129-409c-9af2-b5224e05e608", "value": "3d180ac03c7fecca34df3343603b81a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9d2e1f-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691571628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571628, "uuid": "84e21af6-7180-4041-9478-cde7911e30cd", "comment": "Malware payload", "value": "49ae0f544d6156cf540413d949c96aec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571628, "uuid": "bfeb21c7-0c68-459a-89ed-4283ee674c74", "comment": "Malware payload", "value": "14bd7a0ad86cf3e18ca992539535c065228c84ab81150a6f6099f2618a87b095", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571628, "uuid": "d766e00d-bc23-4c1b-9617-9317a054ad8b", "comment": "Malware payload", "value": "0e82416524801dc58167d6cca3a80403bd9568c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571628, "uuid": "d4f15c19-ada8-4221-9a0a-81a4333f5aad", "comment": "Malware payload", "value": "7714d1d947779a392e78cad6e1ff8f8bce4dc2562409cb6031ebe9f419f0c05c0f8dd74a017b503384476355cccce7b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571628, "uuid": "6a2b906c-6681-45f5-8fa3-d6f031316535", "value": "T13743F1924D4D66B0EAA11B32F6AA071B177C77F4D5DB3012A32CE3D8AF5200BD75A2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571628, "uuid": "a3d46c66-9393-4d4e-b861-699d0a026001", "value": "1536:5BWooK0f6h1jNWgVY9z3pY7lwSZdc5xFqJ8urs:uRhcjNkFamydcRohw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571628, "uuid": "be0df99f-54be-4e72-aa71-056fe3f448b0", "value": 59684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571628, "uuid": "3a9a7e83-9527-403a-b189-ea7c4c26f1f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571628, "uuid": "493896c5-384f-4b98-b8d7-e197bba3f12b", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1f560d-36a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691577957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577957, "uuid": "79af96c7-69a4-473f-9778-acb5d93ecb8e", "comment": "Malware payload (RedLineStealer)", "value": "0cbadd29af01cee7fd8af7609aea9e8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577957, "uuid": "e8e2f4af-f93e-4bfa-bbbd-c9750a916a73", "comment": "Malware payload (RedLineStealer)", "value": "15bd64bb4be5bd22c363ab5e8772a2ba7ae3b42d72c4afa2b7b1f259957cb661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577957, "uuid": "a883e1e4-a56a-4af5-8868-78410a5e4a15", "comment": "Malware payload (RedLineStealer)", "value": "93622ec337795619e077392bcb6ac16779162e54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577957, "uuid": "dbb41ce7-6018-48b6-b653-19f956fe08b4", "comment": "Malware payload (RedLineStealer)", "value": "dd8ef1fe3ca1c3e319ca04f336a75f2fa14b3e516e0bd1aff5de4176ea0830580b2f0ca20f4b4d919c25d8c1e6c04a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577957, "uuid": "ebd868ea-e491-4f4c-8078-a1b74496e44a", "value": "T109C41216BAEC50B7DDB6277058F603930B3ABD618DB092AF2745A81A1C737C4647273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577957, "uuid": "a117da5d-1e71-4769-83c4-8626d3efa0e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577957, "uuid": "d1c627fc-0862-4bf0-82f8-1a2a70014fcd", "value": "12288:fMrHy90LBrI5d+cknd7TG+kR6x4vsUdoPu7GUT6IGMj4gxvZV:Qycyd+cKXYRC400oPu7GUDGMpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577957, "uuid": "8c3e61d9-e8d3-4bd8-bbde-e1cbb67e9c30", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577957, "uuid": "92147e73-530d-499d-9ed2-f9b3aec993b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577957, "uuid": "5fa246b2-ac20-4cda-816c-24f556cc2195", "value": "0cbadd29af01cee7fd8af7609aea9e8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc93e32-36cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691597475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597475, "uuid": "5e79e5ac-d311-40c5-8195-ead1b25e90cd", "comment": "Malware payload (RedLineStealer)", "value": "abd4d21954bb7306fad04f97f085f111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597475, "uuid": "680e016d-3716-40c6-934f-1a557a88d52d", "comment": "Malware payload (RedLineStealer)", "value": "15c40e38a67a8839a522994a6dbb1672b3367fc94b7a6b3cde07b55ee96984b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597475, "uuid": "42cf107b-cf8a-4089-ba77-7d3a24a21ec7", "comment": "Malware payload (RedLineStealer)", "value": "ae082eb3506486d53d8b8b4edf109740a1a0a006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597475, "uuid": "891e35a3-15d0-4d3d-bab6-d4af0ad3ec80", "comment": "Malware payload (RedLineStealer)", "value": "3938873c213b4ab308798054dc71355c1cbe9af27c5e2503813430fc9639628aa485e822d47b6789067250e756fcbb7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597475, "uuid": "6a48b0a1-4eb8-4c76-b060-8699b1cf2da3", "value": "T1FAE41243ABE98032DCB527B168F713C30B367C909E79825E27879D5E0CB2650A47677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597475, "uuid": "717c83a6-2b77-4d7a-b865-a89e231db4b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597475, "uuid": "fe83cedc-0502-423a-9ff2-cffe4553c089", "value": "12288:uMrUy90voWwG3WPCwym6UDnKaYUO0Hz92tJSVh87CkBlH:+yzWwZHyYzKX0T92XSv8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691597475, "uuid": "ab5728ec-6e96-4163-a90e-31924aabb458", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691597475, "uuid": "b9e64cc9-1e3d-4bf3-9391-25cd8022e5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597475, "uuid": "844ca1c0-b750-4e4d-a837-fb47a55244be", "value": "abd4d21954bb7306fad04f97f085f111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965fe2ad-36be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691590268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691590268, "uuid": "1b66a512-7bc4-4ae0-8028-fd87845c253c", "comment": "Malware payload (RedLineStealer)", "value": "41f27ba2d05e41a8aca8fade06ceea54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691590268, "uuid": "3c45bd4a-e98c-479b-911b-e4d5aeae8920", "comment": "Malware payload (RedLineStealer)", "value": "16676057af0cc10ed2654a1b8310b825e1567f9f0e0bd8dd7758781f8d935d71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691590268, "uuid": "c572f45b-e1b9-4c1e-9f27-21c7a9a29a8a", "comment": "Malware payload (RedLineStealer)", "value": "1bfa596178b69e3507196f2000c7a104555f1e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691590268, "uuid": "57b37be3-8aed-4000-95ad-6ed026e08ec3", "comment": "Malware payload (RedLineStealer)", "value": "67ec7bc3075cce6a9350c4501baea271dedc7729df0b3f6d0f8706f61069e55d05029172a8522c3f4ecc85c2444a7133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691590268, "uuid": "950529d8-79f9-49d9-9193-8f87c2b72509", "value": "T14EC41252A3EC8072D4B5277048F606E30A39BCA25D74C32B374DDA5A4C726D4E53276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691590268, "uuid": "b3b5ea53-a8d6-4dd2-abe5-6a0edfabda4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691590268, "uuid": "315656a1-36b3-4e65-84c1-c5825471aed5", "value": "12288:dMrzy905ia/hToJYMMbwizR3K4M3gBYC1SnI/6vUo5:CymiaZ8JPiK2z17M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691590268, "uuid": "32b0c958-4e97-4ddb-93b7-573ea264ca8a", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691590268, "uuid": "b1e7d55e-562a-4233-b75f-91fa0b72e31a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691590268, "uuid": "2bdca58b-e58e-479a-a4f5-1513ec5bc23f", "value": "41f27ba2d05e41a8aca8fade06ceea54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48e0fd6-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549141, "uuid": "de9a02b1-2014-49f0-98f0-3e2ba21a6071", "comment": "Malware payload (Mirai)", "value": "a9587198b75113ef77ed2d3070ca6e28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549141, "uuid": "c5656448-55ea-4b19-9c01-2fd4982e4293", "comment": "Malware payload (Mirai)", "value": "16a17d900ccc86551b46966ea811d62c2c134baed5c794e06c50e88576b68bb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549141, "uuid": "44620b76-0b3f-49b1-bb83-6b6d4a9d509b", "comment": "Malware payload (Mirai)", "value": "795c7b1fa37f1b2c6254dba63196ea189e563ca3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549141, "uuid": "6ebb1930-acbf-46da-bb86-5182eaffd4ba", "comment": "Malware payload (Mirai)", "value": "20c955c79f87fc256692a9ffdc819a72e53812e985d843a25e2998d93e86787b858ea9dab9e49e27a908d4c5fc2eafbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549141, "uuid": "3643a957-3ee9-45f0-a967-11322acdc804", "value": "T173C2E1A360B5CD17C4A3827A5E3D19A621706434A34DEE2D776A5FC433860E0697ECC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549141, "uuid": "33607b10-0738-4ecd-ae58-086d401750fd", "value": "384:MsQ9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5CwTvDyLTwfflrTHOBFR0j/y5ZCA+Y:u5+Kcrb9VDJee2KTgdTHOBcK5ZCAyc1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549141, "uuid": "4dffbfb8-c5a0-4eb7-9208-a4f24b645f30", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549141, "uuid": "0ebf8f1b-9220-4a8c-87ae-b950df19ebd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549141, "uuid": "5bc13eeb-2900-4b31-b2f9-d4b72d3f2b06", "value": "a9587198b75113ef77ed2d3070ca6e28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36df8b4c-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691574646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574646, "uuid": "1d27fd55-1a24-42d8-b5e6-9d99d26caf7e", "comment": "Malware payload (RedLineStealer)", "value": "19fbd122a2ed2c71c6be7e0f9ece3e8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574646, "uuid": "6725d619-cee7-452d-8d88-3cdc61cb863a", "comment": "Malware payload (RedLineStealer)", "value": "16c31577921935f996768ef12863eabfdacef11f8fec4ed7711be48b8c3be3aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574646, "uuid": "c35c9476-eef2-42c6-96a9-a8d8c870a97b", "comment": "Malware payload (RedLineStealer)", "value": "d5942b9ef699d31816bbe324d33df1973146872d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574646, "uuid": "cb03b90c-13c5-4424-bd7b-71d8313244bb", "comment": "Malware payload (RedLineStealer)", "value": "b3fdc013e2fab164098d26cd3cb9f67ccf7ad46b59212f72e541cd0da2163850be130ad0364dd8e8b44624e3e3b6d736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574646, "uuid": "1ef29b19-8bc9-4066-9437-174e97959ae3", "value": "T11DC412427FD58433DCB617F058F643830B3ABDA14E78A3AB2756595E0C72AC0A47672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574646, "uuid": "3068a754-c357-45c1-bd7b-c133406c0702", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574646, "uuid": "6a46909f-350d-41d0-9587-03727bcbf8bd", "value": "12288:zMrNy900YZjmuJIto6wkZQThdRcVvd97bO6dN95:KyNYTJRkZMLRqd97/95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574646, "uuid": "f13bd47a-3bb7-44c8-8ef2-c49c119d5cbb", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574646, "uuid": "75812a89-f6ad-4264-ad36-81e62242c323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574646, "uuid": "d4333fe9-b080-448b-8aa1-f9c617714769", "value": "19fbd122a2ed2c71c6be7e0f9ece3e8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106ccbc2-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602929, "uuid": "f7ef5e30-a4db-4cce-9041-3b22a0d2b52f", "comment": "Malware payload", "value": "b4ebe61a7e0eff941669d74aedf44448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602929, "uuid": "6e94a4cb-e4e0-4cac-939f-9120c4015cba", "comment": "Malware payload", "value": "172998995b63bc4a4efc8f6d1d879e00822f6fe338f5bb04360b81e2b4c48473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602929, "uuid": "31ebb0ba-9f22-4709-9a1e-3b0d0d8c42ef", "comment": "Malware payload", "value": "c1541db0eca07cfc55bd836625679eea9152f924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602929, "uuid": "475931b3-357b-4654-b761-a411f8325686", "comment": "Malware payload", "value": "e109351403ce23d1cbbe77ba478b26b87219e95837aa586eac87c93cf461859fbeadf456c59ba0700c449169fa9fbfe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602929, "uuid": "859ed29e-38b6-4c80-a267-0851193ccf0c", "value": "T1B3C5A70E75486C6FDC1D04B28D1FA614875587BE56C3A647394B10E84B3F283AECDBBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602929, "uuid": "6a9cfb7d-2dfe-415e-a9fc-3d4fbf08cad0", "value": "24576:nhf0px22bHPywbdqzqeiTt6AbqLorDi6abtLjGmGYb6Y7vRs/+pOG4:qDvyq4qvFWL0ocG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602929, "uuid": "f72ab610-9415-4376-9f8d-5329c9359b1c", "value": 2608640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602929, "uuid": "50fe5c56-31ba-44c2-aa32-b23ef2f4ea94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602929, "uuid": "c680a302-1a42-44ae-95f3-6151649ae1aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81f7311-36d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691601089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601089, "uuid": "8156f908-f326-4bef-b1f0-8cc609487eed", "comment": "Malware payload (Amadey)", "value": "b14d9c48ba02472be9a0547b5b01a365", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601089, "uuid": "d7f36a84-692f-4ef3-84a1-7996955c1216", "comment": "Malware payload (Amadey)", "value": "17a65634e4c37b80db82fb03d45c43d6e330a39d3f7313295cbccc3a592b4c1f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601089, "uuid": "b0b7075b-1e6e-4b54-ae7b-2bc4fcf8dc15", "comment": "Malware payload (Amadey)", "value": "acdaf22fc3995b99618d58c4320f3de5d0b5054c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601089, "uuid": "1520ba4f-25a6-4cfa-a86b-c7291f4cdd65", "comment": "Malware payload (Amadey)", "value": "afc8c11e7c6ca2cf8e2a67b7b3ebe80ce204776d934b20f9191d62975e3655ff1a93cc63c9dea3d32b8442d243c2d2ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601089, "uuid": "15973c0d-09a7-420b-8dcd-e1ff5535a2cc", "value": "T1FE948EA139D818D7D49B0F3C28F256278DB8FA70483A552534C4B9CF5E9E9DB066C3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601089, "uuid": "9cea5125-6a7c-4de1-9f61-5ea95b27580d", "value": "29c7c0066ae014a2aae25fd8f0dc5834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601089, "uuid": "9c7e8052-ee0a-428d-9438-c17400d6fe00", "value": "6144:dhN21nID6lsGpALu5GzLyXV30lmo+pJeJMJKJBJTJX:dhN2lrls2ASkHylkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691601089, "uuid": "6b910190-0559-494c-b192-486383e68eaf", "value": 430404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691601089, "uuid": "d98d55f2-99d9-4000-8b96-1e9c85cebcfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601089, "uuid": "096a798d-859d-431f-9470-5cc70f1db893", "value": "b14d9c48ba02472be9a0547b5b01a365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a7739b-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549405, "uuid": "7f463b78-5d16-468e-b3ef-4e98dafd7abd", "comment": "Malware payload (Mirai)", "value": "f03b9589b271043798a87d43087f4d2d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549405, "uuid": "da3ff4d1-4366-41a8-a9c6-6eed80801507", "comment": "Malware payload (Mirai)", "value": "18113d0edb0e4ccf1f189068ecb87069716b0bd2fca352d141cba8609e0390b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549405, "uuid": "694b394c-3b98-47c8-aaac-a963e709eb9f", "comment": "Malware payload (Mirai)", "value": "bcff40e53a64e1e82c0d02fbaa16ff950085e339", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549405, "uuid": "c0578d58-f451-43f8-9293-475b3a285df7", "comment": "Malware payload (Mirai)", "value": "33d30c5dc7235101f48885666cdf0dc7fb7effcead8ca5ffaf6aa162165ab765494cd7250a0f4a6d0c333bb48043f5ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549405, "uuid": "3b3a8940-49b0-4bd1-ad77-15464b5a17f7", "value": "T185C33908EB508757C1E22BBAFA9B424F3333575473DB33155A386AB83FC5BA94E22415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549405, "uuid": "e2d04136-d32e-4309-af76-1efb087b89df", "value": "1536:6inAtdl383BbXAkZ7Egqm5x9fu2aUeOlryiOiAmxwm4jHROH9mQHhzw/9TmvUvMn:S8X3Km5x9fu2RHxwLjHIH4QBM/9mvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549405, "uuid": "22390dfc-2782-44e8-a199-89b3319c303e", "value": 125525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549405, "uuid": "86c40cdb-92d1-49fe-be15-2be9b355b481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549405, "uuid": "74672aa3-0593-4822-b75c-272925a1c598", "value": "r6vaw1.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d9dbda-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602936, "uuid": "45ee5688-833a-44e0-9b7f-14893bf8d323", "comment": "Malware payload", "value": "d28336a8cd23646ec8db86ae5e02690f", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602936, "uuid": "882fb6e1-9ac6-46a2-944d-67d62efb00d8", "comment": "Malware payload", "value": "1825870f396a5f687b92ec80c7d5be4936a92c28a3411b22096319e0210c0abf", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602936, "uuid": "fee8fd74-cce3-4721-bfb5-0d62f0d9d9e2", "comment": "Malware payload", "value": "e1dfcdb66ca9df3c32b3bb875f688c30aa1a8e1d", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602936, "uuid": "6e40775f-0784-4100-af76-2d6c0abafac5", "comment": "Malware payload", "value": "f53565e1c88589abfa8e2390c010e6914d0f06e05290ef5f680b38b81ab894b410d8a36c3cf9962457cb118e7fc81887", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602936, "uuid": "8b2ffc6c-8283-4283-a2e3-9322b22377e3", "value": "T10123028B0536C166EBAF20FDF001A70A815969639D50DDE84C4E1FF648C9FE8819A9ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602936, "uuid": "2b4b3ccc-a37a-4cf5-adc0-ea2647bb1c0b", "value": "768:vFoZAvb6oyOZ14bCG835Tlg4RpID4icODVci5oabFj2ycbzYjF0mKLT7HCfMG:vFnbP86e4RwDVz5bN2HganifMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602936, "uuid": "d1c4f16d-57f6-4052-9f1a-65f4f1640519", "value": 45714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602936, "uuid": "e2e07eba-ab14-4ee3-9f93-9b38004200e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602936, "uuid": "146fa5e4-0c98-4468-a095-1886a6582e90", "value": "Payment Order 2023-08-09.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c05d6d-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602993, "uuid": "5b5bccf5-a098-4f09-b1b5-6c1040949b7c", "comment": "Malware payload (AgentTesla)", "value": "7e999aad29e91f42569059e5452faf97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602993, "uuid": "3796c540-f13e-486a-a6ad-862408ea9952", "comment": "Malware payload (AgentTesla)", "value": "18291d45433ecc5bb7381d40ca1727c210435195ecba3a74f7bb74db05aec68d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602993, "uuid": "a910913a-4d9b-4055-8958-33c21b70bb4a", "comment": "Malware payload (AgentTesla)", "value": "e20c77fad7b6dca2393f49216a070265c3d93a80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602993, "uuid": "01974e28-c15b-4d8a-a000-0b7e8deac853", "comment": "Malware payload (AgentTesla)", "value": "ea1652258e584eb441aab9d443842cafbd62b85da1ece896eb527a91ea2e797d8c0f7b9aca9e9dc4db68d2a8f31a9636", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602993, "uuid": "2accc71b-8d01-40c4-8e08-8fae3cba5535", "value": "T10245010536789132DD04CA3469F39D11D2EBAF697BE0961928C4B26D0B326FDCF13AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602993, "uuid": "1dd455eb-a96e-4fd1-b2c6-dcd78cb585b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602993, "uuid": "c4f560c8-4c57-4b95-a052-61aa905e1dff", "value": "12288:sP+Y7BRe8EXCTrBgWqJsh7uxpqVt4+b6uDFW97cI927v0VzHT1v8riLcu3douGI4:sP+YdLECBwWR94gTbV7Af1HBPrATG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602993, "uuid": "8b8c9f24-0b8f-47ae-b7e3-93a6d6df7e50", "value": 1202600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602993, "uuid": "0f8e7262-3c65-4e73-ab6a-78ba84b0d31c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602993, "uuid": "b42e1d7c-7372-4017-9f1a-da3950cb340a", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7199d28-370f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691625086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625086, "uuid": "fcd82689-6945-46af-abf3-09e13c218afe", "comment": "Malware payload (Amadey)", "value": "1b95bc5541e6d1bbe7b4456cb75f6a97", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625086, "uuid": "76c8b417-8ab6-4588-9c34-c43ee316bdd4", "comment": "Malware payload (Amadey)", "value": "18824d83fe9ff5ea4c0e735e71300f4e8cff34435b6a09cf3c68b35ff0a2a01a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625086, "uuid": "c510b0ac-a00f-46c7-83d2-d32a715033b7", "comment": "Malware payload (Amadey)", "value": "1bbb2d595fc61fb19c3b323cf8d295d68978fdb9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625086, "uuid": "9bfef7ac-3762-4050-b60b-71d6800db81e", "comment": "Malware payload (Amadey)", "value": "2ac8dfbd86618468b5d6c67e44edbbcc09e18db130b37d62bd7b107797c463ae35f9593c07166172a197b351896489eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625086, "uuid": "8e35544e-bbe1-4421-9d68-8dea8232b9e4", "value": "T167C41252FBD8A173ECB023B094F602C70735BDB24A74972A27476D1A19B22E57531B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625086, "uuid": "03e74df9-0169-47ea-b47e-5087e4f93ed9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625086, "uuid": "7c851856-3b84-4e86-a79f-1533278009df", "value": "12288:vMrvy90pxZwMm0Q0xLR7WvAUPjDo6r3ugBYCibTrtWRWnuKd:EyKbfQ037WvLjDhTtzedWRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691625086, "uuid": "baafdb2b-9253-45ce-8f68-ff7443f04454", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691625086, "uuid": "e30d3d31-b330-422a-a04f-60530468913b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625086, "uuid": "48b9a195-d47d-46b3-b7da-1348df9c2c83", "value": "18824d83fe9ff5ea4c0e735e71300f4e8cff34435b6a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4d2a35-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623593, "uuid": "465172ca-a189-413e-998e-d555005e1d01", "comment": "Malware payload (RedLineStealer)", "value": "b1d5e46ce909a81ea101245830bb4cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623593, "uuid": "f62d46f7-4c84-4265-9917-2ed4568d41fe", "comment": "Malware payload (RedLineStealer)", "value": "198ae027df7277fb9285231f335f88cfc93402adc125cb48462c9ac46a91420f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623593, "uuid": "32f5f617-95eb-47f2-a848-04bc5a973be7", "comment": "Malware payload (RedLineStealer)", "value": "98a632f4e0c03e19506ad7a5a06904fa92fc2f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623593, "uuid": "14f3f06c-c61b-4553-9af7-1a53fa3c1f80", "comment": "Malware payload (RedLineStealer)", "value": "6245fa4e43eabc0741eab1e1ececdcc921bb702d686b97dc1ff44d63960bd3be3635363e8549f23a1fa4acbee9dac322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623593, "uuid": "7044556c-7c4b-469d-8b73-9ea12651c215", "value": "T10FC41212B6D98073ECB41BB01CF713D31B367CA28D7886AE1385A9591D727D0A63276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623593, "uuid": "7d81f99b-4b14-4dd9-a72d-79b39970666f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623593, "uuid": "a0d88ba1-d223-49ee-a085-1917dab5d50c", "value": "12288:mMrWy90GQ1PySvJXmWtTeYCQWIudyQPUa1ZQygBYClmJ+/l2fHUF:cyY1PDB/FGQWIudyw1iBzEY/gf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623593, "uuid": "52067111-54af-40cd-9ae3-49e23272162f", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623593, "uuid": "96f579f2-4ce2-466b-8f71-35a156b76fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623593, "uuid": "c51ed7ea-6e2d-46e8-a304-177fbb3d173c", "value": "198ae027df7277fb9285231f335f88cfc93402adc125c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb036f8-369f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691576750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576750, "uuid": "548a1f52-10fe-40f8-aeaa-05cd1606699d", "comment": "Malware payload (Amadey)", "value": "4fc725f0479df457ece5e951739ab893", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576750, "uuid": "43aa9374-6263-4931-82f4-ee1bd207f74e", "comment": "Malware payload (Amadey)", "value": "19fb7788efc624e8a0cabad7c23fc06ab7d665d03233c4bbf709a6b7acf3972e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576750, "uuid": "832cc0f1-632b-4269-81ba-d0318c48986c", "comment": "Malware payload (Amadey)", "value": "4d6474d868501600d4631bec8adf248b4b83bec0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576750, "uuid": "f2607284-cbcf-4b4a-876a-6396a097b95e", "comment": "Malware payload (Amadey)", "value": "c410e40a124c1adb30ed167989d7fcefaba6369ad0cc753b8d881257244022a6c98c3d697f1abb8a3946e52ccb8995f6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576750, "uuid": "caced7f5-02e1-4681-a23d-104e13a608e5", "value": "T14FC41213ABE95076EDF55B7018F602A30F317D615C34836A27966D8F0CB2994E832B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576750, "uuid": "1ca93fe5-d6f1-4a6e-8aab-b91e73c5e2fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576750, "uuid": "5e2485c3-65cb-40c3-9756-70c8bd752e8b", "value": "12288:hMrIy901EjHwWO/KLYFacSKkd/j8DJrEb00/mji4Z2ISgNwH1X:RyzjbYQOu8Dyb00/mu42ISmwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576750, "uuid": "05552782-79f4-4dac-b01a-a495bb4131c6", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576750, "uuid": "8a92ff85-3949-4d3d-930d-eb7848df3503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576750, "uuid": "38a57837-1104-48d6-b8f7-fa223270aad6", "value": "4fc725f0479df457ece5e951739ab893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0aea112-36d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691601560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601560, "uuid": "2e9689dd-8d56-4d7e-a50a-bf4b18edaa0e", "comment": "Malware payload (njrat)", "value": "7d28117ce1136bc8f5e96ea1f1f4213d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601560, "uuid": "ee734fec-5913-413e-b924-93737c56c872", "comment": "Malware payload (njrat)", "value": "1a95922cceb3c7f0b12212a4738da6ea8a7e6c9c83ff2a4c90d7ec69136519ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601560, "uuid": "a69afa41-ef7c-4321-aac2-2dfce50ad262", "comment": "Malware payload (njrat)", "value": "83ba9bfd103606cc4ccf0e2a5a459013e8e5d233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601560, "uuid": "5ea607be-bb03-45a1-ab2e-727a05dc87d9", "comment": "Malware payload (njrat)", "value": "0139037a245f558452dc848c34a2ab65d30176f9adb91cf7c3fa239f16837066e483379bad2c6e8ed200d464efe4f4e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601560, "uuid": "e4d10dc6-b9ec-4d4e-a420-fe4e40721d8b", "value": "T1A4E209467BE84225C6BD2AFC8CB313250772E3438532EB6F5CDC88CA4B676D40255EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601560, "uuid": "d8c07da0-df0c-479a-b0e5-0bf4e4d0bc17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601560, "uuid": "7ed1e398-0be6-4f27-bf7d-d5d4b9daaa0a", "value": "384:u0bUe5XB4e0X+OddlXCpF7r/6WTetTUFQqzFxObbM:/T9BudPlQ2zbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691601560, "uuid": "1926a63a-23ea-4e09-b826-b173b93b86d8", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691601560, "uuid": "f347870d-69ad-4641-a178-c87fdcd51051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601560, "uuid": "25102fb6-8e60-4f16-a56d-42af4377cea8", "value": "xqk3816u9fVB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515b1c75-364b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691540761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540761, "uuid": "dfe05b76-614c-4491-a945-8d74feac69bc", "comment": "Malware payload (NetSupport)", "value": "5ffa9afcf0b8f6f600119cf4c35b5c6c", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540761, "uuid": "1404c0f9-1fc1-4951-994b-a5f33acbb5bd", "comment": "Malware payload (NetSupport)", "value": "1addc06728d92460aad1805db7833ee30f67dd8ac81cd4acfcd1a17204d3de7c", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540761, "uuid": "c4fcd9cd-e4ac-4174-838e-442da4b476ea", "comment": "Malware payload (NetSupport)", "value": "f42cef68382195f6a8d0ee0b253b84d53a00b812", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540761, "uuid": "6e62f45f-e419-493b-9826-c5299d443059", "comment": "Malware payload (NetSupport)", "value": "4e42f2656d4ec69d28358b37b406727b583f8bebc8670268de55a9403a82e54c810be4631511fe44f5c85f5be8e28b0f", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540761, "uuid": "a137e717-d3df-483b-9b5f-e9b65c5f58fd", "value": "T12F45CB38397A7C2443DBDA1334F14B961CE9564FD1703A3B199AD8239A346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540761, "uuid": "ee7bf798-7083-4d28-a12b-d9ab270a0902", "value": "3072:lZkTC6BJdE0OryukNC0ButWPUTz1cmuhTAH2W4:lZkeYJdJOryukc0UtLcm00WW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691540761, "uuid": "77d66504-c781-46e9-8f79-b1e6858f1080", "value": 1253103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691540761, "uuid": "e3f34843-7c91-4161-8119-21251949c6ef", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540761, "uuid": "3dd15893-c4ad-46be-ba3e-6d6931926f4d", "value": "importance-x.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f590fb3-36e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691607007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607007, "uuid": "d3853c1c-7584-4b25-b08f-7f028c3998a7", "comment": "Malware payload (Mirai)", "value": "359b9546828728380bbdd6ae6a711e02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607007, "uuid": "724668a8-f033-4587-bb8f-aa9e7a0eb390", "comment": "Malware payload (Mirai)", "value": "1d7989bfa7ba5792f4c60905d0b91014a2e6dca236c0b680148e0f7e29001e95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607007, "uuid": "6f1bbfa0-0903-4ef9-bb15-6bace297db57", "comment": "Malware payload (Mirai)", "value": "f963898d55b418bdab1d389a13d416d137ece098", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607007, "uuid": "d9303b5c-5578-4e51-85ad-ae37fa3d1045", "comment": "Malware payload (Mirai)", "value": "fb9cfeda46354d7dcd3d4fc26bc151155f98dfcb2bec061fa625ef2ab37ad99f1bf12f4fa013eba54425ce1336643d32", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607007, "uuid": "e0286d34-ee2e-48c0-84ee-43f78ffc1dd6", "value": "T143532795BC928A02C9D423B6FA2E518D372263E8D1DF3207DD216F1177CA82F0EB7556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607007, "uuid": "ce9262aa-5db9-4a06-8f27-ba90d51c23e1", "value": "1536:pZ5ntHs3n6jMBc3XWmqgtrL2yBCZt5lh4xq2:pZ5nts3qr5dvUblh4xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607007, "uuid": "518e5e2b-215c-42a8-b0b5-a5f1dec38f0c", "value": 60804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607007, "uuid": "68805153-0d6a-48b3-bef9-163c34079a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607007, "uuid": "65ef57e2-8513-4b91-860e-af4f9aeeb5f2", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220fccaf-36e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691607683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607683, "uuid": "46a5bcc8-13fe-495b-b7d1-553b30d0b5df", "comment": "Malware payload (Amadey)", "value": "2faff36a7ac82093550db49bb3fd91b7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607683, "uuid": "6615df51-de2b-4c6f-9702-52bd2ce15d85", "comment": "Malware payload (Amadey)", "value": "1d846ccb3d95e49d719417310a39658f4d21fde5b9635fa61852e246eda813e6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607683, "uuid": "5092d7eb-59dc-49dc-8842-71f3744d6b93", "comment": "Malware payload (Amadey)", "value": "d24f6873b26e3b3154335ac1c316bd8bab09a05a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607683, "uuid": "3875915b-8a1e-4190-9940-f37ae0ef92e1", "comment": "Malware payload (Amadey)", "value": "647ce82ea3d2cdbb16f853d32c290c3cc588cf83b73d197c8e144a933056c71d5530f40921ed092f2f8231dbd56fd597", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607683, "uuid": "394acaa5-03b2-40d6-8220-514ba85fd4bd", "value": "T1ED13F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607683, "uuid": "556ca47b-14f8-4c67-8c06-ccb196d3c959", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607683, "uuid": "9f520589-21f6-4141-8cb9-ee3664883309", "value": 42206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607683, "uuid": "0adc261c-a79e-44d7-9209-4e694a47e148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607683, "uuid": "cf1cdef6-f946-4e2c-960b-a388ef636d6d", "value": "2faff36a7ac82093550db49bb3fd91b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e018c7-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606263, "uuid": "aceb4d7c-b69e-4360-9f15-c6f5ea40ca86", "comment": "Malware payload (Mirai)", "value": "6c21c5d3f676fce592de302feb112758", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606263, "uuid": "4795899b-ef9f-4737-a6b1-de5d770654b8", "comment": "Malware payload (Mirai)", "value": "20125d44d8fecd4ab96480f13b88ad4680157449f29d4ba100fe2b35f353a1aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606263, "uuid": "585c8fb8-455f-4cfd-a388-cb3583a556b4", "comment": "Malware payload (Mirai)", "value": "299f30f255eb18f997e6a81cebdc6aac40aad92f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606263, "uuid": "779cc01d-8ac1-4154-af52-b11df2e19bc2", "comment": "Malware payload (Mirai)", "value": "e10505e54b1cc8bbea5c6fa166f599569adbe8d17e9278f18a94cbe6d7a7272f752ab49ca0d1f3fbc1c252048bbbb036", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606263, "uuid": "75c3b842-05bf-4ad1-9668-aedcc7986218", "value": "T15ED2E0BDE0B952C5ED8E1C7E84CC3BB10D19A681631BCB9567218C8D5732C5BF17A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606263, "uuid": "10881b76-8545-4a0e-98bb-9c56c84ca972", "value": "384:i8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjHoua8MCRWGVCz0NvM:HMYHb62x4ahQ3CfdwLjga87Wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606263, "uuid": "cdfea6f4-9825-4f17-992b-39d1e3e5b9f6", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606263, "uuid": "5d42433b-b33b-45f5-8d98-7337abf297ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606263, "uuid": "f00c43ef-219d-4889-a843-a4eef708422f", "value": "6c21c5d3f676fce592de302feb112758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a3d029-36f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691615572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615572, "uuid": "dfd52340-60b2-4da1-be9f-0e266bdfa6c1", "comment": "Malware payload", "value": "97b7c88a02b2a5214d742b7ed50f4544", "object_relation": "md5", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615572, "uuid": "0e42db07-d629-4b44-8a5d-d929525c07e7", "comment": "Malware payload", "value": "20c3a5b1c87627e9e016494b806273230f5023cf12d2c0e29eceecb7b8a6d3b6", "object_relation": "sha256", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615572, "uuid": "6ffd7a3b-c77e-4ab2-b804-31cabea2228a", "comment": "Malware payload", "value": "15bf7dd44049b94db1a82504802ead45f6186fa0", "object_relation": "sha1", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615572, "uuid": "50a0946a-2c60-406e-a0d1-be64c66963c3", "comment": "Malware payload", "value": "45d5228b607e3d250eacff5b13a535a679914c8d960d3b8f7dd96990b438a531a3e3eb027ab085491aa56c481eb15001", "object_relation": "sha3-384", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615572, "uuid": "b51de970-ad46-4115-baae-9403cf74746f", "value": "T1E0D16C19C2BA8DE1C225910268A776D1CBACD041C0353FB8E545ACBB5ACF94B31CF91C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615572, "uuid": "5eb55ec5-52fa-49f3-adbd-29b273ef7318", "value": "192:GqNFRmxkyzz06ETWtd4pTunJ8ccJkBhKhgQ:Vp2kgzSTWsu6hJEhKht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691615572, "uuid": "dedca604-a77c-422a-a776-469689d7cfa2", "value": 6621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691615572, "uuid": "fb615a11-24f2-43ae-bcf3-b6086740ecaa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615572, "uuid": "fce278bb-e18d-4e53-aeac-62a8639f1f92", "value": "update.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9601612-3683-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1691565067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565067, "uuid": "75f7c387-1e74-4842-9d04-5d2e3afce7fa", "comment": "Malware payload (XWorm)", "value": "b6e3d5e468ef55f9f1b2af5ed5e84738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565067, "uuid": "b50cf171-d7df-4f60-bae5-0a70b20611c8", "comment": "Malware payload (XWorm)", "value": "22fa6583eb9e22be41af9734b5bd7bfe2c751dcc9ec33f4dd3096c79b0f10dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565067, "uuid": "04bbcfaa-eb2e-413f-aa42-919ad69214ce", "comment": "Malware payload (XWorm)", "value": "cc783d937ff821dc7587d4ae6742f142ce4608f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565067, "uuid": "4e911d1e-f340-45b6-aae9-003c782bdca3", "comment": "Malware payload (XWorm)", "value": "f8266adf68838bf3a27c486cdd0165899b2f0f1d717982e1c6a640ddfdc58e4a751843d75796cae1f4c5cecb81507fd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565067, "uuid": "6012d128-278e-4bd5-a2e7-005f31efdd3f", "value": "T108D3A5542960C31AD5C8AB72CD27B33D33A42E5D0832DB8E5570B8EE73371491A696FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565067, "uuid": "572219ca-020e-4ea4-9ddf-c31b31127320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565067, "uuid": "a6ca0b87-325d-4f4b-845a-2f08d4b7a6ea", "value": "768:ZUa+vNshO8q8poxVJt76JRVFr9jsOjhTbSZe7enyslZ87gUcXmEHNBFNJC5jWb2n:EvN4do97SDFr9jsOj1apysa7iAMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691565067, "uuid": "a8d9e722-7b5d-4347-9393-9a7f3ac09047", "value": 142336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691565067, "uuid": "d5c8a1be-b6cf-4c25-976b-b8a5e9cc1b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565067, "uuid": "fccf5cd6-f0da-40d6-83ea-3ac058e3da1c", "value": "b6e3d5e468ef55f9f1b2af5ed5e84738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91e9402-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606272, "uuid": "fbdd31ce-3cc0-49c5-972b-efbab2b3a450", "comment": "Malware payload (Mirai)", "value": "488d766809f1f4233cd69e7c6f0fc06e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606272, "uuid": "a41ab211-685c-4548-b3d3-69ff88571c0a", "comment": "Malware payload (Mirai)", "value": "23159de0973f2e39f13c575e6721af5b344d47f31051b95b2eaff22b825277ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606272, "uuid": "6a6a9cf8-a41f-4baf-b954-b1c4ae5f3dd3", "comment": "Malware payload (Mirai)", "value": "7f428fa549664b8b1bd991cc9e7f4da05a9e0257", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606272, "uuid": "8c606729-680a-4692-9255-551786b08887", "comment": "Malware payload (Mirai)", "value": "0f68062d1994773663245d9bbb33ec424402c92cc60427da2da5f8cc7b48a9e5cdd13d7200104f29022b010289432881", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606272, "uuid": "db17e5c4-ab2d-439d-be4a-1b6b54893745", "value": "T1E8C2D170F8C1B9E2DFFEAD78881189D03BF51F4937D1CDDA108DDD115212D229AACA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606272, "uuid": "5a2079dc-4d08-4c80-aede-f072174270c9", "value": "768:7KnqLiChP7gI5gBZw+LajRZ9z4uVcqgw09O:7KqL1h4Zwa6rB4u+qgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606272, "uuid": "a8b3fd99-4b91-42e9-b9a0-5f3c2f297adf", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606272, "uuid": "d1c4b6cc-69ce-4692-ac9f-2668c17da0c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606272, "uuid": "4f66c592-ef7a-4f22-8cf7-b8df6b6273f8", "value": "488d766809f1f4233cd69e7c6f0fc06e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af79996-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691583780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583780, "uuid": "77918112-612b-4033-bbd7-480e64a6d3f8", "comment": "Malware payload (AgentTesla)", "value": "994cf300e9078c09abdd7d95df6eadb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583780, "uuid": "e66a8191-9213-4392-a90f-3af0d6dfa9f0", "comment": "Malware payload (AgentTesla)", "value": "23d87b6268b3aa8446d0101b1268b1805f0427ad176d82245e873955337f7ac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583780, "uuid": "171bb23e-0409-46ad-99eb-0e2db59470e9", "comment": "Malware payload (AgentTesla)", "value": "e3adfa06cb686203fd689c518b3544b62ac9ab52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583780, "uuid": "4598806c-8565-499d-b570-6bd93dc6476a", "comment": "Malware payload (AgentTesla)", "value": "72ebbe4b840919528530a5f6802bd90ac3ae76734565260a8a9cbd007e6aae4595ac48f01fec35dd2b6749a5b249ee1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583780, "uuid": "1ecef55f-69eb-4943-9e4b-e2aedebd695f", "value": "T19DD4238C060D8DA47EBF3CB64C812865FF59629B179F9BA3BB22C98C57F0C51D81A435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583780, "uuid": "b7baa793-de2c-4c55-98f5-5b6b5852cefe", "value": "12288:izP3hATOyXqZCfv6ZyLxkDalJV55nDJk1py+EbK6Rs+W17TRhFV1f5tkF:iDg5XAXZy1qaP5nmw+EbKN+W17TRLHBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583780, "uuid": "3e012b63-7c6c-434c-80f8-75e0c03b854b", "value": 649605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583780, "uuid": "3ce89855-fd67-438f-bede-5ebb765e13bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583780, "uuid": "99f1c3bd-921e-4c11-a318-55c5bb1538b9", "value": "INVOICE 09.08.2023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dea19a-36b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691588167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588167, "uuid": "d95058ca-bcfe-4cbb-9276-ab01c43e3eb3", "comment": "Malware payload (Amadey)", "value": "b146160026af335cb0bb279c999e1158", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588167, "uuid": "82193dd2-7ffd-49b7-9b6f-12ea6ac91dde", "comment": "Malware payload (Amadey)", "value": "23e9f30fffbfeb3f145881d1732ea15b5196f755b51890eb98914db210c43f55", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588167, "uuid": "61d32494-6bc5-46ad-aec8-98cc394e3a7e", "comment": "Malware payload (Amadey)", "value": "139819ed1ddf8023237472036a4944f3850d17d1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588167, "uuid": "5189a60e-6885-445e-8cf7-beec2c8a01d7", "comment": "Malware payload (Amadey)", "value": "273686cdc142ecf4c8d3a5480b837fc6852185c8a95dddafc8e7266dfa3952fe069a2e7960e64e2176d74ac929b1525d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588167, "uuid": "4b4e6c34-ad6c-4dbe-a43a-b15da030de4e", "value": "T1E1C41253ABD86073CDF263B058F613931B32BCA19938525B2B86981F0C726D4B57673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588167, "uuid": "715e541f-65a6-47d7-b00d-fa91287959f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588167, "uuid": "1cd8034d-2fd8-4eae-bdd1-de7c00c1a143", "value": "12288:6Mrcy90WwFp2q352IX8hxodqQowy2tWiH+5G0In7O:iy6bWHydVowyyWHG3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691588167, "uuid": "27bbb364-71fe-49b4-9171-7521c80e3c24", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691588167, "uuid": "0938847f-d754-46b2-bf6f-668efdfccf5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588167, "uuid": "893583b0-2067-46be-8111-7dd7008f29fb", "value": "23e9f30fffbfeb3f145881d1732ea15b5196f755b5189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d93f79-36d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691600743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600743, "uuid": "cab055f9-d6ee-4e41-a644-def2a7b2a0b1", "comment": "Malware payload (RedLineStealer)", "value": "68fbc3bde1085d59ccb94e635b783ad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600743, "uuid": "84c56a77-3939-4fb7-aee6-180178c194bd", "comment": "Malware payload (RedLineStealer)", "value": "23fdb325235605dd05cda92f0275e08aa1d8e5df6973030835ffa63daffe74d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600743, "uuid": "91259fb3-0269-4d03-93d5-d08e718513ea", "comment": "Malware payload (RedLineStealer)", "value": "db22fda9282f1600d42ccce648376e24b9ef1378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600743, "uuid": "52c11432-1e2f-4aa2-a67c-e64c05546642", "comment": "Malware payload (RedLineStealer)", "value": "cb78ae244f2a12b44eeaa4d6a88e6aaa09c95bc496c48059e13a43f3c8b9c22fdc3e14423cb1d6620e69543c273e6cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600743, "uuid": "3e24d99a-2e2c-4485-8506-8b52eaaf34e2", "value": "T16E44D021B9E2C072C59B01704830DBB0AFBBB4755674A58B37640B7E5E703D1AB6AF4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600743, "uuid": "1b92e328-93ee-4b90-a2e1-be4a0389664b", "value": "21e75c39e5b8b26ccac618e4f1755b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600743, "uuid": "e5f57829-fd7e-4a98-a41a-9ac70e3c23bf", "value": "3072:MlaXHm0f6dOy5qJLZPNC+VJmuIwX0dXbBpXFHtg/eh7l1qxfCk2LWjo5xGKo:MwH1fr3LZVC+U1JpTflh1qWrGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691600743, "uuid": "a64befa9-5c26-46ec-a744-cc6dcbb108db", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691600743, "uuid": "e7c5b5a3-10cd-4e8e-b992-a6b19229cce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600743, "uuid": "b2c57bb0-0c86-42cf-9917-673ac7ecdbbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd54848e-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602843, "uuid": "181f4284-9b3c-4d9c-aa6b-5c9531bfd18a", "comment": "Malware payload", "value": "b4204e537d8529bae3a4476fd6ef1f96", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602843, "uuid": "14317274-72e5-4942-8635-5b0913ca80d3", "comment": "Malware payload", "value": "244104fcda8c3dac0341567155320c8bf68f04a7c251506b572f35d38c180388", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602843, "uuid": "5c803d43-5745-45d1-905e-83defdc94535", "comment": "Malware payload", "value": "8206faf6c1ebaf5591ea82ac4043bf52bcb21cef", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602843, "uuid": "c65f35ef-7a09-4b44-bfeb-2eecbb05a9b7", "comment": "Malware payload", "value": "0867add210c1ab897b705c54ad4726ed2262b435a18b1ba36408372c18c3037b0b3c9662a2c7e8e39bfad26bc1098f32", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602843, "uuid": "48b1599d-e899-46c2-ab51-507da3db978d", "value": "T1CCF423E0EF876D28CBF25736B3607B41F9ED9401E5295CECD016B4693E1432AD3998C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602843, "uuid": "3da5cbf7-28d7-45f4-b21e-4d0f5630ad32", "value": "12288:MFUpgPPB1MsdNsL0ZzFCURa0qnXNPVrPlxY6u/MzhFBaSubxwSaxvz0kHH/Mj0s5:MigPp17NA7UTqnXNtl+/MtFKdwhxvgk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602843, "uuid": "9dcdbe03-28c6-497e-acba-59141c0fb148", "value": 761452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602843, "uuid": "33454a22-319c-40d1-aebb-19299a767014", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602843, "uuid": "819f0f01-533c-4993-8a1d-c339a74c60c6", "value": "Request for Quote.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8b38f3-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691623597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623597, "uuid": "aaeaf396-ca67-4248-85f1-8feb69a707b8", "comment": "Malware payload (Amadey)", "value": "7a88f7b130bb6624f0eb29b283be3f37", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623597, "uuid": "b07b2470-c184-4164-90e9-d12ef9538a01", "comment": "Malware payload (Amadey)", "value": "248c2b325bb83cfc0bbe901e02534bde892ecc98e725b6cf8eee4c8446b27941", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623597, "uuid": "db112aba-cac2-4492-ba48-befbab7a20f4", "comment": "Malware payload (Amadey)", "value": "b1db25812f745ddc56dbc3f780ed900848192e04", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623597, "uuid": "500b6b9c-36aa-4175-8634-624ab3636e54", "comment": "Malware payload (Amadey)", "value": "10ec603a4ba1b2bd7549e5f177badf71631b994cc0e9fd3037ac89c66c4f7517cb27529f6e97f7568e787e714d3a7b2a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623597, "uuid": "b6820cec-14dd-4e61-a8e4-e2da1c7c3693", "value": "T14DC41263E6C440B3C9F157B059FA03A31A3ABDA08964435F3BE5995A0C72BC8B53573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623597, "uuid": "f96e5890-45b2-49be-8ba8-d807da2b3a61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623597, "uuid": "3a4ed949-7e92-44dc-a286-f66fea43e3df", "value": "12288:8MrGy90k7KElPzyTO/+4sBSaHPBTxVOX3SM:Ky3lKO/4B3HpTnSSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623597, "uuid": "8560bc41-7889-4655-8147-f83c5f5c0f0c", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623597, "uuid": "8fb33543-698b-4fbb-84a4-7e27f330e867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623597, "uuid": "3fed54c0-e399-49a3-8647-8f136d00e4a8", "value": "7a88f7b130bb6624f0eb29b283be3f37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b3b29e-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602859, "uuid": "70598096-0de1-41f5-8f98-ccc02ad389d1", "comment": "Malware payload", "value": "4c8c732cbd8f6d7a4d88df118ac81ca7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602859, "uuid": "f920d918-55b5-4b15-a89a-0a1547264877", "comment": "Malware payload", "value": "24edc0c28acc0625f0ffc312a8038362a9edf3f055a6c06b50cbd5ee39d124fa", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602859, "uuid": "7b2f85aa-e397-4e3c-8eec-0cea43a748ae", "comment": "Malware payload", "value": "df536a8d3f5b24980b29d8664c51a0714502cff0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602859, "uuid": "09502646-a15c-4840-903e-0f2cfd9bd194", "comment": "Malware payload", "value": "0915cc3e93ee8293dde3dd4f5ebe197be34ce08f10165e32a3efd233b94eb17d52ad41ef53f68fbaf58d983cb100c243", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602859, "uuid": "65502084-38e9-42c7-92fe-3a119b1aa776", "value": "T18ED423DE4A1149E4DBEF17352A7F5681868A5CDAA36979CFCDC3818D3B490983C38F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602859, "uuid": "e8447784-faa2-47e5-9fe4-b2c23288eb24", "value": "12288:GNGTMtskk5M1o1s9n4onH4QUn3RyFf0rUMZtVwZ0Q:TM6kkiea4onHOnBu46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602859, "uuid": "927e10ff-35a5-49c1-b8ea-c03e2ce48e6a", "value": 621729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602859, "uuid": "52b25cb8-6ca6-47f3-af0d-483578cd52e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602859, "uuid": "3488e74d-fb49-46f4-8405-30d81a4899a7", "value": "\u03b5\u03c0\u03b9\u03b2\u03b5\u03b2\u03b1\u03af\u03c9\u03c3\u03b7 \u03c4\u03b7\u03c2 \u03c0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1\u03c2.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f8fdb1-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691571638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571638, "uuid": "5343c769-95b8-46f9-8a48-e2743f48f176", "comment": "Malware payload", "value": "1f0428454d7f50a84994ad0933b23ab5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571638, "uuid": "3fb0563d-fd3e-4d3d-89ff-8f68ff6b3c8a", "comment": "Malware payload", "value": "25098a17b84835d5126c06858b9c057b18b82a1ccf1c5e461839fc57f63c1b7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571638, "uuid": "9541d857-f5f9-4740-a381-05c8c727ebb7", "comment": "Malware payload", "value": "2e8fa646a3c60542e847c316089cd2187f8376b3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571638, "uuid": "9ff3287b-30a2-4cbf-b14b-f7d4f0953fd5", "comment": "Malware payload", "value": "d8ad3c7e90f03acd6de2b9837eee278c92c3e6f6605e691584d04afa6dee574431584ef2f9624fab9d341946baec4dc3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571638, "uuid": "cff82642-b78d-47b0-abef-84f1efcee887", "value": "T16C33F14E1904AB4CEDFE363C068D1230A861B990E3AD5F4D13AAFD75972E94FB24B074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571638, "uuid": "0037bd6d-5856-4294-b6b2-6a684030c7ac", "value": "1536:7Vn3nuOgc1uLz4uYdh+WhGOS9f8/At+0I09:7VneOgcMv4Z+Wpmf4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571638, "uuid": "6af0a6ae-add3-4013-9dc4-5432f9dd19e3", "value": 51648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571638, "uuid": "fee08ed2-b0e8-4c91-83ac-77184cf4b07b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571638, "uuid": "2dd72257-07c2-420f-8655-55162c5b706e", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370ebe53-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571640, "uuid": "9a29fdd9-4dcc-4ad3-a517-8a9f55090fca", "comment": "Malware payload (RedLineStealer)", "value": "1a39ed2383fb52327e9d83c6acc9ab27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571640, "uuid": "5015a83f-e03e-4cc2-87b5-497cfa1807af", "comment": "Malware payload (RedLineStealer)", "value": "2521a4eae33e98ccbdc94833cf08cfa10dec621c5948ac91184e1c1417f310df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571640, "uuid": "70a4e24f-6696-4775-9762-0abb31ec15f3", "comment": "Malware payload (RedLineStealer)", "value": "e458f12232057f919c3472a0bf8c83e7c6ea0745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571640, "uuid": "2347f203-93e7-4989-a7a4-af09b7b69d28", "comment": "Malware payload (RedLineStealer)", "value": "541103975848f67398ce9431a618b8964c0e4d667b9b178f4f721c4947fb171e360e6679644d393e76c99d7a07933db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571640, "uuid": "120432e4-da62-47b8-b84e-60ef08481d1d", "value": "T12EC41213A6E490B1D87867B424F203930735BCA65D6993AB3B42DA2D9D737C0E53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571640, "uuid": "42c87707-e8e3-437c-a7d5-526cd94238cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571640, "uuid": "d8806394-49dc-4bf5-b567-2937ec4b4f86", "value": "12288:MMrey90gQ1MSGXWUnS/0YZDgBYC7FfQURIY+/sonS:qyPQR7/vZ8zdQUf+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571640, "uuid": "ec680209-bec0-4afa-b89b-e337598193ac", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571640, "uuid": "1cb1bf3e-e8b6-4a85-bb57-58ba1d648e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571640, "uuid": "026d3ce3-c4e6-4daa-9c8a-fa80b6c7e0c7", "value": "1a39ed2383fb52327e9d83c6acc9ab27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9fb2a8-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691599760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599760, "uuid": "3f1d5948-efd5-4c35-986a-39cfde2a927d", "comment": "Malware payload", "value": "b9f89277f5ab392074c8b406cc63ff31", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599760, "uuid": "0892ec5e-c187-4893-b5f3-e50d4a7ef763", "comment": "Malware payload", "value": "2566790bc205591858b7158178dc89f117629b9f3fe382dd1d678a0f2e598c1c", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599760, "uuid": "5477b4d8-df7b-4644-b4cc-18d5c6d2d921", "comment": "Malware payload", "value": "2ac25e41279e6397d86203dba80f9abfdbefa9e0", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599760, "uuid": "8717eab1-a05b-4b20-8233-8e89e84d754e", "comment": "Malware payload", "value": "3bb927e0139c55bd508ac62a3ac9511606d7def30d144b965b10d2e9b3113e5d7f0dd4f70fa974ac87fb336b10e9aa32", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599760, "uuid": "18c5256b-2993-42c7-bcf5-32171dcb0084", "value": "T1F1E4CF039D498B43D42847F8BD435EAD1F197F0CA9827AEB51627FCB3A702215D9E06E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599760, "uuid": "c3afbf3e-dd87-4564-bc73-007e2f437132", "value": "12288:jeyV6em4Qe1LSHnuVMvaxlbrKNH2FNjIAFqAgjfzqXu+elYlDhS2WRG6:reixNFFNE0qA4uXVVlDoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599760, "uuid": "67d23e89-5a02-417f-8135-43d055aaa278", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599760, "uuid": "e737728b-2fa4-4c97-a2a1-cdaf5dd8bb43", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599760, "uuid": "cccc7f64-e137-41d1-b09b-f2dcdc4033b4", "value": "PURCHASE ORDER.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd46389-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549422, "uuid": "80866559-d400-4c32-9a90-34d7188e1970", "comment": "Malware payload (Mirai)", "value": "988d1cb3060675b68c6aa0325fc8b397", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549422, "uuid": "c365d708-5094-4bc3-87c7-484dd5ee0ec9", "comment": "Malware payload (Mirai)", "value": "256efd3ec5e8bcc6890b83c1a8e7d1097c2b8f51b7e59e4e3d1aa01f138af909", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549422, "uuid": "f5bea58c-6722-45f7-874b-56862902c036", "comment": "Malware payload (Mirai)", "value": "c1f98b75f837333984621646a5a5d73f70485d1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549422, "uuid": "5ef34ef0-f20e-41cb-b79b-618761df542b", "comment": "Malware payload (Mirai)", "value": "394d836febd0e31f7fca125e1b21e8813d6718430dd2ebc79e3f0d56462796dc3ac24540801e1f2faf50c5c15c24e004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549422, "uuid": "2419c4bb-1360-40e0-b53f-563871e4c8a6", "value": "T1D7C2D170FCC179B6DEBEAD38485188D07BE61F5837E2CDDA204DDD215212D3796A8A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549422, "uuid": "c4b4cc07-04d5-4aac-9851-326ee6e758cc", "value": "768:7KnqLiChP7gI5gBZw+LajRKy4uVcqgw09K:7KqL1h4Zwa6Yy4u+qgw09K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549422, "uuid": "fd7d2dd8-25c7-4311-9631-1f7d5b14b949", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549422, "uuid": "66913790-d4d2-4d85-8a0c-7c06f468890d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549422, "uuid": "0826b76b-3889-466a-98e8-1140c7d25282", "value": "988d1cb3060675b68c6aa0325fc8b397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4224181d-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691559203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559203, "uuid": "bc96d6d4-f624-4fe3-8e49-f700b1fab820", "comment": "Malware payload (RemcosRAT)", "value": "1427d34daab4b701f4917b757d8bef85", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559203, "uuid": "22afe36f-f955-4c48-a68a-0a65c46bb255", "comment": "Malware payload (RemcosRAT)", "value": "258563c88f1dc702e7dacdcfcbea44f4e1b8a07ec219fa3ef3a0a24c35eb5471", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559203, "uuid": "a54a00b1-b067-44c6-b02e-de2f948fff17", "comment": "Malware payload (RemcosRAT)", "value": "b0655784dbf3c152d9105c3d3b116738c6e30fb6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559203, "uuid": "0708ef18-93e3-4637-94f0-057d2196b810", "comment": "Malware payload (RemcosRAT)", "value": "437aaa345668f772fcaec26ee0f181771673a7e0333f36bc879ca25ba482d5a27c0fb81b37b59cd39e8f14e4054821e5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559203, "uuid": "f383f141-27f6-425d-bacc-398a78fe2883", "value": "T1E11523E14ECB4B72627ED5E044E9E754D1374CA24CB444ACDEF4A1BF9607A6DCE0B228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559203, "uuid": "09a9fb06-0cd1-4a56-b5ee-329c271f15f9", "value": "24576:rl/y094m1BDY+m3olm1E5r/q3Pi77lLe5nZu0F:rl/34mHpl1ri3PiZeak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559203, "uuid": "f4ec5491-b589-47e1-a14b-0ff5e567e47f", "value": 936969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559203, "uuid": "8361dd15-e69b-4e16-be9b-8de4cf6fc420", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559203, "uuid": "c61084b0-0a3c-4809-a38f-ee1c20b1cb53", "value": "KWITANSI PEMBAYARAN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc96012-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571950, "uuid": "713d4193-de92-46ac-ad39-25bbb0d4b914", "comment": "Malware payload (Amadey)", "value": "914fb985857ac1f06d9c958109e90927", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571950, "uuid": "19def8e4-c3cb-4a35-915f-bd3417132c9c", "comment": "Malware payload (Amadey)", "value": "25b386a73ae470e47120a1154af348db36ed868056765e774dfbdfba67e421c5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571950, "uuid": "e21affc0-f32d-4257-b301-9a5b4023813d", "comment": "Malware payload (Amadey)", "value": "89db1badf9586529758c786504a9b9205059f95b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571950, "uuid": "128ea066-e724-47b4-890a-7b5ff9d4262f", "comment": "Malware payload (Amadey)", "value": "0fdfecb882007c65e817ea954c4ee4a82048fba9494c8d1c3d0749e6d3a70b2a3a0716be2db60e11bcc29ca2162b3929", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571950, "uuid": "08f237c7-75dc-43a5-a65d-dc3bec15d1ac", "value": "T121E4128267C99532C9B61FB064F203830B7B7DA19A75C76B339198AE0C73AC4D176367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571950, "uuid": "60cbb9a6-f898-4b74-b6b5-e3a7e76c26a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571950, "uuid": "e4c70863-2ccf-4030-b852-e8815f7306e5", "value": "12288:3MrEy90hbr+4PyjIg3H5Ai7FTjSmUBjy1EkWBWkOprXLM7d7R80:DyUbC1h35f7lS5hypW74XLa7R80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571950, "uuid": "c0349d04-a26f-4ee0-91ce-f936addfd1e0", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571950, "uuid": "8a183123-0811-4e7b-b798-e6662889ff9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571950, "uuid": "65afa6fd-5af0-409a-b7da-a6524293247a", "value": "914fb985857ac1f06d9c958109e90927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46be7f8c-36c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691593571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593571, "uuid": "70fdb075-eb6a-41fc-87d2-511c08c684ab", "comment": "Malware payload (RedLineStealer)", "value": "aab3cfb01aadf323f37c83c562a1aa9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593571, "uuid": "37669c7d-8451-435c-bec5-400f4492cf7a", "comment": "Malware payload (RedLineStealer)", "value": "25e9cb490bf3e68f03053981715cbe0c17bfae17d529d9fe6a5a4e2852ad3101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593571, "uuid": "27a6e987-5378-46eb-80c1-b637c590d634", "comment": "Malware payload (RedLineStealer)", "value": "5e4eb01127ccfc727526d60b3d8b8dc170aa67bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593571, "uuid": "aef24596-825a-4ca4-8c0f-dde45b434085", "comment": "Malware payload (RedLineStealer)", "value": "abf126b7245479a6aa405688c785495728d0defeae78e968d9bf5bfe8ba4963f35ed94abdc5f6e17bd4074d98896a3ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593571, "uuid": "34fb047c-e652-43df-b9f9-dbd851da1223", "value": "T178C412133BD89072DCB517B00CF743871B367C926879933A1B42989E5DB26D6A83673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593571, "uuid": "89364795-b490-4321-b25d-b67c7e5d87f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593571, "uuid": "c7562e49-49a6-4283-8250-f514bda9d201", "value": "12288:BMrky90de+2PubK1jvp8BRcxhSgBYCEFQLylfK/0a:9y2mg8p8BRcjhz2QGhKsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691593571, "uuid": "07b15205-88a3-4277-b656-e68ea199796d", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691593571, "uuid": "e17980e3-1d2a-4830-a498-b435701d5723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593571, "uuid": "3c9d365a-b7dc-4a72-b5c2-1fab97513653", "value": "aab3cfb01aadf323f37c83c562a1aa9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d02101-3695-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691572658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572658, "uuid": "bcadc492-674c-417f-a4d8-8ec505316668", "comment": "Malware payload", "value": "b9ed1f32c7fb1c7fdf34addf20719a50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572658, "uuid": "e5979234-2b9d-4154-ba4b-adb7c61f4ef0", "comment": "Malware payload", "value": "26b08735f4b20bf7a5d6da035ca5dc6b1d3f8685d83397a876cc4db946adc778", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572658, "uuid": "05885677-d909-4dcb-b82c-c4f7ba386e34", "comment": "Malware payload", "value": "0d6e50710ba223d8a65ee7773533de44eac17912", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572658, "uuid": "33e9cc5a-6248-49e5-bf1b-f68431acf732", "comment": "Malware payload", "value": "23c48ff365b21e62cf1eebf4f5b8e8c1486b951ff3b667a53479b7fb0ee762a302eaf4be8433284232d4d5a4bebf382a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572658, "uuid": "044c33cf-283d-468d-844a-bf3c5af3e6d5", "value": "T1DF45A189835A06F4BFDE7F844AB0A89B9C10A51674FC789DEECC1F089C6A4BC47505DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572658, "uuid": "3fda53a8-940f-4362-b686-e3ec56103327", "value": "12288:y6bmO7zyyH+3NR/04xiNV4mC6k7aMRRIZpSPDKcDaTE1JJr:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572658, "uuid": "702681cf-9667-4ba4-a963-ffa5cf1b2829", "value": 1173999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572658, "uuid": "c69ecb84-355d-4ac8-8a97-92a2040598af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572658, "uuid": "43e72060-4b80-4cdf-9de6-5774d209a79b", "value": "chkyy2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4015a4a-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602854, "uuid": "b620e112-b072-472b-a496-919502d89f43", "comment": "Malware payload", "value": "c546968a1f13d20f92a1966891f84ad8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602854, "uuid": "32f5f0d0-5202-4ec4-946e-cfbd5f8ea158", "comment": "Malware payload", "value": "26e3290a32d6cc723113c8e0a9c4b79297c60f545e4b18b5ec905718fe940fb8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602854, "uuid": "ba055e20-b9c1-4823-baf8-6caf8dcad26c", "comment": "Malware payload", "value": "1f881d603737744ee6ea33a501495540d32b450e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602854, "uuid": "7f21609b-bf56-4374-b4d5-23a5ab8a3bce", "comment": "Malware payload", "value": "5a39a97fa9797c54c0c31a340cc3659b9ebf6e168a2bb4d16283f57ed90c1d676f16bc144b817ddeb102f2925e284127", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602854, "uuid": "36b03dc9-e499-4d8b-9211-e57fbd7bda44", "value": "T19DF4336D16A3CA37F1264D7B9FE42E931DCA306E756D218B0AD2EF62484E1653E743C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602854, "uuid": "da6e20c4-cf1e-46ad-b1b6-b9ae73767c78", "value": "12288:ChPgareJrEresQDbVSfh1S2yjJ3Cq1sxQyqvgIUugQWgXHmWOvEy+CK:CFgBJQr7Q+h1S2yjMFxbWyuZqL8y+CK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602854, "uuid": "f11fc4b8-bcff-4791-837b-33005e048e25", "value": 766228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602854, "uuid": "aa207cba-fed7-42b8-b168-e159823ec8b5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602854, "uuid": "45dcf274-96c5-4af1-a155-42ca126bca74", "value": "RFQ#117300011189.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8369617d-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602692, "uuid": "c7736cab-c21d-46bd-b439-fc20c882c625", "comment": "Malware payload (AgentTesla)", "value": "774ff369c52efad91fc877a5b8cb0835", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602692, "uuid": "a33ff115-bb09-45e3-a3a6-af3f4ccb9c19", "comment": "Malware payload (AgentTesla)", "value": "27de4e75c92c025910bc868f68f2323db4ff96855abefa1672851e6936c77141", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602692, "uuid": "ddf1b88c-9616-4058-aee5-fcf741aca017", "comment": "Malware payload (AgentTesla)", "value": "11c73b6f1f4e0eca16883f0cfbe596f24363e750", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602692, "uuid": "4c7bb1ac-dc14-4b14-842f-c294ce687918", "comment": "Malware payload (AgentTesla)", "value": "02f9e832196f029080d6f8de4cbcefddc6e608f2c2ddbce8d83c36dab23182ed4b5ac621d55ca7c4ed8f5597872f8196", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602692, "uuid": "8deac11d-ccdd-4ff2-b1e2-0afc14eef03b", "value": "T14DC449E1724C45D4F3B3BA0253FC39D9578FB2EACA3A09657448D61CA6CE9724CE2361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602692, "uuid": "d6842910-ed10-465f-a0f7-40749fd3619a", "value": "1536:7OIfYShwxtSFPIT9z9vyWngFkCC3d7y29oSFmlZt:7XfYSG7SFwfyWnghKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602692, "uuid": "67c23b8b-996a-4808-8a54-8d9850dbd5bc", "value": 547100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602692, "uuid": "7046d992-5dc5-4141-866c-0702729fe35d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602692, "uuid": "8e756a08-ad54-49f4-8fa7-3c00fa93bc48", "value": "NO56789043.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb96fa4-366f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691556322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691556322, "uuid": "227b7ac0-deee-485f-9bf9-a829cf2af1ca", "comment": "Malware payload (Formbook)", "value": "442b56f3ffd0b474bac9aaf352c15254", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691556322, "uuid": "05c7d6c6-2ede-40fb-8f18-f2a1ee93db98", "comment": "Malware payload (Formbook)", "value": "27fb912989776892394c463e26fc2bf2dfad5c6f7abae572fa0691013210f9b6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691556322, "uuid": "e65dc7fa-d2f9-4e2c-9973-8974a8049423", "comment": "Malware payload (Formbook)", "value": "b9278ef6855619089a05c81610850de75fa8d980", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691556322, "uuid": "0c53e556-f79e-47b2-8215-81067a42262d", "comment": "Malware payload (Formbook)", "value": "b289abce9a5a3c8dd8a3e83ad86b1feb096c5c64d9fdb12a061317fb2a64d708cf85f68477f369d75d86fc5dfd9cf4c5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691556322, "uuid": "9f967862-9242-46ae-a317-3bd5c2178da1", "value": "T1864423A165AD1869836315937079F4CC8A26ED6C0F0E8A9E92D1F7F47CD02B939B3136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691556322, "uuid": "a8013024-0438-491c-ab94-3cc4c8d52876", "value": "6144:rGgS4hPB+NyEFYBTrqF0Uyx+SdoRMGCkZsNMYKJ4:iSPUjFYBaSUyPdo3XtYKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691556322, "uuid": "38ad2e63-a401-43b6-8f6c-d17e70846a5e", "value": 273424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691556322, "uuid": "3e01def0-36c4-4ed7-b82a-b5e5b7da894f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691556322, "uuid": "d6783c07-9ab9-4a31-8153-b5bb4fa7c272", "value": "RVEG00123737.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf5e9ab-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602867, "uuid": "5d41e21d-e8c0-40aa-a642-4db17f6cb939", "comment": "Malware payload (AgentTesla)", "value": "12f72edd54ae8b574189ae3ab53fa36e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602867, "uuid": "2d23630b-09a1-4c72-9aed-c0000e91f9de", "comment": "Malware payload (AgentTesla)", "value": "2817126c43337143465a9b198d5a0aefc098f01e53c2bea159c82e6978e8f5e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602867, "uuid": "4a790401-a5f7-4b9e-8d27-09b8a3bac091", "comment": "Malware payload (AgentTesla)", "value": "4585ae1c999e055236b9e6a796b10f8d505da470", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602867, "uuid": "0a0e9c50-28a6-4f2a-847a-80c75834cd08", "comment": "Malware payload (AgentTesla)", "value": "ea3933f52f69618ad5ab1a7d4b7d2643c1c6e86d499c50bb4857342fa6f751e05d20ad0b27a939634643ffda3f40246a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602867, "uuid": "1de78ab2-4e68-40d9-b33f-419b4a306823", "value": "T15EE423E96233D0F7F30E6EF69642861846052691506DE5C8E139EBF8F58B3B11FF5A04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602867, "uuid": "45cf94be-a321-4835-8b41-40c15e4a3121", "value": "12288:RAnWp6tY9YyjlJ48IGzYKE4bafFNlgnhIIMQSqb6skQTRz1tHKYsUw8LITz6PM:mbYJJ+OhOlgy3QVb6skQTRpZdPPkqPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602867, "uuid": "e58d8ace-75af-470f-b9b0-6c3991448f9d", "value": 718983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602867, "uuid": "bbac74c6-42be-4ecf-addb-e0dfeac2407e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602867, "uuid": "aca567c6-3e30-4858-b714-a0cc4e574152", "value": "Group Details.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc778f1b-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691623887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623887, "uuid": "f9c2281d-7373-495a-9c37-63e24e13f1c3", "comment": "Malware payload (Amadey)", "value": "db0edab8dc14d2d3052f8fd3703db957", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623887, "uuid": "ce4215b1-14a7-4fb9-9bcd-99388eed2859", "comment": "Malware payload (Amadey)", "value": "281eb3307cab11066b1e6df8ec00dbeb373a7727ef7c22363b460c723b2d1f1b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623887, "uuid": "8494e10a-89a3-4008-9946-160ebefc5423", "comment": "Malware payload (Amadey)", "value": "b422ca9f28e723f84a515a1491c0bbdcb187e5fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623887, "uuid": "371a2379-22fd-4c1d-a0ff-4db3f2d5f487", "comment": "Malware payload (Amadey)", "value": "dd2486b1a140c9ca39b57d5f98d94881c10bb6c3f3a96aa9236afe745d5b51eb502f62dbabfb976053495f5464d1d7b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623887, "uuid": "4e400be2-ecdf-4e1c-b8a6-35a9bfa47ca0", "value": "T148C40212A6EC9573E9F62BB014F603931B30BDA25D78571F3249A90D0C727C5A836B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623887, "uuid": "cb2ac0b5-5a9f-4300-a19a-ad83de366b7f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623887, "uuid": "baa7f992-f7ea-4433-a1a8-1bb289de0bc5", "value": "12288:zMrTy90oJvPe4ioMpH6lPiyZrZtrvyDLWiPgTjkC1BZ:wyve4oOKWtrvynWRj11BZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623887, "uuid": "377368f4-0e83-42b4-b577-71d121f57e2d", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623887, "uuid": "192dfd05-92c9-4b43-8bd3-3fee226d960e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623887, "uuid": "6a980d41-119b-4499-aa45-e9646f9ac9ab", "value": "db0edab8dc14d2d3052f8fd3703db957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e1fbc0-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623278, "uuid": "97e6e3af-6301-4e2a-9a41-49335b53d624", "comment": "Malware payload (RedLineStealer)", "value": "6314580349ab9904893990966582e2f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623278, "uuid": "ac037396-edca-49dd-b9e9-354e0be622ed", "comment": "Malware payload (RedLineStealer)", "value": "2858b827906b4e8fc8fb0723454e84dff3b5bc5dafa53f31db49ca5261308921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623278, "uuid": "70cdeef8-fc92-4fee-88f1-c25e7257ae36", "comment": "Malware payload (RedLineStealer)", "value": "d5a2e04607ee69cc4d4ff739cd72bc560fbaeda9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623278, "uuid": "4d459ea5-d85e-4f9a-b419-072f292cbe92", "comment": "Malware payload (RedLineStealer)", "value": "c87a02db01e1b4eb51455b0d0fa7c8b8b7d3c49325e805fbded56019842c234407770d244e9b1cb85201d0e8707312be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623278, "uuid": "51f0bac8-7625-4a28-bf8b-65da9785f2bb", "value": "T13CC41252B7FD4176D9F5277018FA03D30B3ABDB15E38426B275A954E0CB3690A83633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623278, "uuid": "55ba14c3-fc17-4aed-84ef-5b9e056e5e31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623278, "uuid": "d83d06c3-3bc8-4b93-88f1-59569b752fb8", "value": "12288:pMrGy90xLB7EkrZCYl5r2JSoAs/TPgYUvkUx4mxFD:vyCBS1zzIx4mT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623278, "uuid": "1befd132-e065-48dd-bb5f-00341eacb92d", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623278, "uuid": "3e3621b6-0cdf-4dc9-aa5d-b97dc54651b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623278, "uuid": "75742e8f-1ebc-4f2c-9130-e92c2902bd17", "value": "6314580349ab9904893990966582e2f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a2f69f-3680-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691563534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563534, "uuid": "bcc7c941-d581-4d18-be86-e2e2c6545291", "comment": "Malware payload (DCRat)", "value": "1ff6dacccb79de494404797f2fb0f2c2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563534, "uuid": "9027b02c-fa86-4eed-96ba-9785f9d23924", "comment": "Malware payload (DCRat)", "value": "28c4fc6179f46a227b9b6789798835f2e6e2af655fe43d4e3ba372a67591f514", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563534, "uuid": "d6d6514d-6f42-4c75-b355-076e346bc134", "comment": "Malware payload (DCRat)", "value": "26909f648dcc5cb7dce6fef4430d6ea07ce4f909", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563534, "uuid": "04946b52-ce72-477c-b3dd-ed443a14b453", "comment": "Malware payload (DCRat)", "value": "91e1dedb92da99aacecaf0c71dee05755e1e121bada24af45c3b8c207bfcdb827ccc3fcda9c2ab6ea4063ce18215aadf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563534, "uuid": "007ebb38-7984-4736-87f2-02897e0af164", "value": "T11DA42342C588CFE0F6F2ACF14622C95E46D12E112321631795A5F8F7BBB11B7A92E1C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563534, "uuid": "3fb949ac-637b-4ece-aecf-0d968aee439b", "value": "096c12658c5e4a55e69a5d9070c24030", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563534, "uuid": "83fa77c6-1c6e-44a5-8b9d-30b8355d4835", "value": "12288:gMS6BVsQYfrhaUq0qf1ijDY89hPuANv6jhlA1m3N:fsQYfrQU8ojX94rAm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691563534, "uuid": "bdbccc43-45a7-478b-b147-659579fdd05b", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691563534, "uuid": "e9d0a94c-abc3-4943-af7c-2b2b970e7213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563534, "uuid": "139febd8-59b0-4106-899d-5fa7f7f3c018", "value": "1ff6dacccb79de494404797f2fb0f2c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae1cd04-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571942, "uuid": "663b4edd-b71d-40bf-808f-ffa5895c9a78", "comment": "Malware payload (Amadey)", "value": "94e87a5d6827a5ab02ee851c44e85bf5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571942, "uuid": "1787a989-85ee-406d-b021-fc5c59018637", "comment": "Malware payload (Amadey)", "value": "29c8e23ab8b3f691bfffe66cfde0640683b1f90300fe2af8ff6fb541142b50a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571942, "uuid": "c59f82b4-779e-4ba6-a7db-341355342212", "comment": "Malware payload (Amadey)", "value": "1cd7a16cd382e794d0772ae35e0d0b0775bdb39b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571942, "uuid": "079b98fb-b422-4fe7-adf0-8d17cd91686d", "comment": "Malware payload (Amadey)", "value": "b178f20434f64bd940ba80a7b3463163b9c0a2a8297344979063c04ac23a7511092d2d5e952758ec4a75e417599e6929", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571942, "uuid": "c0a1d811-4174-4112-8991-7781eba23963", "value": "T138C41202EFE89061DDB1277048FA02C31A367CE15974A76E2355E9AE1DF26D0E632377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571942, "uuid": "1e79d7ef-fe49-43ea-8111-eaf900899719", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571942, "uuid": "8ee01f45-3b7e-4f2c-97f2-e507b14f0320", "value": "12288:lMrCy90R/Fm5+wSe4eHpgBYCiNLIorXcgszIZkgGfJf1/7:HyQVwSe4eHyzKLLrXc1zI6x91/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571942, "uuid": "f3ca37d4-5130-49e7-bbc0-e8812219b768", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571942, "uuid": "4bd34eb3-dfc5-4d61-b909-49014df10021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571942, "uuid": "0c628a76-588a-472a-9fc7-b7777136367d", "value": "94e87a5d6827a5ab02ee851c44e85bf5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48de20bd-36bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691590568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691590568, "uuid": "4bc8701b-193f-4476-9c8c-277941817ac5", "comment": "Malware payload (Amadey)", "value": "f0871b3df678899ce18a703f34c58a77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691590568, "uuid": "3f488885-1d04-47be-a9c1-bcf60abee025", "comment": "Malware payload (Amadey)", "value": "2aa1ea0106058c63d3b69ad2b66de5099a11874c42862d6ac5787ece2ce53542", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691590568, "uuid": "52ea42de-30d2-4e8e-bcc1-34f42bd8a421", "comment": "Malware payload (Amadey)", "value": "56ed636db5177403a46add6ab1bfde23e440814f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691590568, "uuid": "1c09566a-0c38-4123-a4ae-79fd7c6690b7", "comment": "Malware payload (Amadey)", "value": "3d12f73923b6994b7cf9c019c260bb7a32f7df2e3ab1f7af324f4cd444d4ffd3b7db8485d8edc26c161071753e8d3366", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691590568, "uuid": "62a8b78e-fadc-43f6-bcda-29e1a6edf3a5", "value": "T144C41252DBE88032E8761BB01CFB16C31E363CA18978976F3795AD1D1D72680B97172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691590568, "uuid": "293a34a1-97fb-499f-a538-6a13952cfa93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691590568, "uuid": "25b2bdbd-c943-4a4a-a55f-16808e1efc5a", "value": "12288:2MrCy90QjkZjUXTZL7gB+UMRYdELzOfjaB73mogte3m0RcrKK1Dy:AyVkJEdpUMROjaFmxt0RnSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691590568, "uuid": "60c011c4-0819-4ea8-b3da-891ffd3aa5c5", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691590568, "uuid": "384ab040-e56a-4e31-8345-03bf60a13382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691590568, "uuid": "236953c0-221e-4ddb-bd83-e1a2839df287", "value": "f0871b3df678899ce18a703f34c58a77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e39742-36aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691581804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581804, "uuid": "47a346ff-2b6d-4ad5-9398-bdf4535e5140", "comment": "Malware payload (Mirai)", "value": "d4318c6bb1faa9239bcff101a00c02d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581804, "uuid": "df5c3bec-3573-47a8-905b-43f5b4598e42", "comment": "Malware payload (Mirai)", "value": "2baa4c2ccd12e93811b7330976eaaa7eb4eb26216745c173cce7f276289bbe81", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581804, "uuid": "d048654c-b704-46ef-84be-02d5b3880968", "comment": "Malware payload (Mirai)", "value": "850dd9ba782dcf44eb491b90ec3d8f7dd61aea58", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581804, "uuid": "460e0c41-9421-484f-9c3b-91d7b83f71b6", "comment": "Malware payload (Mirai)", "value": "28b2b6f1b8700c4f31ffa089b1f29f01fc466427b05bb0497f8d2a6b26c68ad1a3f303470b4f9ea8fa9a103a63c48596", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581804, "uuid": "efa9a956-8a9b-4ab8-be31-9168ddf5e526", "value": "T1D3D33B86EA408F13C0D51B76FAEF41493322D755E3DB73068D189BB43F86A9E4E23649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581804, "uuid": "844de114-88b9-42bc-ad0a-6ee30e989512", "value": "3072:wybYEaneGkYBORXaGgk9mrsplDKZUmQBKXAVantX+F8Jyvl4hL5A5If+f/h1BSeK:jbYEaneGkYBORXabk9mrsplDKZUmQBK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691581804, "uuid": "e4aaacdc-6603-473a-8698-cbf0dbaa95cc", "value": 142643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691581804, "uuid": "952fdb8c-4f4a-4bc4-9374-a9a08912d950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581804, "uuid": "175e8da7-7323-4682-9d7c-45963ffeed03", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97d2cfb-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691606299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606299, "uuid": "26aa000b-15f9-4197-bf5a-5219f1677c52", "comment": "Malware payload", "value": "e781ca8ce0cf2ede3c242c2bdc1ea2a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606299, "uuid": "580d6da7-7b72-45d2-b099-f04304974072", "comment": "Malware payload", "value": "2cd6b5b83367c4796549a84161209ff9e32d4ce42fcffbe24015e603d3aad300", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606299, "uuid": "c10b2fae-04c5-41e6-89bf-de2d1d17266d", "comment": "Malware payload", "value": "2381be51fa72ed0cb3802e281dbd2a156ead8ec9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606299, "uuid": "2915ce35-880b-453c-9aae-e3f7b378e809", "comment": "Malware payload", "value": "61d5d4737c9f20c354320837f5f3dc89c5b69e05ea74bf6f2ebfb4d7f22275cb1aea2a39e9d47a3b89fa62fda665a2fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606299, "uuid": "5807d591-5b72-4599-8a9a-97e3a5b38d3e", "value": "T16C54231C37EB1CB7C99205F0197E153BD27E6210253A869B9F81FE7D2B1029BD85E2C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606299, "uuid": "75b52dcb-451f-4ad5-afd3-c86d109ec56e", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606299, "uuid": "e477a699-5d71-491e-83a5-19097359e908", "value": "6144:4MMYNXqBB4j8z9qKelFO/uJORFZIv3L+8t9NMdfMUVjzbKCA+j8iG:En4jqIKmEmNz1t9NMeUVjzbHA+j8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606299, "uuid": "09a69136-39da-4051-8adb-6a153ee8b6b8", "value": 298346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606299, "uuid": "33efc974-0c4e-45e9-9e4d-bce70ca05e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606299, "uuid": "3ebcf453-3661-4da3-90ad-67b06a7fc37b", "value": "e781ca8ce0cf2ede3c242c2bdc1ea2a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bca8c9-369e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691576450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576450, "uuid": "de75b051-dfaf-4517-ad0d-6c884092fc75", "comment": "Malware payload (RedLineStealer)", "value": "64ed6c28592e0b1fd0bd0582770128ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576450, "uuid": "8bc5703b-e944-40b9-8056-d1bc10548aeb", "comment": "Malware payload (RedLineStealer)", "value": "2cfb376f02ecdca3427e0e9c9aa5ae0f29e757b83cf05396f00b4272c4c70c62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576450, "uuid": "81f4f344-3321-49bb-a0dd-26900e470632", "comment": "Malware payload (RedLineStealer)", "value": "dd77e2e91d5ee721f60b9f1a1e6de11bba046d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576450, "uuid": "8904fcbf-8a07-4045-ba89-e6ca057847d5", "comment": "Malware payload (RedLineStealer)", "value": "aaac8ad379f680bb42f354eaec6fbcee7f7fc2b37e4386c8dc1817eb5e15f95e37c397b10fc5a9afaa08d126a1f8161f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576450, "uuid": "0eb240ac-89a0-43b9-9524-05127c06c53a", "value": "T1C0E42202FBF85171E8B227B059FA55832A347EF15DB843AB1395A58D0CB32A0D43277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576450, "uuid": "670325df-37c7-4238-ae36-99f87a84ec01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576450, "uuid": "b873aece-766d-484c-abc5-daeab1d0005a", "value": "12288:TMrEy90Zjve9yjL8aynWDO8RJUVzsTJSSBVlmQ/SqKPHp2m3mbY6r2K:Dy1qLnynWCGJYzsJJBVllyPoLvr2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576450, "uuid": "7355f2b5-1642-4b87-a4b8-a8108684598c", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576450, "uuid": "f2b8c624-9048-4711-ab54-1c50ffb72be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576450, "uuid": "cab92905-8e9e-47e2-b610-3efbd1735f43", "value": "64ed6c28592e0b1fd0bd0582770128ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed875d0e-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606306, "uuid": "cbcd9e3e-c75d-43f9-9576-243384741392", "comment": "Malware payload (Mirai)", "value": "efd8b5b0970d9977e8155a65ddfe6ab5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606306, "uuid": "3f539ec8-2caf-4625-abc2-c7bfcac6b3f0", "comment": "Malware payload (Mirai)", "value": "2dd60571ae3cef5df321e2af5a5db92ed7b644e1706f47ecae801e92d77290aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606306, "uuid": "3a2bdcd4-76b8-45d9-b226-4c307be79f16", "comment": "Malware payload (Mirai)", "value": "65b3f054c20b933077a1d3128a5a36f3d5f99043", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606306, "uuid": "c14f1baf-8e2c-4fb9-a3b4-9c54fa89b2bf", "comment": "Malware payload (Mirai)", "value": "3e7f6bc42de3041f953313b1c9a2af1adf650022a084c53eae5e6325cd6cde1ebb15fb62e36059263bfa1524f0ec8cfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606306, "uuid": "911779f0-35cc-4587-b128-9223ad168845", "value": "T118538D75D11DAEA8C0414AB4A9198E705F13E4C046733EFBEA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606306, "uuid": "9b483d7f-da91-452e-8620-834f8de8fdf4", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606306, "uuid": "4bcfd608-2dae-45e4-8073-bf44db6de297", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606306, "uuid": "eb255ee1-a453-4557-9151-00d981eb4784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606306, "uuid": "e810ab53-3a7e-4917-9b96-df45de409ecf", "value": "efd8b5b0970d9977e8155a65ddfe6ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e89076-36ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691588464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588464, "uuid": "ea94360d-a7c6-4940-88b3-5e4553d29fd9", "comment": "Malware payload (RedLineStealer)", "value": "b52a42ab485c57a24e14d43eee5f514e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588464, "uuid": "f99756c3-3b03-4e48-bb60-e2f23feb971e", "comment": "Malware payload (RedLineStealer)", "value": "2de6754a429fb1bf67e370615ec3c27d10ff20749b3df395c16726e964f4ae72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588464, "uuid": "4f15e002-2bfb-44db-88dd-12998051fcc9", "comment": "Malware payload (RedLineStealer)", "value": "9afb01993b3f6e2321c0dc38fecd21f3763fb78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588464, "uuid": "3de1aeca-f207-4e14-b680-c53f487efbd4", "comment": "Malware payload (RedLineStealer)", "value": "322342c113dd875c1d526835b2f9acab615b110ef425aa519f2d13316dd43963335c28bda706f9dd5e122c1ed1ba266d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588464, "uuid": "c4b057e3-4cd5-4434-aabc-cd01c378d8c7", "value": "T1E5E41212EAF99422CDB113F098F622D31F37BC925C7843AB23826D4A4CB25D5D976367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588464, "uuid": "c6741160-6b79-46ea-aa21-31602e184941", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588464, "uuid": "4b1efc66-6b18-4470-a2cc-513988a5bcb5", "value": "12288:1Mrby90nFiYXm/rw/amR9nEkHRLhZoLvfXnb36urnogywS7z6OIpLyNZV:ay8tXmTMamRakHZoTX5ofwWWpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691588464, "uuid": "aef01c91-13f7-46ec-be30-f199a9785cc0", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691588464, "uuid": "cbd7212a-8adb-400b-ab21-0a787d4c7189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588464, "uuid": "f3d1d552-3b8c-4cbc-9be7-d071190ff2aa", "value": "b52a42ab485c57a24e14d43eee5f514e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb937408-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549126, "uuid": "4d2c76ba-4e01-4c22-934d-8c26a3ae51a1", "comment": "Malware payload (Mirai)", "value": "86a2e8fd4bb556809898cab54b191171", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549126, "uuid": "f6c3cbf9-7af2-48e1-b70f-c3b1e43ae593", "comment": "Malware payload (Mirai)", "value": "2e17c1e3dd3c5ca782831bb3000b7d42f9e6f2c6aaa8dde9e5ec7f2ac1c71e00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549126, "uuid": "ffca9627-dae3-4c6a-b7f6-b4c5035f4018", "comment": "Malware payload (Mirai)", "value": "40321b6aa7e9968b525f042d1a3bceaa1e98869e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549126, "uuid": "70fcd569-4207-4f77-9b81-72d2cde1ba34", "comment": "Malware payload (Mirai)", "value": "2217876466944f4263cf1cd8f75ef0b193d71c299a226a890199943b9d5e656962839ab6b5c6139b8092a719bfbd2835", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549126, "uuid": "087e92ad-4be7-4802-a3c6-c700258438ea", "value": "T1DAB2D03461A9A0F0CD306438F97EC983A7DA41FD91FD3B222A5350E86F568CD15E89C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549126, "uuid": "e24304fd-f088-4bcc-91d5-5a1fbcaec309", "value": "384:osoBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH15sH4RhymdGg:ocaNSq5sOHpTqncvsdDePiAUgefoeDeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549126, "uuid": "48aae0b2-a0be-4e9a-923e-a78ce7a881dc", "value": 23736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549126, "uuid": "60cca39e-bbde-4f31-ba66-4e75ead62bda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549126, "uuid": "cc2d136c-59cd-4a07-9d72-835ceb3b6fd4", "value": "86a2e8fd4bb556809898cab54b191171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1976fcfa-36a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691577603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577603, "uuid": "7aff112d-3d39-450d-87e4-079eeaf5a1b5", "comment": "Malware payload (Loki)", "value": "4d74c8a3ea965a15fa1903e17ab291c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577603, "uuid": "164d8a10-042d-49ec-8a41-f08cb8c47b3f", "comment": "Malware payload (Loki)", "value": "2eb81e5ef35729ff5cd330b41347350298e20cce4b1ebffcdba90be70b84590f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577603, "uuid": "f56acc80-6b9c-4554-b944-a8c98fe3ef1f", "comment": "Malware payload (Loki)", "value": "e7710230b537181fd5bda7466697b58dbeb1e9c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577603, "uuid": "3312e0dd-0e55-46f7-8509-baae68b8fcf6", "comment": "Malware payload (Loki)", "value": "b7b05235e1b906a5daa2f6700f14086d701541441557fd63418a201ba5e84a0d547d3a21b5beae0f787e9104a5faf03e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577603, "uuid": "7be80749-9280-4dac-94a2-f5838f860e54", "value": "T14EC412A95EA48E6BC67D1BF4092077F6A37DBEE63061E24F2D52B4CDF852F4C8521201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577603, "uuid": "ff7d9386-69b4-466f-9ead-12073c410fd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577603, "uuid": "29ebe13e-c16a-4629-84a2-c95e42ba7da9", "value": "12288:nuYiIoFwIrG3XCCaoYGjzHZVGD1WreOx3zICzn27AUm6H0v:uHIcTrGCcXHZUD1/OS827Xm6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577603, "uuid": "544bbb5d-957f-45fc-aeff-3dbda986926e", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577603, "uuid": "75303d33-7b25-42b7-be4b-81f5f7b32700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577603, "uuid": "d25d707d-01c0-4c24-837d-723cca5c876b", "value": "2eb81e5ef35729ff5cd330b41347350298e20cce4b1ebffcdba90be70b84590f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0490eb-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602759, "uuid": "c87c6413-65c2-4034-96c2-dab351b5c306", "comment": "Malware payload", "value": "a570077b4749d4d150540aa39454e7be", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602759, "uuid": "95bc8f7a-51b1-48ec-9dad-d32db53ae735", "comment": "Malware payload", "value": "2efaedf6dcff4965ea59dc70b0df4813432204267b0f1145892676767b86d9d3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602759, "uuid": "0bcf07da-1bf1-4728-bd1b-9e3510a16c85", "comment": "Malware payload", "value": "e94856bdcd47af52f6455f08fcfc80076f3a9b27", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602759, "uuid": "d215ba2b-c8f0-4613-b3e0-9b01dfce429f", "comment": "Malware payload", "value": "a5b46f20befc294b0acc8fdd7bd1a513b21c8b50bea9509d5438e08196d6a76b53343757a9af08642146ae6bd9abca40", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602759, "uuid": "c322e0b2-11f6-4462-9aee-0d6b077ac7e2", "value": "T138151822E77B6589EF25A2E84E2F847179D6DCC0F1B1C588B7E7680385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602759, "uuid": "94f4ad0c-c399-4c33-983b-238aae7a4a37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602759, "uuid": "172db01b-1291-44f5-ae7a-6c8a317211ba", "value": "24576:tBYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOiCD3UNcOgu:t+Rs6CE3jLbO9Rs6CE3jLbOvD3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602759, "uuid": "e72aaf51-9f3b-414e-8799-b8df4b65d24c", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602759, "uuid": "32c86e8d-3c58-4b1d-9ec6-3eb5545aead5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602759, "uuid": "feff112c-42a2-4040-bd79-3d1a1969cc87", "value": "DHL tax Invoice 00199199000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f36854d-36c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691592672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592672, "uuid": "0312daa6-6335-46b1-9474-1543616b3094", "comment": "Malware payload (RedLineStealer)", "value": "9ca9b96290a70dab362805d97fabe8f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592672, "uuid": "1478f8ea-e0ce-4cfd-8975-cd756bf16888", "comment": "Malware payload (RedLineStealer)", "value": "2f457e9bb311b9882e8993cc528d9faa67253f68317079681e026267bd0c61ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592672, "uuid": "b94c1af1-592e-494f-a472-a17eee53520c", "comment": "Malware payload (RedLineStealer)", "value": "7e104d25480a63a6fa561ea3146853dd334e8341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592672, "uuid": "9fdc341b-eca8-4651-ade4-99f313c27756", "comment": "Malware payload (RedLineStealer)", "value": "d474dde58d51deaf6bbe74b5c3c5fd60a508005e4f2a1aa422daa6aeca5a1c1e5939466e58c236f190afb3d84383aeb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592672, "uuid": "bdc93a14-fab0-4725-85c1-f8b5a7e34d72", "value": "T1C0C41247A7E88072D4B517700CFB07430A71BCA65E74836B2759E96B2CB3BE4B43235A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592672, "uuid": "be62f8fe-04a2-402c-b307-524ac364ad6e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592672, "uuid": "9a2d7094-b592-462b-bb1c-a4d7d88a710e", "value": "12288:zMrey90YnvJL2kU3X/eZBQXRs7P3o62JgBYCresJq+LQLmi2:ZyFnJAeQXR6ySzXxLMf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691592672, "uuid": "afc34cad-67d2-4e93-a38b-dda3dc0c6b3d", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691592672, "uuid": "dfae45ca-296b-487b-895f-11e07f04a33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592672, "uuid": "28e5a53a-969b-47eb-a230-4aa1fad01580", "value": "9ca9b96290a70dab362805d97fabe8f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75b1f9c-36a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691580472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580472, "uuid": "8e0cfe4f-c2bc-4f93-955f-277deb8d2ec8", "comment": "Malware payload", "value": "2703fba86d1d1ccd8888b9ef2798b5f9", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580472, "uuid": "f52c93de-53c5-4fd9-8f7f-6c51d853674f", "comment": "Malware payload", "value": "2fe5f7997c9111800c88d2383cd3b62cb0c72eeb2bec3c5d72b5c1ac62d9145c", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580472, "uuid": "6285f9e7-cfde-4a42-a398-95cd7b81107b", "comment": "Malware payload", "value": "d3ffc507653fb8abccae0bf7e662eefb92d214f4", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580472, "uuid": "821a84a2-f457-4792-a4b6-f25ddbcbc9a7", "comment": "Malware payload", "value": "4d5682fb5fdbd46c316655510dc32ed0ceb672f3b7c3c57b03ef549440e09531bdfc9803ece86bb6a9966577421c7c3f", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580472, "uuid": "4647164c-1756-4ea9-84c8-b53cacda3596", "value": "T145628EB03F65411AC0A6E77A9FCD6E41BC193D4580D1704AF5EA0F0B05EBD589B70D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580472, "uuid": "502db695-f90e-4bda-ad12-a80f5026fe8b", "value": "192:uFx+rU4V0vV/eQzUxUOeizkj9A10I8viXqB1Z4491K1etNQL:uFxqNV5kOtQc0I0TiJotNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580472, "uuid": "e2ad63e9-9afa-4cc9-b66b-55dcd94133c2", "value": 15086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580472, "uuid": "4fe71839-764e-43f5-8ac5-7d3ac74a6d9c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580472, "uuid": "899821b0-4a4a-471f-8354-73286d6c56d2", "value": "CDE_8406727184.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b229bf37-36fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691617803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617803, "uuid": "7f8ccbeb-f646-4820-b8d1-408a67c3c941", "comment": "Malware payload (Mirai)", "value": "b1cffe70f7de7447d742ce3caf0943ab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617803, "uuid": "04040eed-e71d-45b8-b252-250a0c6154a8", "comment": "Malware payload (Mirai)", "value": "2fe643095ec609995eb5be8cd1cda92a0c071dcdc8c2c7c3a8cbad0f5dafdfe1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617803, "uuid": "707ac7dc-aade-499f-96b9-ccafa961fc82", "comment": "Malware payload (Mirai)", "value": "5313364c37bbe0a1d2a170901d50433e0ecdd53b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617803, "uuid": "cb322cd4-2e16-4f0e-b78c-10566a9a8ba9", "comment": "Malware payload (Mirai)", "value": "ec7a05bf097c7362d6f8923df97113772dc9c3e8790737da43887f60387822083f8ac79954b3f7126b04054e5a6b41e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617803, "uuid": "6e4e5c11-bb08-4fa1-99f6-4d039eb643e0", "value": "T1DB3339C8ED97D9F8DC5125712027EB328672F13B1019EA8BE7DDAA23BC52B41D40729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617803, "uuid": "2b581168-0211-45bd-bf63-b358d0466c3e", "value": "1536:gAmkKnnAvjccy7ZeDm4ECd+67ZdC2BjWxr2dJKQDfP:nRKnAvjcV7ZIECdxZdC2tirS3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691617803, "uuid": "90dc1e3e-0995-49ba-99e4-5eeb3ec5f053", "value": 54800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691617803, "uuid": "d68a07ff-2a85-4857-ae76-f703910034b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617803, "uuid": "b2b8acda-c5af-498f-88d4-da6fc907e80b", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7341d808-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691583767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583767, "uuid": "f3477d78-f5af-42cf-944d-86fe41177690", "comment": "Malware payload (Mirai)", "value": "80ca8153101cb67c426b6ff488eb69d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583767, "uuid": "e7318c3d-da29-46a9-b002-22128e087820", "comment": "Malware payload (Mirai)", "value": "309fe6b01e182b13485420048d2f9c18ecd4315c3dc40bfe397cf49074a7d90b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583767, "uuid": "672706d7-b5da-4c1f-8794-70743283a584", "comment": "Malware payload (Mirai)", "value": "31bf84da36a3178b7ec8b8f847791e89510a5b61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583767, "uuid": "61a3145c-7cc2-4af2-84ce-efa1b38f8548", "comment": "Malware payload (Mirai)", "value": "2c7ed40168dfad73c81172a27041459edc0c1b1823c720bc03322bceb56fa6db7f798f1fb9b5151d57fd9839c8a7c29a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583767, "uuid": "26aab827-2ed7-4e4d-a09d-5b69df6ffeea", "value": "T1DF83824A7F614FF7E89FDC3705A92B1224CD651B25A97F35BA30D818F20A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583767, "uuid": "9439e276-19d3-46d0-9767-8af064da0611", "value": "1536:4tHI0VzfKg4SfpfPuw/uu9PLp98GfjHghP1q5Ypc:2HI0Vz9fpfPZ9mhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583767, "uuid": "8a8af474-6b73-4181-80da-b06c56f6e4a9", "value": 88736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583767, "uuid": "df21cd86-5390-4047-b5d3-f35e99713304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583767, "uuid": "fbff1b31-d041-4d04-a4c6-7338d93d64e8", "value": "80ca8153101cb67c426b6ff488eb69d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a2033b-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691599797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599797, "uuid": "4ce8dd73-0328-4a16-9174-9c1263772488", "comment": "Malware payload", "value": "85ddddaee5a148f168fcc5dc4519eb38", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599797, "uuid": "d11d9ded-0761-4b09-b434-6b59860f9c51", "comment": "Malware payload", "value": "31832220cf20738429266c3eda9b9d01a6823ab18a911f529cf01e2a0e221c72", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599797, "uuid": "9fb8f512-eab4-44ad-9939-2e02a183d5de", "comment": "Malware payload", "value": "c1d17ab2288a7e646b0f09730efd5a87064945b3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599797, "uuid": "3d46ce6d-cf01-467c-a870-048382f1898a", "comment": "Malware payload", "value": "5e810f61cb715ec0c46da92952e9e165abd92b6495b9672f9842b81c62bd902f595aba0aa38b5894d7be7c71704a6df2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599797, "uuid": "9b30b778-cc33-458f-bc2f-8f0a07e355a1", "value": "T12335E003E804DBC3D41D83F87E530ED91F0A6F19E99569EB04627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599797, "uuid": "17109bdf-a093-4c48-bb9f-d40e5cb46a3d", "value": "24576:DRZyQw6VfZyPw6V4jKaWlEzp7ap9dlzZbtQA3Qp5EfIwsx:DbQ6VRb6V4jKjOz0dHt/3XfIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599797, "uuid": "c71ed49a-7042-4ef4-891b-8a54d5ea9130", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599797, "uuid": "6b74f11e-c9cb-4e8c-873c-42f45cda325f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599797, "uuid": "263ed256-b44c-4a80-8dcb-60afda501027", "value": "MT-103 EXPORT PAYMENT FOR EUR 33,830.50.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790a5504-3673-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691558007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558007, "uuid": "38cc4554-75c1-49ad-9b15-00eb80b1d1f6", "comment": "Malware payload (Mirai)", "value": "731618d9fa4c82c0bb707fcad67e2117", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558007, "uuid": "32460aa6-50f6-4d6d-bd2f-79a2ff191d2d", "comment": "Malware payload (Mirai)", "value": "323f6a2c6934f6c9c46deb0e4d5a19162ff27ae4f0b65995248654c1e0a6734e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558007, "uuid": "dbdbe5e6-9776-472b-b24c-b9f380a16b95", "comment": "Malware payload (Mirai)", "value": "e2a3c1e9270ceeeeddbd5c5f058acf2e23713fbb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558007, "uuid": "2547b98f-99c7-492e-ba11-ef50583a5f44", "comment": "Malware payload (Mirai)", "value": "8b1a4475b65514a628004299dd2ddb86ce6cfc144f1922a7f3037262aa15173f1d9b22376d56fc75d67668dc1c939cc1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558007, "uuid": "849032df-d0bb-4de5-b9d5-6cef4dea4a57", "value": "T11513F292972AFB70C834123416351542F5E6EC379E229ABE12F931FD44D6C96343AEB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558007, "uuid": "6b98f194-a02d-440c-a482-44de38ee8ca1", "value": "768:+BLihwG9bX2NQiCNF52GUdTXbNdhHtZaw/iSdLexSNlDK27RwIv9sPwI:+BL0P9bX2NQTNF52GwXbHBtwwDdLOsJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691558007, "uuid": "cc8e25e6-53df-4a07-9f6b-850fe3124ebb", "value": 45120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691558007, "uuid": "9e7df6ed-c599-4f53-94df-9f3ad8c12b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558007, "uuid": "d3305636-d5f0-40e3-8e7b-694b71bd3e04", "value": "731618d9fa4c82c0bb707fcad67e2117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589e981a-36a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691581145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581145, "uuid": "7593e449-1f71-4c38-9acf-c2977ac8cd83", "comment": "Malware payload (AgentTesla)", "value": "b7119b7b2f4b613f44a7a51771ff7d70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581145, "uuid": "068d6ce0-4fa8-431c-abd9-0bcf490c9e66", "comment": "Malware payload (AgentTesla)", "value": "325054c4115a1fdb6ffbe48536d8e54afcf6c1ae974d5afdb79d6646769f436e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581145, "uuid": "f21961f6-6205-4388-b0bb-fc1abb96d78d", "comment": "Malware payload (AgentTesla)", "value": "6381aa935efd4b7a0e79aba630ca6ba728592a43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581145, "uuid": "a356a999-7f4e-4cc2-a90b-db640f10f729", "comment": "Malware payload (AgentTesla)", "value": "7c20427099d1e36d7a0237db522d543076169356f9ec866f426af6bc98188b41e13b6194eb0431d5f024f8cc40039adf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581145, "uuid": "f76596cd-0a65-4e3e-b543-17c2aadb7953", "value": "T14604BB74A1F26AC9F896CEB29E61E609FFE70C819A41421FD17439F61233B84C6451FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581145, "uuid": "a7436e84-13d2-4fc6-b073-54afa59fbdfa", "value": "768:he/BQt+uZj3ViIisLk35bQzQ95snIIIIIIIIIZnIII2nIIIZnIIINsHIIILHIIIu:8p21ZjhGIBOrPaOYdSkjiRNqOP3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691581145, "uuid": "57b4d58a-18ea-4b05-82e7-93b298497ea3", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691581145, "uuid": "abad12fe-a829-423f-b8e3-57b97dba4903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581145, "uuid": "a5f2baf6-604c-4956-ab50-e1534d8a247e", "value": "SecuriteInfo.com.Win64.TrojanX-gen.26182.14183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64303a3d-36b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691587178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587178, "uuid": "296e454f-6a71-411e-8e7b-88747071130f", "comment": "Malware payload", "value": "d4a13637a79b986edcf37e16f96fc9ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587178, "uuid": "f7dac37d-4b1b-46ed-ba08-e4c1d9103e8b", "comment": "Malware payload", "value": "32a86846495df9594aec9fe9538b99b8e156afe5a86e55c3fd2471217952cd4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587178, "uuid": "b3473ede-257b-49f5-8a29-7c3b3c1c5488", "comment": "Malware payload", "value": "6120c396759a5dce397a8f92a656dc929f1a9c41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587178, "uuid": "efaa3bf0-380e-469d-906f-18190515ef95", "comment": "Malware payload", "value": "dabda8fe991591b76b4e3f2780488fdc6e785d112a30f973bf62ecd6ac4b69ba63b9c2e722d31423e7d83e0dd047a8af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587178, "uuid": "b00aae66-2e9a-4762-a8c5-dc6740ef9dce", "value": "T1C6946DC6F646D198FC5A0530943BCF841653FE26B8502A5E7AD6BB4F4F73282B86740B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587178, "uuid": "af018037-bbb9-4de7-8cd1-3fb34e210ad3", "value": "6144:W7yL3OOeAaZYSR6dr83E3pnkmahcuGYCtP:W7UGYSAm3EJ5uGYCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691587178, "uuid": "dead1958-842a-4629-9080-f54ec6632254", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691587178, "uuid": "baac4ac3-8659-4993-a8f6-80bedf407766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587178, "uuid": "427aa9c4-523f-4a9c-b136-c930809d5c62", "value": "xlicons.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74ad64a-365c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691548233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691548233, "uuid": "78e83b66-9c45-4072-8d3a-770104e3ba09", "comment": "Malware payload (Amadey)", "value": "aa0dab580befbd5451e142027e150896", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691548233, "uuid": "5d6051be-f612-4483-8079-0f7bc2e7cf70", "comment": "Malware payload (Amadey)", "value": "3321c5e7113a5c48aed748c17b2c497179bde417ae35164fcd0d574b34f4272d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691548233, "uuid": "80051104-83fe-4cbe-9595-9b5c8b461fef", "comment": "Malware payload (Amadey)", "value": "e889516704508df17ae16bd3a48d56195940f1a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691548233, "uuid": "4766a466-fbe7-4535-bb99-0be6611eec32", "comment": "Malware payload (Amadey)", "value": "9337a8b37287b7c331fd002499bbabcd3044c0b51231a891e688271c2970cd8eee28e8406a2f0c72bc2c24a2396e01f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691548233, "uuid": "e8d7f75b-936f-4c6c-b803-dbdea4bc7055", "value": "T18A03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691548233, "uuid": "3cf65a25-778f-4256-bd06-298be7ff0556", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691548233, "uuid": "ee1e6c1a-6ef4-4dd7-9d19-0e717408f729", "value": 40988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691548233, "uuid": "c6bf1428-1245-480d-af7d-31e6cb9f3f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691548233, "uuid": "713b8151-683b-480d-a5bf-61bd33686285", "value": "aa0dab580befbd5451e142027e150896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ed98a1-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602832, "uuid": "dd4da7dc-f01c-420b-9197-90574c17ef7e", "comment": "Malware payload", "value": "aa767000909b63a93549edb44b6047e2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602832, "uuid": "abcf5c68-2696-4168-a68e-e7729d77e3cb", "comment": "Malware payload", "value": "33877c64ff03794b51581b7014d85961c7d452a0cd911cfc7cb5a2f29d73fbf8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602832, "uuid": "d0c9ba6c-8dcd-48b9-9417-b16a093a451d", "comment": "Malware payload", "value": "1bf24730f2d268ddaadc90dd31d5811975fb206a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602832, "uuid": "e33d75b5-dad7-4600-9db4-54755bd9e5a7", "comment": "Malware payload", "value": "5e6d15869e50e81503995c60ae50786f3fa9bdc17352d3e28dc73c71cff6a7223ee29e5c164544115b2084175ec3babb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602832, "uuid": "c18bade9-8aad-4d67-9d93-33ec09ddf2e4", "value": "T112E4236547628470C2EAC0BEB40A587EC44F7F6366F3A25B49E4854173AF7DDE22078E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602832, "uuid": "eb0f1758-207b-454b-83e5-b2d4c456bd82", "value": "12288:7RnWC/OTWFfKm8+tOg3G95g1M4/2zT9zDBV3Jfiybs0naMjVHto7ufw1yzTRINVf:dewi+eg1f/2Np9AyIYV5jla3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602832, "uuid": "d3a03344-340f-4db5-8d2e-23dd182826a6", "value": 661916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602832, "uuid": "5b41bf21-851c-4c27-a818-8ad8198501bd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602832, "uuid": "f4225ba0-f377-4b12-9b8d-4e9dcbb516e8", "value": "FV23-050034.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64d639b-36b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1691587289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587289, "uuid": "e98eb6ac-4a74-42e8-a9f9-2b1e365465c1", "comment": "Malware payload (ParallaxRAT)", "value": "77f82a88068d77ba9ece00d21bf3a4db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587289, "uuid": "15c38880-5eab-4df4-ae24-2d5414bf5f94", "comment": "Malware payload (ParallaxRAT)", "value": "33dd66da63f57e1d64d469172a5d5e7615924bcde919e962c4a5a00c51306051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587289, "uuid": "ae4635a9-0449-4f34-ad6e-87bb547fb86a", "comment": "Malware payload (ParallaxRAT)", "value": "cedf93d2a9dae5a41c7797baaf535f008d0166e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587289, "uuid": "bf8eb4eb-99c4-4be4-8556-743700faf2ca", "comment": "Malware payload (ParallaxRAT)", "value": "c6241903957ea60a25836e16ead0fa32c94c5d2954b6fd3444a217d5bb960402010be27d36f9ebec82f56e0d74d01ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587289, "uuid": "27a5759b-ba70-4ecd-ac3d-637aa02a115e", "value": "T10A753B721109A41BDCB4C7751353FEB5A871EEE9BA1EC2A25BD0BF6B783514C096B203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587289, "uuid": "331f68b4-e1d4-4916-967a-f59c894fc9f2", "value": "c4d010441c17e8245adced7fdcad59f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587289, "uuid": "3c8af7bd-ab02-4ac5-97dd-b01aa3077bac", "value": "12288:KNVVyrGvaRlb2nZS1dUpSp3fHgY+bE6gVVpQIcsmvG5SYmG7Sa:SVNPnZSXUpShfj+bE6gLpKpu5SYm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691587289, "uuid": "15e97fa1-85c9-4a80-872c-b3063770f550", "value": 1604096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691587289, "uuid": "aaa936fd-3914-4746-aae9-4087d53eb8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587289, "uuid": "869e6aa5-91c4-4514-bdfd-4fbfdeea894b", "value": "html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee70b1f-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606255, "uuid": "586895ad-8a05-4fbf-b2dd-4357f6723ca0", "comment": "Malware payload (Mirai)", "value": "4bf636045ee35edf3ed7e5f227e4a266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606255, "uuid": "75c5c2e6-35fb-4468-b9ed-ba9a825c27cd", "comment": "Malware payload (Mirai)", "value": "347bbf6d113007aef1fb8d3ed6304f749900f8ea09c08f6cfdbbd71f05a842cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606255, "uuid": "6ee5fdd2-306f-43ae-b342-a87a7ce46b1d", "comment": "Malware payload (Mirai)", "value": "4b03faf759ab4def3619135013968fb126e5417c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606255, "uuid": "fb01cda3-0bd6-485d-bfe9-f8dd9dd8a4a7", "comment": "Malware payload (Mirai)", "value": "7c34e86d13b31371c20f699dcd62d4f58622b8f6073dc8b80c99495ba215b28bd21fcba26fa7bce08d6f398030dddc1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606255, "uuid": "0a71bf0c-3d76-42c6-bed9-56bbd2721bbf", "value": "T1DDE2E1D555BBA879DEB20D7AFC63074D2539C5FC8AFB112267F8363423B09A64AB0443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606255, "uuid": "8e6b02cc-55a7-4704-9b89-9689c4626112", "value": "768:n8Lm6COq1fewdHy62pud4yNOYSOyB8Lrx29q3UELdy:8LJCmjpkcMKUVbLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606255, "uuid": "21279c09-aef8-4d00-8b29-f4d1e4929307", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606255, "uuid": "600738b7-2fcf-4df5-9b49-64a822a9a73a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606255, "uuid": "73eb708e-8107-4371-9518-0be4149b9f4a", "value": "4bf636045ee35edf3ed7e5f227e4a266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b5c2cd-3698-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691574047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574047, "uuid": "ea639462-debb-4401-8db8-187226eed2db", "comment": "Malware payload (Amadey)", "value": "8d5d4cee9ae1865ad036bac284484993", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574047, "uuid": "9c8505f8-2cf8-4957-9b21-e46d89513e4d", "comment": "Malware payload (Amadey)", "value": "35129dabbd5d24e6e69d65bdb1d3103a97ddb3bbabaa04dfc5149efb8d1de3e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574047, "uuid": "32ec0587-4a4c-4f6d-8d12-824e4db2287e", "comment": "Malware payload (Amadey)", "value": "9102324dada1ede94907782a832ca4cd6ea0ef26", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574047, "uuid": "eda9ca9e-154f-4abd-b548-dc8ad8965c21", "comment": "Malware payload (Amadey)", "value": "b98db43537b87bdf128add0dd88621fbd042fff777fbc8609ac330876f05ebe11cff733877a4d53829a7f5bbf22c0971", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574047, "uuid": "95395186-335c-48c8-b01b-de5c801785ee", "value": "T196C41286BBD48073D8B027B058FA03C70A397DA65D78532B2786DD5F5DB26D0A43172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574047, "uuid": "022e192b-ff8e-4592-9a4e-a808463ab881", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574047, "uuid": "0161e1b7-f22f-4f7e-8a61-53c9aeff77ef", "value": "12288:eMrey90bafSLOYhUX6TpvMmgBYC6FYUpJ7Vj1R:8yujOyQ6TpvozsYknR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574047, "uuid": "0aaff9eb-fbf7-43e9-ac71-37904b3f7022", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574047, "uuid": "25c139aa-165a-4a05-b9d5-a8f93ddb38a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574047, "uuid": "298df054-5bd9-4f9e-8e96-ed430627a73a", "value": "35129dabbd5d24e6e69d65bdb1d3103a97ddb3bbabaa0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb738dd4-36ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691609229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609229, "uuid": "fdb2aad9-450a-475a-a81b-b854f688c7a0", "comment": "Malware payload (AgentTesla)", "value": "02f640b65a7d8591daeb484c59a9da26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609229, "uuid": "f184a326-2d72-4a6d-a197-19a7987bea6f", "comment": "Malware payload (AgentTesla)", "value": "352f49bdcc9d31b5707d6d2bd026edc78f9925ea4da142465aa2bb1152b82e6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609229, "uuid": "a08c8740-5bf8-4565-9179-749018d34afe", "comment": "Malware payload (AgentTesla)", "value": "5ca00357cfe86a0ab9d988eacbc8cc2291feda60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609229, "uuid": "ddeb8184-83fd-4cd2-92dd-76da94375e14", "comment": "Malware payload (AgentTesla)", "value": "7f4ee198d554fcc8709e5a2572118c70ed9ee17a41678431716ba1f1202d72f26ebd018ee40d2b6eea21db1e719bea10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609229, "uuid": "020199a6-d42e-4b34-b56a-d25509ed97d1", "value": "T1FDE412FDB2E75E30C7A44A37D25B50042335975B90A7F70B1A0822D2863AFE69355BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609229, "uuid": "a16b7bcb-f0e3-46a1-be57-93091b41f1f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609229, "uuid": "5816729f-7563-4171-b28d-2fc8886f825d", "value": "12288:4GGTIYlV2twVtSFNItIiXQW8W3r1Wc/2A7HB4oWAIRDv2N:4xIYlVUw/SFNfiAW8W3rD57h4omy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691609229, "uuid": "1983abb3-b320-42cc-a0ce-2bba044868ce", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691609229, "uuid": "7e786a39-5d2c-49f7-88e2-2ddee41d4c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609229, "uuid": "2bc86a0e-d7ab-46cc-8381-ee52c6a45b33", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d81500-3664-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691551532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551532, "uuid": "b393a43b-33ae-4051-a9b1-0f28f2f1b452", "comment": "Malware payload (RedLineStealer)", "value": "1dbfd695f6f6494126fcaaa7493d33d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551532, "uuid": "0893d6ff-b4db-4e1b-9af8-1a89f262a07a", "comment": "Malware payload (RedLineStealer)", "value": "35eacc9458db9554296eb24f7b1faed460f0e711d824f0f8901e342f14e426c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551532, "uuid": "8996fb8d-a140-439a-9adf-e754b368df4a", "comment": "Malware payload (RedLineStealer)", "value": "9a43cb57ca82c1c116b07dbbfbfddd65dde2f2f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551532, "uuid": "2f159c1c-7a0c-4dc8-9125-d12c7d4aabda", "comment": "Malware payload (RedLineStealer)", "value": "10bbdb17c756815bb370e0ccf1c687c70309030e8d16e7054973d4788a402e40477a3824b5be708cc16e3617ee8289f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551532, "uuid": "25f05f25-fd9c-43cf-af0e-144cf3aae4a3", "value": "T112C41217B7E990B2CDB157B058FA01D30B3A7CA25DB8C2673A459D2B1CB3285E13536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551532, "uuid": "e68d7d93-6b2a-47c3-af26-037a9a03e0d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551532, "uuid": "97874bfa-9fb6-426a-ac97-0ddad9ba5c4f", "value": "12288:2MrQy90JkXsRRRDaRrqPSQAGEwPBhgBYCiEhWmnzQmO:yyZX2RN2rG9PBqzZGmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691551532, "uuid": "9a452a6d-0dc4-41c9-bbd7-090d71846072", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691551532, "uuid": "5a994949-6546-4730-9367-8e966f0759ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551532, "uuid": "c34b6ccd-5cab-4841-b40b-169f6c785879", "value": "35eacc9458db9554296eb24f7b1faed460f0e711d824f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce287530-36b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691586067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586067, "uuid": "d0491116-2acb-4776-9d3f-dd4684163ee7", "comment": "Malware payload (RedLineStealer)", "value": "45fcbeaed712a20605d3245292cb0593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586067, "uuid": "75648d68-e41d-4c5c-9bbd-b83135005f49", "comment": "Malware payload (RedLineStealer)", "value": "361d582705fc3826278ee5325fa5fba1205c13516356346e1b28ef73af69e5d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586067, "uuid": "3e241045-ceba-46de-b878-a31d83846e2b", "comment": "Malware payload (RedLineStealer)", "value": "d6c6a0ecb54ddc2da4d838cab3e91038da055d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586067, "uuid": "0d6db7f4-c23f-4153-adae-fe05a4cd22b2", "comment": "Malware payload (RedLineStealer)", "value": "10e3f99afa2411a55efa1bf62ed184f3da648b50c5375b76f36a638f2bbf2b7539eddea3c5b5eb6dfe6df5c25ab2b85f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586067, "uuid": "99245f90-7aed-494b-acfa-951f5a8e1574", "value": "T1CCC41253A6D84073EAF2673048F752D307393CA6597493AB3B469A4D1CB27C1B432B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586067, "uuid": "1ea878c8-0173-4138-8ff1-e30c8c15e636", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586067, "uuid": "7ceece53-a7b1-4169-a1fc-601b29dc9fc5", "value": "12288:AMrPy90i2+6rNwKBQFxz/wP3FDZbp1iDArkJQLf:fyQpdBQnCtZd106kCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586067, "uuid": "7f36a9f8-726d-42a2-9c01-e15452eeea59", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586067, "uuid": "ec741c20-a8ac-48a3-8cda-a9cc97f00594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586067, "uuid": "aad16da9-9838-438e-95fa-4cef3db9e320", "value": "45fcbeaed712a20605d3245292cb0593.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356fb58f-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602991, "uuid": "e394cbaa-d213-4e59-b457-99897b4b5c3a", "comment": "Malware payload (AgentTesla)", "value": "38e31a3447a09e0aeeead02d25adaa4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602991, "uuid": "6ac059c5-a95e-4503-b969-34262be50157", "comment": "Malware payload (AgentTesla)", "value": "367694ed3588ece2435244e5fb94d190a17adc4410da1d392c117f9bc543b55a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602991, "uuid": "164e0379-4b7d-4285-98a2-a5554ccaeff8", "comment": "Malware payload (AgentTesla)", "value": "87a128f422a74e2dcab618373631837e48a8c072", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602991, "uuid": "efcb9a33-f672-493d-bcef-69fa12d13cc0", "comment": "Malware payload (AgentTesla)", "value": "36f331b0c766536bd64c92a5a71c2f034def5c644c4aaf55fc00f5e44a81f812569bf5b6ef756e2e452b9aa3e69722c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602991, "uuid": "11d0c2ce-e4e1-406f-9102-6a282a2502bb", "value": "T1BB856B03BE666DA1D746D736C5D704004B9ADEC12AA7C72F398A335A2B337BE5A03147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602991, "uuid": "b4ee2001-8d1a-440d-aa9f-eaa705285046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602991, "uuid": "fa952bb9-7595-4781-a4fb-1ff634f37e86", "value": "24576:xMbbGpPdOyHYpjrwljl6RnoWBb3AnihHBkyUZHxNQzJKz+nrmQ:zWtkK3ph+HxNQa+CQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602991, "uuid": "0674f969-b8a2-4437-bd66-49e34b1df767", "value": 1806520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602991, "uuid": "02096d9f-79e9-4f5f-8cf8-6d71d61190b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602991, "uuid": "77f214a1-7430-43f4-a23c-ff369e28b5f7", "value": "QUOTATION_AUG7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf7498e-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691599728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599728, "uuid": "753e5f04-99e2-4c92-a563-8287134dd6dd", "comment": "Malware payload (AgentTesla)", "value": "d22c8ae1012d8494ad7c0a0fc7004350", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599728, "uuid": "b5eae1fe-41c2-42f3-90aa-c1f66dc35134", "comment": "Malware payload (AgentTesla)", "value": "36b46cc4190ce3730b7655ca7cd4ac4cb651d4bcee0bfadce918178440a75400", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599728, "uuid": "915b31c2-433b-494a-806d-9a03bd7bfabe", "comment": "Malware payload (AgentTesla)", "value": "396e9b17a1469a84803673dac40d5be7244352f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599728, "uuid": "d02fe9d9-70f0-4573-b2eb-6861fb150d51", "comment": "Malware payload (AgentTesla)", "value": "558d2960392f7567b7a6545b5d341385d9c1eb7d91be8faf0f4528d2266f2ddef5ea11f6ce6ea98284e7647f7c88b637", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599728, "uuid": "b3a6ead1-833e-4b83-8cb0-9a110cfa9e07", "value": "T1B2E40102373CAF33E5F993F5257910900BF2255E2A9EDA680DE2B0DE1976F109A11F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599728, "uuid": "2bc670c1-c6b1-48fa-8fde-5af466b5e998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599728, "uuid": "1664b9f4-397d-46d2-ae8a-e34bcd1d5527", "value": "12288:NsZx4iF9yeIea4jyJgr71w3ohhj/r8QvOZyBhspkO+TwUQcK:a74i0ea4m6r7Eohhj/r8fZKhsp1UwIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599728, "uuid": "4bc1cf08-d39c-408b-a374-b43e3f795850", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599728, "uuid": "be99a684-d278-418f-8d8e-62cd182f80ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599728, "uuid": "2fb156fa-70be-4b55-8606-8edf41db95a2", "value": "Confirmaci\u00f3n de facturas pagadas a su vencimiento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc9e829-3695-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572541, "uuid": "50e6ec3f-28f5-41c1-b73a-69a59e9cdc02", "comment": "Malware payload (RedLineStealer)", "value": "62e5a5aa61119f33022027ebdf286171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572541, "uuid": "873fea0b-3e94-447b-9aee-98c48007fcfb", "comment": "Malware payload (RedLineStealer)", "value": "37a09fba4da84a87d6a93fbeadf617952f1ec35ef474a655c26f277bc06071e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572541, "uuid": "b9b42eb8-c9a8-48eb-b982-734e7556df82", "comment": "Malware payload (RedLineStealer)", "value": "cf69ccacf3304becd0945b421b79574ab2688628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572541, "uuid": "05339c09-d5d4-4269-96b0-97619ad9512b", "comment": "Malware payload (RedLineStealer)", "value": "e51f1a8e037f1d85bc45887b2dbb551392915631e3da8fbf7f3a73df9972a083d1fe3b67782a490d766aea257946dd45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572541, "uuid": "89bca8b9-5499-4746-b639-91f89ded750a", "value": "T18CC41222E6D880A3D8B20BB059F713E30E3D7CB25934531B6B559A1A0CB3AD4A572777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572541, "uuid": "e206b63c-d073-4056-8a3a-4609e70c6ba6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572541, "uuid": "05b2f812-b752-4cb8-af88-67edcfc0a8c9", "value": "12288:LMruy90mIL7iOWA8jOQ1LPYgeJLy1TuiYn1nZ:Fy5ILW+6z3edytuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572541, "uuid": "6ca7e7b3-9ffc-4518-9146-27b1bd1812ad", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572541, "uuid": "9632fa2f-7f6c-4608-be0b-f5f2a7c490f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572541, "uuid": "c3a7776e-048f-477d-891f-f70e24e17ac0", "value": "62e5a5aa61119f33022027ebdf286171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4af4f2-3694-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572236, "uuid": "defe6de8-02e3-451d-8fd2-f93194142be6", "comment": "Malware payload (RedLineStealer)", "value": "9cb808cc68f138024f33bbd7fdccb95b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572236, "uuid": "ae652a14-ea08-4e9c-a7b3-8e683171271d", "comment": "Malware payload (RedLineStealer)", "value": "385b746074e9aa36573692c00a27fab2c257c696bd7d05b5d2cd98a0e3a596f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572236, "uuid": "5dfbea83-efc1-49bd-a45d-83da7d7c8bb0", "comment": "Malware payload (RedLineStealer)", "value": "61e0585b4cf4ecc50778482d0f74a50f2f0b10ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572236, "uuid": "0aaceeb2-a11e-4cd2-8995-030b0918bc8a", "comment": "Malware payload (RedLineStealer)", "value": "0d314206e80f0d3c6fd7e2b5284a55dd1597dbbe735a4e9cbb28b836fb2f27f5e2fc83801119dd9b6f3ea4d65f342fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572236, "uuid": "3ef6c1e4-7f5b-461b-bedd-ca42bf660bfe", "value": "T1F8C41203D7D94073E97517749DFA12871A3ABD628E708326229AA90F0CF3394D63276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572236, "uuid": "bad0e0c1-594c-416c-a074-dcaf55f22da1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572236, "uuid": "f0bddb27-bd68-4a13-bba3-1f1992258882", "value": "12288:7Mrpy90kMf7rhYLXfCsgTEDdxVGp4rWIeaYp:+yXMzrcCFYVo4rWeYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572236, "uuid": "989e6315-ea28-4f4b-b316-39ee660e5815", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572236, "uuid": "3e6ff192-3d97-4d33-8cb4-8b5e55823238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572236, "uuid": "5dbddf3f-722e-480a-b0d3-43d2a5e54fb0", "value": "9cb808cc68f138024f33bbd7fdccb95b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f639d734-369f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1691577115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577115, "uuid": "03ef0f3b-915c-4772-b477-c0fb291fbeae", "comment": "Malware payload (ModiLoader)", "value": "6f9d18e4a3748ad8d8976db90c2b0462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577115, "uuid": "96c7e76c-8053-42c9-991c-01e28e1cdfd6", "comment": "Malware payload (ModiLoader)", "value": "3866b18892bbf0a1ea3a9d854059a51f61d8036700c169f67f64fe8f6f6d4cc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577115, "uuid": "bd6762a5-a423-43d6-b299-916b1123b0d4", "comment": "Malware payload (ModiLoader)", "value": "a3f0327bc6dc8a7e6ac3e624d6e639418a927823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577115, "uuid": "65afa1f0-c96b-49d1-b912-4ab8ea373452", "comment": "Malware payload (ModiLoader)", "value": "42e4011f55304bb80fc24c993ceb3bf274c5337fb0e59aef27f623ca4c21a3e3cfdbdd8735b57c638a4f46a173b6d1f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577115, "uuid": "f8a4aa95-b940-4c59-8cc6-6892fe622335", "value": "T19A05B035E1684473E05E2D39DD06EB545C387D313D34A86AAAFF3CD89A7A683FC16182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577115, "uuid": "eb18af68-f190-4608-adf8-3f26463fbfdf", "value": "c1bc1b4428880431ffbb0e7b82ce2dc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577115, "uuid": "43ddbca3-899a-463e-9f0e-0929252b39a6", "value": "12288:h3H75pQe3LJf1jpBVudoJrLsqkbBjXjiggOhGHxWgyFaB3Z6:hL33tfd8dgLTklKggY9aB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577115, "uuid": "7b73d368-6e2c-4d90-ae35-7789fe502d81", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577115, "uuid": "00d14d5f-9c44-414f-8886-ee410d672bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577115, "uuid": "06a52926-ec24-4a12-8c9f-cb631fde15db", "value": "3866b18892bbf0a1ea3a9d854059a51f61d8036700c169f67f64fe8f6f6d4cc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203823f2-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691574608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574608, "uuid": "c1f9e36b-7796-4276-8592-8f1d90a12cca", "comment": "Malware payload (Mirai)", "value": "ebe467f55d0b62174f254842378a815e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574608, "uuid": "f55e6048-e5ea-44c5-a5fb-667d30a412ab", "comment": "Malware payload (Mirai)", "value": "394f0876faf53ed2c30b927a1fbd091be6956acf06f8f3dc2b35d7c9e401ed1f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574608, "uuid": "0a00c077-35a7-4f4b-8e60-b7cf2289c4cf", "comment": "Malware payload (Mirai)", "value": "efb4efd2776e22104f2b61d4b5e5f73e90231cf4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574608, "uuid": "e965162d-1cbe-468b-8642-a9c2d3bc7af6", "comment": "Malware payload (Mirai)", "value": "4ff988a0bc41c40d65ff9a174a4a73a0ab46ad9d8f9bc950a3b5ad5866f96606026ae73dcb4d992891369714adaebd11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574608, "uuid": "bb8bda34-5748-4583-ac9a-a01d0c5667d2", "value": "T128C2D03056EE2CB586500A72F7B856C9BA534F7DEAEE3890114057FA3D418052DEADC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574608, "uuid": "7330424b-3eeb-4de3-988a-324f8288f54e", "value": "384:ESt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNE4KtshymdGUop5h0:ESsoTAZ3alkXLvFh8nNEttss3UozS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574608, "uuid": "8dd30416-ef8e-4b66-9333-f44b2eb729fa", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574608, "uuid": "91751123-7c14-40e7-8ad3-c52ca6746145", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574608, "uuid": "d2710e36-6717-449a-a314-9d3b67456a3e", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf5bc55-36ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691609929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609929, "uuid": "77c6f828-6e94-45cf-93ec-5750d0ea6e23", "comment": "Malware payload", "value": "bc1705db6ccc60784390e7ae66887148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609929, "uuid": "d1668a66-f343-4475-9f50-16b8b431e8ec", "comment": "Malware payload", "value": "39e67f25b0fa660db0541bf37e315fb4def772bd3b6d67991b64a5a85914477d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609929, "uuid": "7d243c56-33b5-44c5-a28c-174aa5474604", "comment": "Malware payload", "value": "6ff6a0ed3412f944b2a74479993b7e5dc56773d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609929, "uuid": "d65b1407-6d24-445a-a012-530d0af89a58", "comment": "Malware payload", "value": "4c5e1091fe0b9eae694f711a8b1ff07f7c5231fde646143216d3c439ed7604fec73a813b81560e4e4700317ed67b25cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609929, "uuid": "ea1f4b6a-ec75-4173-8411-e3a9be2a92f2", "value": "T17313D50B77840773D5585575A8FB252123F16CCB9B33A6CA3F4C728D2E023A79D826AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609929, "uuid": "5a40daa9-396b-44c2-9914-bdda489c55b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609929, "uuid": "81157bc9-a3ae-4842-bd2e-921614389b03", "value": "768:hFVResNz+5fRg8+CsS6H1YH6J7pfx0yiG1m:hzosNz+5h+CsS026tpZ02m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691609929, "uuid": "c9d861bc-273e-411d-b648-fd1a2c07374a", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691609929, "uuid": "8aef0419-6c4a-4746-a23b-65d62b42a065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609929, "uuid": "85b682b4-93b9-4c37-8cf1-8c528d02b413", "value": "paste.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba895b44-3687-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691566707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566707, "uuid": "0bc55c65-591f-4dc6-8f0e-9c0a096f4b36", "comment": "Malware payload (SnakeKeylogger)", "value": "04e74f3bbfe2663bbd434de85a3b1efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566707, "uuid": "605772a1-ca54-4e85-bdf8-19d79ce20e5a", "comment": "Malware payload (SnakeKeylogger)", "value": "39effc8ad793805f7a5558b804d72b01de87db3a89657c91d5508612c15d3761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566707, "uuid": "c4801ccc-61c1-46b4-86f8-61d927e69440", "comment": "Malware payload (SnakeKeylogger)", "value": "ed8bafcd88dd9e10a76f8a5296dae752eb01992b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566707, "uuid": "14d380d9-039f-4de1-987d-5d3c768fd164", "comment": "Malware payload (SnakeKeylogger)", "value": "540f2c55fff87732790d41b1604ce079ccae8dca913ccd7c25332156478349ad63b1ada566df0659c6b652632d79dfaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566707, "uuid": "7f304e9a-6613-4d98-8b38-827579bb40fd", "value": "T170C3091BF7CB8DF1C2785F3AC19B511003B1D69EB763CA0A7A8EE35919033A599056CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566707, "uuid": "0d6facb1-a16e-4714-94fc-95e841b7713c", "value": "3072:s5zBEAzGMg/GakKy8WtH3ox6ZdcmfM/f0LSATP:2zBpzGn/3ty8WtH3oxFH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691566707, "uuid": "79ce8a66-45b3-47c8-94ae-ce4bfba503e2", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691566707, "uuid": "1c8a4826-b191-43d5-ab48-3874a80eb243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566707, "uuid": "c41a915c-a537-4ba0-b978-bf8bedfb175f", "value": "Rbnzqx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332b2c9c-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691571634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571634, "uuid": "e9e2f86a-fe3e-453f-bdc8-25bfae853e9b", "comment": "Malware payload (Gafgyt)", "value": "db480f89a4bd819d6a2101a224e1d93e", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571634, "uuid": "879ec4b5-2c60-4ef5-b81d-7d4868e4e6ce", "comment": "Malware payload (Gafgyt)", "value": "3a2b2eccf59ed48d6bb039e75cad047036aea95976e753a5cf51da0b5ecf442e", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571634, "uuid": "559d97bb-51af-444e-b1ee-e3e63025bbc9", "comment": "Malware payload (Gafgyt)", "value": "c53ff40cf499b65ee397280b2333b15466eedd41", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571634, "uuid": "53fed0a7-49a0-43f6-afe4-c0a35f5e0e1e", "comment": "Malware payload (Gafgyt)", "value": "c9132ebbdb8ea29ef3a10e556597325ecf3dd8b560207eaf7d098acc117c5bad18c967536983f9aca941c95cd7cef9eb", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571634, "uuid": "9b1817b8-0e60-41b2-9838-6186512624b5", "value": "T191230254C69E47FCC50BC4393CBFB5CC4268635B4A3E4D522FAC946E8900EAB27B15AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571634, "uuid": "34711ad4-822b-4708-8a06-0d8e51aa6ac9", "value": "768:dZNwic0jwbAQMy++Iw1d5HRrQlG8yJHe5S6kvsms+OZ5LNcurlkjoTyTdILPig8h:dZNwZ0ZyV1dU+Hes6QsmslZnVm0yTdIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571634, "uuid": "caa05319-4096-4931-8d57-587bdb53f64d", "value": 47852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571634, "uuid": "f746c944-cac0-4541-896c-ac18a3e85dda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571634, "uuid": "992e7f87-23f3-4d83-b0b9-0652677c03d7", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5ebc49-3692-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691571144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571144, "uuid": "b8b6b10a-2fdf-4830-88c7-eec020ccdda0", "comment": "Malware payload (AgentTesla)", "value": "2ce7379077f3f837a7183b01d3c408fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571144, "uuid": "41ae6b23-3ba7-499b-9f71-1042911841d7", "comment": "Malware payload (AgentTesla)", "value": "3c4480182736fae7f98710b9d84081c004629bd1c8ec7d88cd5a5b140ee3eed5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571144, "uuid": "c1fdf87b-4e54-4482-b91c-8284a1939a96", "comment": "Malware payload (AgentTesla)", "value": "a62f20f031ddce91edc3b4e8306661a26e166f15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571144, "uuid": "68964977-0f2f-4d92-9b07-cdcf01ffe837", "comment": "Malware payload (AgentTesla)", "value": "03ebff3d03d94ac6e1c185193e1ce4903c0a61b977d9f26bb7b86f8678cac0ba0f26bc7a4b80320b9ac7f72148b8ad8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571144, "uuid": "338c0b36-4188-4ee5-bfc5-8d709b4f0077", "value": "T1E0150822E77B6549EF29A6E84E2F847179C6DC80F1B1C588B7E7680385C23114E35BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571144, "uuid": "ef8bfc7a-6396-404f-919e-9bf1741974a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571144, "uuid": "eaa54c2c-2a45-48d6-9f0c-39a8fda3453a", "value": "24576:W0YRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOOOgu4DgVUdGd0s82dxfU:WNRs6CE3jLbO9Rs6CE3jLbOeuoW3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571144, "uuid": "277b252c-4452-4f55-8785-972eb9dfd00e", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571144, "uuid": "5bdfb212-71e2-4b19-af2f-ee6301871ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571144, "uuid": "37e24e87-186c-43c0-8585-ae6143c6adc4", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93aa741-36a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691580959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580959, "uuid": "89945581-0df4-4ca4-a710-90d1ff3a5f16", "comment": "Malware payload (Amadey)", "value": "ecd6a0da449c85828a91953597ac0358", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580959, "uuid": "9ccfccf1-7a31-426a-ac27-667f6f34b063", "comment": "Malware payload (Amadey)", "value": "3cbc435a5facea000628c9bc9d9d7ae9210c0f3ca11678e90cc8a4545ad67616", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580959, "uuid": "81e06801-f7cd-4516-a526-5b5030f20cfb", "comment": "Malware payload (Amadey)", "value": "8930165e89f6260e0f452aa5164a6743e0756f05", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580959, "uuid": "0615f20a-bd55-4f2e-acf4-7b1b03efab07", "comment": "Malware payload (Amadey)", "value": "724d190add3a5df20c68b525dd611ac1b20d000e498aa448ad312d456672b9e3433cbf47af96bc6ac157638fdda33e11", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580959, "uuid": "962ba42b-cf10-4d0c-8565-0073bd390c44", "value": "T1DDC41243BAD85573C6F717B028FB06D31A36BD616D38821B2791A94D4CB3AC4A13673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580959, "uuid": "745b1649-96bc-4cf2-923c-b8e8977c8663", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580959, "uuid": "987fbc16-89b5-4a03-97f4-bebd53f1c343", "value": "12288:jMrEy90z/qYx/j8zcInVPHEVULJ27+JyTxUi818V6E:3yYiYxj8zJVPHz9JyFUzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580959, "uuid": "b1d3fbc7-7f81-4b22-80e1-726d5ca9cff1", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580959, "uuid": "fb8411ae-78e6-43b1-9c39-541dffc746b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580959, "uuid": "581f3956-3dc1-4e6b-902a-49f3a2c720fd", "value": "ecd6a0da449c85828a91953597ac0358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed76bf16-36f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691614896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614896, "uuid": "2903f888-3b7d-495f-b986-13b97fb43c17", "comment": "Malware payload (RedLineStealer)", "value": "1468f76eee4b3c9eff679a76dc9dae87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614896, "uuid": "6c429278-cafd-4048-8aa9-d4020ce20dc8", "comment": "Malware payload (RedLineStealer)", "value": "3cd798071cfbd50ee158d709ce939435569438d4890f6a6b3d85bc7cf540ab4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614896, "uuid": "9ee91dd4-100b-4447-9553-d0d3cc0cf00e", "comment": "Malware payload (RedLineStealer)", "value": "065f6069e2fa115feda3279542e94726ee46e816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614896, "uuid": "54f1fb1c-02df-498e-9ada-07ddaef034bd", "comment": "Malware payload (RedLineStealer)", "value": "982b4ec6f9d4dd1d20165fde52ee073b71d165da208e24b3250412d1c9cb6bb15b9f8a823a9df6063efd9b2d89d1f49b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614896, "uuid": "788f5442-2cbf-4d8a-98fc-6dd1cb7b9e62", "value": "T17604C458364BA97EC96F487E9D601CD07B7C6C622246A7079C8FF0E8793B7819B050F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614896, "uuid": "eae20125-2367-402e-be4f-aaf32104d778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614896, "uuid": "9615c259-6c3e-4fe0-b33e-07dab119e50c", "value": "3072:0lO8UbLS0I049dwHOTQGxkSs1TiE0cVcUlI4J08e8hz:0lOc0I049dwhxiE0glI4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691614896, "uuid": "34725ab0-3634-49c2-b4b2-e0c530bcbfb7", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691614896, "uuid": "8f0d1e0f-754e-4d13-88b7-f75f3ac432ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614896, "uuid": "06141cb6-f958-401a-ac90-840ed5a6241e", "value": "1468f76eee4b3c9eff679a76dc9dae87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9663f6-3705-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691620558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620558, "uuid": "0c02c772-63b1-45bc-aa58-d0613f37596d", "comment": "Malware payload (Mirai)", "value": "e446e11d798ddaa0518d400b1fb7390e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620558, "uuid": "6de6ea0a-714a-405e-aa0a-0c92d4840eaf", "comment": "Malware payload (Mirai)", "value": "3dba05f06239da605efe8b154664949cb42132b6aa1d99498318f88850d2b169", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620558, "uuid": "1bd989a7-f282-4f9d-90a5-fdf45527fa2c", "comment": "Malware payload (Mirai)", "value": "d629dc7ff83aaa6c7a502ce8c314fa9adc65e923", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620558, "uuid": "1967ac8f-9632-4dac-aa37-91b5df04d977", "comment": "Malware payload (Mirai)", "value": "d404ec86df17efed454b5632a1265db2ed0724bd50bdde4e163213661a15326c61b460e095d72b6c3913d8a1ec74482f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620558, "uuid": "eefcd6b0-e1ad-45e8-bb1c-dd790b3075ad", "value": "T13673970A2E35CF6CFB5D823697B78E21975833D626A1C649D15CFE021E7024D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620558, "uuid": "3b85cfad-b7ff-4f09-b10c-e7aac390858a", "value": "1536:HogWL2T87i8qXc3SEyNlnXLKgLhaV4+6uHO/YQBSmP9AAfd42+Is:HoB2T2qX4+JXLKgLwV4+6B/YQBSmP9/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691620558, "uuid": "ebdf858a-3395-4501-bd88-b62632bd3680", "value": 80072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691620558, "uuid": "3ed224c2-69d0-4317-9233-11d77fe952a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620558, "uuid": "e8a09382-c430-4080-af2b-3e9ea765d5b3", "value": "e446e11d798ddaa0518d400b1fb7390e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1840f83-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691603199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603199, "uuid": "ac80341c-4566-4f2f-9cfb-ce3cc140a3d7", "comment": "Malware payload", "value": "dd6b173778edd78c541721b80dddcce9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603199, "uuid": "1d8c2ae5-2863-44b3-9154-006737869461", "comment": "Malware payload", "value": "3e1726efe4cbeb3752a7df64082735d166989cf28e8ae9ab2b780381b22e263a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603199, "uuid": "34e88a83-1ee2-4cfb-8c3f-74f6a623cf23", "comment": "Malware payload", "value": "68fb66d14d13fd3b706a2b35ed9372d04f39a932", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603199, "uuid": "73cece5c-e113-46a6-a0dd-53e3ea2fb93e", "comment": "Malware payload", "value": "b9433450dfe78d1066fbb631268b0d929c5e5e726bafd640a1eddf113be8a3664712d4aad414b72b455906c1bd38eea8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603199, "uuid": "20221ea6-c0ca-4582-81fa-e1c0a2d8de23", "value": "T1CC1378C0139D8FAAF20A35BD44C52D311DE479B9722F91ADDBC78D9EC508ED512A0E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603199, "uuid": "f7f51e5c-9117-4ba8-a95e-3dfdad497f8d", "value": "f2f990465237c4edd1a206d507a4d286", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603199, "uuid": "36acf822-a7b7-413b-bc75-b0d0ca11959b", "value": "768:oj4t+i7qI+TbkIlHXJU4B+zQugcELzFTknepkZMBbosU0DmmKbdHXBwy+GrulYMq:oj8q5Tbdl3JUHsugj1knpegemD1xp+Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691603199, "uuid": "773d0423-6c03-4bc5-9648-779f91494016", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691603199, "uuid": "8179ed4f-29f7-4cbb-b06b-4ba00c33340a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603199, "uuid": "aaeb8c7e-a31f-4a6a-8651-726a309f5753", "value": "SecuriteInfo.com.Win32.InjectorX-gen.29315.18246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bd9f8f-3672-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691557725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557725, "uuid": "ecd0a54f-e639-4538-b43e-1b1b08e10e09", "comment": "Malware payload (Amadey)", "value": "c9e4b5e6adfd9dc39449b3de59e562de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557725, "uuid": "4dd1f05e-27cb-4435-b326-9a27e419ec0e", "comment": "Malware payload (Amadey)", "value": "3e2ebd86881b09f9c1f97602e84667b35c633bf225d842e30bad0a35c1d74b73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557725, "uuid": "3a2fee51-2afe-4d5e-b260-08033c00d5e6", "comment": "Malware payload (Amadey)", "value": "6b7d96fab1e479730bf944589011d54d5fe9b72e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557725, "uuid": "2aa5a792-66f3-4e12-88f9-b6ee539d25a1", "comment": "Malware payload (Amadey)", "value": "f04cb0bf46f9d62a427c8f129a1e3c47b9d66b315d2f21bbea1eb7a8f0aa5aacf034fdaa2fc6ff310b4cfd0c6848b099", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557725, "uuid": "ea8d6f78-3583-426f-91ee-bcc013e1e71b", "value": "T1E116F654BADA5740E59D07B349CBAE45DB32F892C7008D0A7F9B86188EF33E22D519D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557725, "uuid": "50f0267b-1efd-4674-a8f0-b5afc7fe92a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557725, "uuid": "f526d3f8-4f09-4dd4-865a-bf2e71220186", "value": "24576:/1sgX+Pw9f7dsrhCrt/niFbM8N1pKQzfS2RvXQvXgY3+nd+1dZNdAyvb0sJwr/T:agf0yV8K9RvKU1vAvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691557725, "uuid": "7696b703-11a9-4d42-a98e-37a589e25d49", "value": 4097128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691557725, "uuid": "17244eac-7f0f-415a-8717-914b7e7679c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557725, "uuid": "122b81b1-ecad-45f4-9c14-9afa4b52fbfb", "value": "c9e4b5e6adfd9dc39449b3de59e562de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3e9d30-3692-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571328, "uuid": "36be4118-c327-43c0-a7e7-aaf52a3cbd61", "comment": "Malware payload (Amadey)", "value": "31b2c862a29ced8621b33412a58a21dc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571328, "uuid": "60f66a5a-c434-451e-9eb3-ba16a95a7a0f", "comment": "Malware payload (Amadey)", "value": "3e685ba1d95047be78aa9237430d6423807c7db4edfdb432e6cce9dc2bc1f252", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571328, "uuid": "9307848f-a65a-43d7-93dc-db387372fddd", "comment": "Malware payload (Amadey)", "value": "aa1e7e8ff7f3d1c285df947ac937164c3f17f529", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571328, "uuid": "4648fcd9-f603-4d51-b7ef-835f23ad3940", "comment": "Malware payload (Amadey)", "value": "b8234e8ef2a33d8bb18e673cb654b018c38bb058765351266f1d5fc49c5cdb8bfe64f4daf674617bded09fe8b869d460", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571328, "uuid": "b9ce8e98-2703-49de-8572-64b4f2063538", "value": "T1E6C41253BBED0563C8B257B018FB03A31B36BC604D34925B2796A81E1CB36C5697573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571328, "uuid": "291fde3e-3484-4ac9-a741-01bb692bf9a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571328, "uuid": "54e888e2-27bc-42a6-a4a9-3a193c1820a6", "value": "12288:SMr8y90HUe+qdHrRuPqztoJ24uQyV24iF6JIiaa6Vnl:Sy2nNACZo0Qyg4NJIiCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571328, "uuid": "40025429-f4f2-4ec5-8c57-75ee8548a705", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571328, "uuid": "0af0191f-dfae-49b1-a174-077301f670bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571328, "uuid": "981748a0-1d9e-40e3-b902-de61e515a27c", "value": "31b2c862a29ced8621b33412a58a21dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1630d256-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691559130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559130, "uuid": "35d4ba87-da25-4095-80b8-f6461cdba124", "comment": "Malware payload (AgentTesla)", "value": "1e50742b9218c437e321292930b9e7f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559130, "uuid": "7569018d-1d69-4aed-bfdb-62a62c377496", "comment": "Malware payload (AgentTesla)", "value": "3e6cf1f602231fd84bcf06af2a289436736182eb7f188ab0b02d9799d47a6eeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559130, "uuid": "d116ff89-fd30-4533-b77d-a79b4e027cf4", "comment": "Malware payload (AgentTesla)", "value": "c5fb79ec3a2ba6ae2d16b88d180f3903e9c731e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559130, "uuid": "1e7d2f73-fee1-46c8-a629-7ae936ec5e9a", "comment": "Malware payload (AgentTesla)", "value": "bc7adc7e9b866f76bfb59b78cf4b47bdb8624615bdce08cae1b5278899d2ce0b4ca434c7a5a145d5b8450b599a4e9543", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559130, "uuid": "b97cda0d-c6ed-422f-8d36-6bad6caca136", "value": "T1950522457F08CC3AE9A587B5B8DB5400127DEF9A7374928D3EFD30542EB3B816EA1506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559130, "uuid": "eba87364-f636-4b03-be29-2819bfbd66f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559130, "uuid": "d884e7c1-481b-4eff-8db6-6cea6ed7c3e5", "value": "12288:7wGVJVu3/g2N0MS+lqeAEtCThB1PRNLXQ6ymktgXSEfymYnye8Sb//CZS8qK:7ZrJ2N0M1AEyNr79I2CEf/cb/gSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559130, "uuid": "da4c687c-9be2-4bf2-8e78-08bf5d1e7e1c", "value": 864664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559130, "uuid": "ac82d22f-b46d-4ecc-853e-338a45da093a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559130, "uuid": "19858572-4828-4456-9408-929ed66cb4b0", "value": "Doc25790008pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a5305e-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691602828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602828, "uuid": "90d579fb-2005-4d41-b95c-c1fe8637e3d0", "comment": "Malware payload (Formbook)", "value": "6ba74e260251f49ce3eb6cf56cc25192", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602828, "uuid": "c49b77b8-6ad0-47ce-8860-f65f92265ccd", "comment": "Malware payload (Formbook)", "value": "3e8bbd563bf539b08acb62ff89b43353549e9d0aee0a32567eb42d7f0687e51c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602828, "uuid": "84ef619f-1d3e-4f99-959a-ff62bbd0d360", "comment": "Malware payload (Formbook)", "value": "20873e960f5f027206be4cdc5b3b76c2ee2b1d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602828, "uuid": "8729b0e9-04c5-4b8a-ad84-73f7ffae42cf", "comment": "Malware payload (Formbook)", "value": "630f82089f26d5ec99505a9e90245cf1ad0a95ca59249c90e8de1ca4ac974e7871ba2320d485933cae7ae1bc3c76041e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602828, "uuid": "f715a21f-2c8f-4945-9eff-8ce49e6fb13c", "value": "T1E125AE37FEC29C37E176157C4C0A1A647C297FB30A386445AAE87D8AAF3D150363D266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602828, "uuid": "1d64e759-47d5-4e28-843d-5df5bdcd111d", "value": "bdf6349f4337edc78aae879092566618", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602828, "uuid": "169309fd-c051-4b06-b0ca-5992de246a33", "value": "12288:q+V0OGY20hP4SpWD4XIiIlYqHrvd6FE3TNDJrYb0fZp0B0Yi7fLssVcgbbFWWRpD:qWAs6lD4XNVQrvd/DFR20fI0JzR/RcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602828, "uuid": "d6eee26b-616a-4a4e-87f9-b2046981184c", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602828, "uuid": "f608f8a8-e7b2-4003-bdd8-6ac69b7fd2eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602828, "uuid": "610860f6-c08d-41f1-9f0f-823f3d183d2c", "value": "HSBC Payment Advise_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1550e8bd-3705-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691620546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620546, "uuid": "7b99831a-8cd1-41f6-9d7c-8d54e753e698", "comment": "Malware payload (Mirai)", "value": "e3fd4a236a591beac5dd0dab3e693831", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620546, "uuid": "a05da287-0748-486c-8522-42dc49899c2e", "comment": "Malware payload (Mirai)", "value": "40b1ed2ec07832e77b9716ae2e6a4678788f25e19d3aee364d07200ce73ef7a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620546, "uuid": "5c7742b2-568c-4241-9e3b-8a061616b78b", "comment": "Malware payload (Mirai)", "value": "d2859db095c5c3e48222c6dfbd383edfd6bc4eae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620546, "uuid": "327fbb49-298e-4596-bced-89dff2f3a43f", "comment": "Malware payload (Mirai)", "value": "75b8204222e4dfc29c94e0594288361ae33a894b0755c362c8d781f533f64903f5b750e7499ffba4c1b4b82a11aafa39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620546, "uuid": "d72c70e3-61d4-4adb-a251-9f996060a7c4", "value": "T1ED838116BF601FF7EC9ACC378AA8170528DD611A31A93B75B830D428F25B25F55E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620546, "uuid": "76f8caf6-06ba-48ca-b8dd-2f967b5d8286", "value": "1536:LsHhLMLiQAlHvBoaAopJpLwA9Z5lsihd42+:LsHhLamZvBkA9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691620546, "uuid": "c55d7ad0-3912-41bb-be16-5e58e4621b0c", "value": 84168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691620546, "uuid": "b5d63ecd-8d42-4b88-a261-ce2888580064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620546, "uuid": "988601ff-8658-42db-926a-88655558e32a", "value": "e3fd4a236a591beac5dd0dab3e693831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3c98bb-36b1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691584510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584510, "uuid": "819716b8-dfeb-4138-a440-0938d5d43bf2", "comment": "Malware payload (GuLoader)", "value": "9c119ae4550475cfbdc9d3ee5f73b5f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584510, "uuid": "2013f4f4-fe9e-4046-bc1a-9a2f46268676", "comment": "Malware payload (GuLoader)", "value": "4117cfa44e461122d319394e630e4836d6977b949de9a678e13c4772a10f6df9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584510, "uuid": "e1e8a9a6-f523-446c-95d5-35e48398e31e", "comment": "Malware payload (GuLoader)", "value": "3db0844c2ff760a2d8f07c6de1d2efca8ec3c76f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584510, "uuid": "60a13005-6abf-49b0-91b6-93560d48d425", "comment": "Malware payload (GuLoader)", "value": "bb71635c0f50585bbbfa52631f712ab446044ff78227e81e655c78d786df1a98e9bb5d9755d7c0c9781c768ae66e9577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584510, "uuid": "875917d0-1dd9-451b-a039-3b8c851e1a02", "value": "T133A4E0A1F3958CCBDC9E63744877BE172162ED6AAC71061F119A77E86DB3383106780B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584510, "uuid": "e15f4f98-6bd1-4e39-9ce2-af8d125be77d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584510, "uuid": "5587b1d9-55cf-48e3-8961-6fc8f8ea055e", "value": "6144:DlgvTRHybTTGup5sbH+iJ8sCYkv+fVERRRbxMI9hnPrYxmMltkb8e+LF03bx2:J2wGus2sCYk+dETRbiIznQVC85i3bM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691584510, "uuid": "f65baaf8-4ef1-411d-8535-02bd85e02105", "value": 465800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691584510, "uuid": "5b3621b1-ae9e-4666-bb2a-b6a8f4809399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584510, "uuid": "4e5d8ded-6a6b-4af4-845a-088be869a1d1", "value": "Scan_0024034 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdfead3-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691599727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599727, "uuid": "56791182-1454-41e5-a7ae-0b5d726a9d26", "comment": "Malware payload (SnakeKeylogger)", "value": "413497e05db26b981699deca615612f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599727, "uuid": "d82d9a7a-e99f-49c1-a693-9a49eb11bd03", "comment": "Malware payload (SnakeKeylogger)", "value": "416c2136bb0ca02323291f16f05c282ca7fbcc465adffab53e1c7bf18a7ebc83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599727, "uuid": "4d67efe6-6435-4a20-b7ce-4decc7f9b03d", "comment": "Malware payload (SnakeKeylogger)", "value": "80cef5a58860028c88f1c33f3a673a60a4518541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599727, "uuid": "897e48bd-6df9-46a1-a3b4-04fe59e9b188", "comment": "Malware payload (SnakeKeylogger)", "value": "d542338dbba050793b0e9b76f60a7b472cb23b8079cf24cb29832a305a55e1bf128ec32dac86b01dfbfba9c419198dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599727, "uuid": "ec97d3e0-44cb-4d34-bdfc-351a262fba27", "value": "T11A13E50893898573C7AC1A747497D24427F4EE5A29A2F30A6EDDBCA51E733CCA4117E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599727, "uuid": "4e6e1d87-b42c-4309-a593-c1de7ab3f7fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599727, "uuid": "a6c7fffa-8553-44b2-b925-af8581f7237a", "value": "768:3lTacC0KpMLY/JAH7FbgGcu4+zdH9DV2Aqo+oLZwdViD3rPTPkg8AUcSLrZ5mQXp:3f7Kpl/JAbFbgGcu4+zdH9DV2Aqo+oLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599727, "uuid": "6174678b-35dc-4169-8899-d15a6f4d06f5", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599727, "uuid": "ad61611a-35ff-431f-9588-7e0c3e14524c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599727, "uuid": "3a616dac-4523-4466-b3e9-996c3edc0cc9", "value": "Addsv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e254a07b-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691559472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559472, "uuid": "f3b71f4c-3f31-4e41-9aee-f31cad90707e", "comment": "Malware payload (RemcosRAT)", "value": "38d41faa1fdcd996ea54cd262449e7b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559472, "uuid": "9c6f756d-cc1b-4a62-9309-3116027d53ed", "comment": "Malware payload (RemcosRAT)", "value": "41e5e1da54fb730fb90a677edcc8a725d62cbddfdfb7e8d25aa4267de18f7118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559472, "uuid": "010feba2-a706-486e-af70-b4f062cb0919", "comment": "Malware payload (RemcosRAT)", "value": "e830c8b2df16f9f1dd6a5e7d093426324d1f08f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559472, "uuid": "4e2f748b-3307-4ff2-bbe2-3ae21761fb92", "comment": "Malware payload (RemcosRAT)", "value": "6476c2d386c729c84c91a2937955e7040639126388c17b53cbbaa179a934e0cf7a1729b9b5c35a8245ba9cf72f30f8d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559472, "uuid": "d533d82e-27b6-429a-b6a5-af7db19389d4", "value": "T12015221436B7892FC57C66F69BAD040447F5A7AC8A6BD8DE2CE4204781F2F009794F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559472, "uuid": "f2f27256-9f41-4099-bdbe-d82940aea9fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559472, "uuid": "0b8cc360-af49-447a-b604-d56ba55d7508", "value": "24576:Pn6YTatVa/zLBHr06JhLLthPx6nqUhmgi0zZ:P0aLLBHr08hnvEnldiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559472, "uuid": "4b63336c-c570-4ed6-91ed-16e1109f99f5", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559472, "uuid": "9eb44c19-9721-4d13-a72e-587133e3aeca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559472, "uuid": "f3b095d5-2064-4320-9e27-0c6033925056", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb2ddf1-364b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691540758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540758, "uuid": "7bba187f-2b81-4166-9211-ef260030311a", "comment": "Malware payload (NetSupport)", "value": "687c130b1c2a3a7185c2676feae9cf2d", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540758, "uuid": "ee2910bf-6758-4954-ae9b-ae7c5ac6e8ae", "comment": "Malware payload (NetSupport)", "value": "42582f7bd07d8297537948cf35c69baa525055392e62405f6f222f63b835777a", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540758, "uuid": "9629bc73-0508-4a6c-8a69-d48ddeae7418", "comment": "Malware payload (NetSupport)", "value": "04ea3a7954e84e5c8de8fbec2bf25ce25841c8ea", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540758, "uuid": "da226f91-702f-4aca-bc6b-1f4e4d2d8d14", "comment": "Malware payload (NetSupport)", "value": "80d05bf5aa32fd2e13abbc663f4f6cf53072c412ae8d8ca63480e917731a4ca6c0a0f47d494a38b8216b362c3ee0f872", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540758, "uuid": "b8651b28-7592-484d-896c-d7103e436db6", "value": "T17231373627A5071CC6B5563B58B1BA13973AB80DD90B8F8E32505EB8185819CA925F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540758, "uuid": "d9bf4153-6e87-44f3-98b1-fa5e46204f86", "value": "24:8NDZsxqtMB+UN7oKgaghW8YDA+Wmk+/CWby1TpXl7pEQeyTppTpZab/2XT:8bvsjOj1H7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691540758, "uuid": "788b0e7a-c5d7-4e7e-af80-3daabe00a379", "value": 1560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691540758, "uuid": "8ed9e388-78ba-459f-aa70-3bfd16ba4c17", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540758, "uuid": "b9bf1284-34f6-4ad3-896e-b36d9c8ea5c9", "value": "revenue-en-local.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712d98da-366d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691555417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555417, "uuid": "c95ce9fe-56e8-43d4-9541-f2ab66d1d153", "comment": "Malware payload (AgentTesla)", "value": "8eff4f13d9cca8e21f2c05b4e54e8044", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555417, "uuid": "2013cbde-3de2-4481-8db5-987b8f1f9320", "comment": "Malware payload (AgentTesla)", "value": "42b98cffb1e034308c86c0d262715685ce6469ab8879a321a721d57cded72cbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555417, "uuid": "9df07b29-70af-4f52-b8a9-237ce6b213fe", "comment": "Malware payload (AgentTesla)", "value": "696847799ac38d6fdbc1c5984432cc02d1f35005", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555417, "uuid": "74c67f63-e602-4627-a221-fdebbe1c4ce7", "comment": "Malware payload (AgentTesla)", "value": "95717854276d3ae5e1d85663fb3f0f97322cb0a5dfb56288504858293469ffeef5d43c5cf99e29af451bae8f89e8b9ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555417, "uuid": "b877255e-5280-4fe5-af91-c76641f8ef09", "value": "T11C150822E77B654AEF25A2E89E2F847179C6DCC0F1B1C588B7E7680385C13114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555417, "uuid": "78b250d7-8028-4b98-8961-947f5c93e4e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555417, "uuid": "10a66246-7eed-4b70-a25c-9a6527f4cf7a", "value": "24576:Q1JYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO4OguSbmVs0spUvXoQjs:2WRs6CE3jLbO9Rs6CE3jLbOguSbDpUvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691555417, "uuid": "0487c300-3436-44cd-943c-0841b48ab424", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691555417, "uuid": "48821f6f-ce0d-44bb-99bd-baa3e302fdd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555417, "uuid": "cfbd83b2-b585-40f7-a62d-fcad026fbed4", "value": "SecuriteInfo.com.Win32.PWSX-gen.31171.22180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbc5aef-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602840, "uuid": "a98e9c7e-a37e-4840-a948-dbdcda0d4db4", "comment": "Malware payload", "value": "592effda30057f1f23b21af692849edb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602840, "uuid": "7743d9b2-9252-490a-b961-40a8c45cd446", "comment": "Malware payload", "value": "42c6f01e2be38da4c04082fe2014c5ee38742189c8ba57222b2e7b3a6bd45fcc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602840, "uuid": "a25a5830-0e2b-4017-80a9-440366dad44d", "comment": "Malware payload", "value": "3855600c52993176de7a06e0856eb912696f0b9d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602840, "uuid": "fa1bb9db-2bea-4d87-9dfb-fd173bca27b2", "comment": "Malware payload", "value": "870cb51b8132393474841870762d9d5261d6595b0647f57b985c588415d504f4cecfc3b9d8e2545b2c0ea682b79f6334", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602840, "uuid": "07c441a0-b4a2-4313-8fff-b0e4c6b844d3", "value": "T1BED42381433E39634B86BCC1646F20294D477AC7A7A4F82E46308693FECBF6C9D55762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602840, "uuid": "8e5ece18-22f3-438d-8315-c4835169cb5f", "value": "12288:kPSWHK+NePAMuOPmMfxxLK65kD2iAckzCaLXKRcpH+jTx1I2I226zCbuYk:kaWqpAM3mAxxu4NUsKRcUvIKCbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602840, "uuid": "fe38913c-3034-4f8a-ba39-285863c24b23", "value": 642463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602840, "uuid": "3a9fff07-2640-450a-83cc-2654e948fdb2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602840, "uuid": "7870f474-bf6a-4a36-8e29-121dff3dbe02", "value": "QUOTE FOR DAN VIET.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd39eed-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691574604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574604, "uuid": "e52a4e7c-92e8-4cbd-8337-d56a0909a01b", "comment": "Malware payload (Mirai)", "value": "5172c1010dde287ec55f2a700f903ad0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574604, "uuid": "3d039bf5-3840-410a-97be-ebbd2a55bbba", "comment": "Malware payload (Mirai)", "value": "430ebd11ea89e57be96f5adc465c486d0b09aacde579d53db622506acdd3040e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574604, "uuid": "a9f2a013-c2cd-4852-ae74-d1d2e2599003", "comment": "Malware payload (Mirai)", "value": "8a865b05622fc47511402f8d5f87332b3d096619", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574604, "uuid": "79220b75-9107-4d40-a82e-248325c5b50b", "comment": "Malware payload (Mirai)", "value": "16049d18cc09e72f1a57afb2f98b66c1b8ac76f433e558bd71b43fc769bb53df2993286f554cf5acdfc8a3e87978ef35", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574604, "uuid": "52ed7ae1-8e6e-4274-97a1-bfb242d841bd", "value": "T108330262676E29D252B09777FC33EC2A679C17F85C67309A2CF06615B7C08064EF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574604, "uuid": "731e992a-d407-44fa-8d44-de7d7471f9ac", "value": "1536:99O/ZMAXIxNUk0xTLcPqF1aBexo4opKZb0:99O/ZNKyFTLGqFUFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574604, "uuid": "05c52ba8-0fe4-4390-a68b-8a7a7b9a3e1e", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574604, "uuid": "b3379dfa-9e47-4dda-bc93-059280371c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574604, "uuid": "d9514d48-31de-411a-9ffc-29bcf8d19077", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85d2971-36a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691579159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579159, "uuid": "d8ce6da6-e8e5-423c-abdd-4544a575fb21", "comment": "Malware payload (DCRat)", "value": "ad7135c4ac6dcdec9a3e7772086e897f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579159, "uuid": "7d638e81-ceb7-4bf4-b21e-723b992ae28e", "comment": "Malware payload (DCRat)", "value": "43531bc00b3cc040a017a7422b2e10e408a8e9d8d5ef9b2fad66a0674ae03444", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579159, "uuid": "eed72075-bcde-4424-8989-43f5f4082eb3", "comment": "Malware payload (DCRat)", "value": "1b5c0745c3934bdc813d4871c3f0be39fce0929b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579159, "uuid": "c662ff74-a7c1-4f06-8e4f-f47c8c7b940c", "comment": "Malware payload (DCRat)", "value": "cbbf2f24741b9ce1fb1536ac73876a451e510904d6c929cb749a96e81e1458b1a4c746ec762656508c0f63bc5fc2e15d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579159, "uuid": "9ba79379-8d36-431a-b256-074c00cb2b00", "value": "T1BA2539067E04CE12F0181633C2FF4A5847B4A951AAA6E32B7DFA336D55163A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579159, "uuid": "f5efa8a5-e9bd-47d5-af3d-4aafc8d673b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579159, "uuid": "2a44809a-cfe5-4a2f-b838-7b5b2a9fc86c", "value": "12288:p/9Iz7GVLuVF0MoG2+TME0TfN8l1UerBKuhtBH7LfoooEZ/wfdk+pdb0sGMmWZ7a:HoGVqVF044ZB8l17NfoKYfOUR0ss6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691579159, "uuid": "20ac6d92-5e23-4af3-bb7c-4a2fa4fba25b", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691579159, "uuid": "52da76f8-8d94-4eb0-a0f4-5ecfbcd60ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579159, "uuid": "3c1558e7-2db8-4c90-a380-405cd9d7f1eb", "value": "ad7135c4ac6dcdec9a3e7772086e897f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a8cd4e-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691549435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549435, "uuid": "a52233ba-bfcf-4dda-808e-dbebd07cca5d", "comment": "Malware payload (Amadey)", "value": "5a2bd33bd4d8e753baee943f2d4b3dde", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549435, "uuid": "8fe9f52a-2de3-47d6-b922-2674f2ea1755", "comment": "Malware payload (Amadey)", "value": "437192014c192306284e384a3aef5eebfb9dd21cf51df99a27ed82833f56c8bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549435, "uuid": "c8c2f7e4-fee7-4f26-ab0a-0072005bc884", "comment": "Malware payload (Amadey)", "value": "401cfbc7cb983fa3d7cae8029bdd8afbb2c4c85c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549435, "uuid": "cf0f5be4-8015-447d-a900-98178c322ca2", "comment": "Malware payload (Amadey)", "value": "857b7fc78751d8863a04a9d8c67601e1f7a49b2033daa81e87182c2ea188b26e2bd070e82ba7c677fac1d06a40122161", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549435, "uuid": "0095b21e-4a41-49c9-b2c8-f9cb0d37f1f7", "value": "T1BEC41247A6D86072DCF5637058FA03830A35BCB19C38976F2749DDAE98A26C4B47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549435, "uuid": "e3485a44-7107-4f56-983c-9788ea5759bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549435, "uuid": "3410b0d4-b4a9-49ee-902f-c95fb1da03d6", "value": "12288:9Mrty90X2J9OFRyy/LSnBDTYNnL2iI0hCBgBYCYNx/5QmNyCsd62Nwc768xL:4ySJTSBDTGnL2irhCKzsCmNfsFmc762L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549435, "uuid": "1e591c05-8f6b-4fcd-be1d-ac462caaeeff", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549435, "uuid": "b0b742cd-c84a-4913-873a-ad60e66807e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549435, "uuid": "1d612646-ed93-4dde-b762-6da35f11a04e", "value": "437192014c192306284e384a3aef5eebfb9dd21cf51df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23b539a-36bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691589966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589966, "uuid": "6f2368ed-7ace-4a10-90c8-579da131798b", "comment": "Malware payload (Amadey)", "value": "7294af0fbedd0df583de338d1afcebd4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589966, "uuid": "c106ee5b-2bb6-413e-b21a-b46895278c78", "comment": "Malware payload (Amadey)", "value": "45703eeba1c44eb5c0a7a21d99fb49c5aad018f7ce290f405ba538b94b997f83", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589966, "uuid": "12ed0442-89d2-43b7-86ee-da890cb145e3", "comment": "Malware payload (Amadey)", "value": "9c5a6c269c572c67d5e4b8465ebd56fda8470e1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589966, "uuid": "96942052-1a82-4440-9f8a-df97f4df06aa", "comment": "Malware payload (Amadey)", "value": "be5e89fb75dc58a1d76b9bc0fd00f4ff554e7ebfb272a98dacfcc5d6f89942a523db032eec57af70aa25742eda79d5d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589966, "uuid": "34a202c6-67e0-4abc-80ce-e79d5956a184", "value": "T1E2C41263F6DD4077C9F517B028FB13931A36BDA25938822B2790994A0CB3AC4B931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589966, "uuid": "6b00fc73-56d2-4120-8584-fb55a0a698cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589966, "uuid": "226f8da3-c52a-4301-8dd9-3e70627b43e1", "value": "12288:uMrSy90rgxGQ/U3q1QW2UFZ/j7yUrNiCYWmKYFKbExwH+P:oypc6yMJ3j7yaNSPKoPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691589966, "uuid": "500fc3d2-49ce-453b-b256-f1d2707e509e", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691589966, "uuid": "7857d39a-1a0d-4a93-b96f-3792d8fe18df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589966, "uuid": "d5780a6a-2b8d-4772-bfb0-78ef8f4bc153", "value": "7294af0fbedd0df583de338d1afcebd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d834c4f-36bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691589368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589368, "uuid": "d913421d-64f5-406d-8655-3afa624d33df", "comment": "Malware payload (RedLineStealer)", "value": "1464266205e666185a308bf6051545a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589368, "uuid": "d17097ea-c86b-4d5a-a80a-dc67a5eb88aa", "comment": "Malware payload (RedLineStealer)", "value": "45d52b269beab7f659343145b2c79d120f17a0a71a02247f557c349cec4230b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589368, "uuid": "5b7255a5-71dc-41ee-8dc9-b4c3b398802b", "comment": "Malware payload (RedLineStealer)", "value": "aad5e949481f27a5e097628173d539cafb80792b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589368, "uuid": "0f6577cc-9f81-4535-82fa-f8e11ee7bb62", "comment": "Malware payload (RedLineStealer)", "value": "3173613ea15ce9b7025a63e8e081590f648fe0021056a9ef88551545d988b361ad0fbcc87f46898af3c43ff9cd0cf30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589368, "uuid": "7fe0169f-34ea-42c4-9f17-377d032486c4", "value": "T119C41213E3E8D472D8F51BB058F70283093A7DA28D78972A2755699E1D737D0A83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589368, "uuid": "2e408dd6-26d9-4fc2-a854-570d9f50acbe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589368, "uuid": "ea4834b7-2a4c-4e10-8c67-a3f0a0c13f17", "value": "12288:mMrYy90QyFwz6Mu54bzjAroAgBYC66bkn7mXGuFYXbz:qy0wru6bn8uz5bk7mXGu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691589368, "uuid": "899e1232-6910-49af-9d21-29c71e7dcac5", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691589368, "uuid": "dbaf04f0-aef5-4f23-839d-845fd38739be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589368, "uuid": "e55c1386-21c3-481f-af97-5cdea235b554", "value": "1464266205e666185a308bf6051545a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9818666-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602836, "uuid": "fd0125c2-0917-428d-8ed1-e9afa1c7526f", "comment": "Malware payload (AgentTesla)", "value": "40cb01bd99edf0614f8be3e9542094ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602836, "uuid": "bfacd8d1-4103-4432-a754-90c3c752f45f", "comment": "Malware payload (AgentTesla)", "value": "45dac3db5b082fac321c97c287d55646db1f41acd79ca7bb6fe7016bacdc2cd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602836, "uuid": "53fa7528-7c1f-42b5-a0d9-89a14b4f6ba3", "comment": "Malware payload (AgentTesla)", "value": "3734c5d339f75edc81f4b8ec98fa36eeeb8d6433", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602836, "uuid": "eed242cb-9848-4151-98e1-5e62a56afc41", "comment": "Malware payload (AgentTesla)", "value": "33d6bc4caca60a5b33c11f5c77955e341cd04164b21e91bb60bbee82833edcff270acd0f4978f295432317052db965b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602836, "uuid": "82a1d97a-cb58-49df-9b99-b24a245eb9f1", "value": "T1E5D42304ACA3C99FC2537AFD804D567FDEE7E6708A650DBA463253ED138DA1D0A0E172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602836, "uuid": "ff8e0d59-3af7-4ef8-b42d-ef2da45ef76e", "value": "12288:yWgrC5XRVnz0tbIoNyMniwgHjjcSBVTwdgJdwNcIVLX7kAKRJcnVMI3t5rO:yWuC7VJoN/niwOjdBVka+rNcenWM5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602836, "uuid": "691b75fa-f8fd-424f-8e69-3cd6ffdec89b", "value": 633022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602836, "uuid": "4d3a2d88-ab2d-444c-af03-760606e9e95a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602836, "uuid": "84836058-75e1-4643-bec7-f01d8b68f74b", "value": "NEW ORDER 347651.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2747ddd-36f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691614770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614770, "uuid": "0fb88493-4bbe-4519-b0de-22fa5464eaec", "comment": "Malware payload", "value": "7a26eebe4e200f43178c6ee83a8cbdba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614770, "uuid": "aab3f4b5-70f0-4e48-9855-9e6499f35991", "comment": "Malware payload", "value": "46f420bece85e928d100636c926057c8b222b0a47c40d249c91ac5f0432b2318", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614770, "uuid": "02b21fd0-9a82-43ba-8919-da4f8fb72340", "comment": "Malware payload", "value": "ab237f6f5a920e41fdd3c70e70ac630d46834615", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614770, "uuid": "32887b8a-2ef9-47ac-88cd-6b02ac17d9bc", "comment": "Malware payload", "value": "dee8b494ff2f11986783d003a85433d1c7a23f44560401de83f232b1d0dd440b4aee317cf4ea44c37023de2dd0ddc953", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614770, "uuid": "2b1afebc-55a6-40ef-9c0a-39e2c5f6dd75", "value": "T1AA145E0353EF0518F2F71B3CA9B615601A37BD126939D56802AC2A0DCBF3D5299A1BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614770, "uuid": "83ed7b42-237f-49a0-845f-77829da89621", "value": "768:yptqNKUw1YCZB4586B6lmUW+jkNtmTAhXyBpz9kmL4Hl4JfvUMeUSM:ctuQ45q9kmLYl+vUtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691614770, "uuid": "2afec4f5-b3eb-4835-be9d-29a3618b8ff9", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691614770, "uuid": "db11d46c-66be-4ad7-a7db-accf27d87ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614770, "uuid": "f3ec5ab8-d75d-4dc3-a0fe-9ac1541c3e82", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f033bd-36b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691584256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584256, "uuid": "8727c1e1-0514-4e15-94fc-1c28849fa1cb", "comment": "Malware payload (RedLineStealer)", "value": "e2cc2ec88e7487563d1bbfddac1679cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584256, "uuid": "65df0021-ad99-471a-8c15-70b002dbd358", "comment": "Malware payload (RedLineStealer)", "value": "473eed024327f477efdb217a0664bfff790d5541078e0ea11ae050d9bbaa4bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584256, "uuid": "0d531bbe-4133-469b-a540-fc9b4995ac44", "comment": "Malware payload (RedLineStealer)", "value": "e0164117dbb19ee6961a54227ceea95583c44575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584256, "uuid": "85787759-a505-490a-901a-5bd4ae5704e1", "comment": "Malware payload (RedLineStealer)", "value": "9f8f001718be3ac4041c70a0445a733fe20631af7c312ac617b1b2a8b85ae3271795926aa2dc04968ff650f99b0d40c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584256, "uuid": "6d496d5c-2518-4243-a452-da2140e61551", "value": "T1D6C41202E7D84077D9F217701CF706C31F35BD618A78476A2B8A984B0DB3A85A87677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584256, "uuid": "838cdf3e-c4b0-4532-9380-b20b0e9b2f55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584256, "uuid": "89c74354-2412-4149-8e97-c73730fb7d97", "value": "12288:wMrUy90hfDcB86N6zfYlwyjXGifSxDe/SMpbUa3pTINBw:0yEfobN6z9iXoXMJpyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691584256, "uuid": "7a276dc2-b728-459f-ba15-ac9061ccc38e", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691584256, "uuid": "c74c5e4e-bae6-46b0-9dab-fa737ea8d6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584256, "uuid": "7ed1c3a5-5991-4b36-9942-00ac5d991ec1", "value": "e2cc2ec88e7487563d1bbfddac1679cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45f3a57-3672-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691557731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557731, "uuid": "cb072276-b45e-42ef-b3eb-3ea7096986d4", "comment": "Malware payload (Loki)", "value": "b98806523c4916585df3f414296d0905", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557731, "uuid": "c2cd6829-e6b0-4f74-9e4c-7d812e3bcc62", "comment": "Malware payload (Loki)", "value": "47c684cd58146f9adbd71eb47df0a97b0edeb1cf4e257ac5c12583349fed4c09", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557731, "uuid": "c2503870-857d-4627-8926-a29beb70b50d", "comment": "Malware payload (Loki)", "value": "c2541aa8299dd929b29c3c8d8d27b21ea97f4201", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557731, "uuid": "0c3f70d9-ecce-48dd-9c4d-5fcad37faf03", "comment": "Malware payload (Loki)", "value": "ab7071987b2014b7aa3fea929ecd3f39af745d42a1469826598bb4e5762fa71d5790a7ba5b75543f8000f85532e4d2c0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557731, "uuid": "f540ff0b-db72-4fd1-9bbd-8ee08dd253c7", "value": "T12A53E169C34F01A9CF66527B9A170A4442FCBB3EF24451B6306C537933EDD2DA1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557731, "uuid": "35fbc6a0-427a-4560-ab5d-06373aa2dbcc", "value": "768:7wAbZSibMX9gRWju+2Fn824LdXOVjD5+r:7wAlRRn+dXOVjV+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691557731, "uuid": "437e9965-fc1c-44b5-84e7-c5f836f32585", "value": 65637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691557731, "uuid": "d9024261-7f9f-4fbc-92ea-233196f54afb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557731, "uuid": "6ac7d8e8-201b-4782-9d97-cd1248480083", "value": "b98806523c4916585df3f414296d0905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ebd12f-3696-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572846, "uuid": "a596c5fa-e6b4-4815-9b12-5e71c44b52e1", "comment": "Malware payload (RedLineStealer)", "value": "cf1fbaf8ae769fc3e306bcf659caca5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572846, "uuid": "88668fb4-0881-4432-983d-7c102788f900", "comment": "Malware payload (RedLineStealer)", "value": "48121c37fa91251e66971db046fb91a11f6f14d8647ddcc2cee9d39b43e8e31f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572846, "uuid": "84df088a-6ddd-42a1-b99e-1ecb21bf3a6d", "comment": "Malware payload (RedLineStealer)", "value": "43a16b69422ffc36fcfaf13434a6d512b83ab6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572846, "uuid": "30f61bd7-bc79-4dab-9537-6b698077b1ef", "comment": "Malware payload (RedLineStealer)", "value": "d64c0f7a8aa2eb5e3f58957395e4f6e296bfecc22e6e12cddcd90473fc41591d0979bfb046ff1f6c376818ddc5d43e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572846, "uuid": "1b804420-4342-4f14-8f8f-d10a114c08ed", "value": "T15CC41213D6F45432E9B663B028FA03D31F367CE66DB8D36633819A564CB26C46972327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572846, "uuid": "64910ed6-2c97-4623-ad7a-c68f397a23bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572846, "uuid": "1240491a-1dc2-4232-8daf-00e539ae27ee", "value": "12288:zMrAy90OH/B5TzEVtxqErccEfkUB5RhBe5gBYC8kEsbTyAL1fWb:Pyf/HTYnFEciRpzis/bOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572846, "uuid": "d8ec41a6-2b56-47b6-91c4-9e5bb502e252", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572846, "uuid": "3816bab7-cf76-4f24-b6af-179ddf168188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572846, "uuid": "e2ff7566-8524-4ab9-841b-571dcc65de00", "value": "cf1fbaf8ae769fc3e306bcf659caca5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b698e4cf-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691599771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599771, "uuid": "e5446449-a66e-4e2e-93b9-acbe01f0c9ff", "comment": "Malware payload (AgentTesla)", "value": "10e70019a9d557f113fd69f29b2319e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599771, "uuid": "f2bc8dfe-0b74-4722-b714-77f08d6b8b4d", "comment": "Malware payload (AgentTesla)", "value": "48bc303529276d86909f2523bec585d5a7bf257f377aaef3f57dc6279a57e415", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599771, "uuid": "05827a6b-757a-4c56-a260-d78ba65af2f1", "comment": "Malware payload (AgentTesla)", "value": "a77071701f67a29a44809acd7ece308c793efaae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599771, "uuid": "35e2c7e9-b48e-43b8-9a2c-5eb9eada910b", "comment": "Malware payload (AgentTesla)", "value": "4721aeb32a9a0ab3fc76899feaf3f89cc04b7b31613d9ea49dee20bdab24d08a1d33186af56f6b1c418cd6ea9468833a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599771, "uuid": "099de441-d5a4-4960-8372-9a7efa95312d", "value": "T15063026DC34E01A9CF56933BAB1A5A0442FCB73EB34151B1306C537533EE82D99662BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599771, "uuid": "8958066c-4c0c-4fd5-98a1-270d624334c1", "value": "768:wwAbZSibMX9gRWj7x0hu72/jf1/UTQ52Nxr1f765:wwAlRju72/jf1/x8xw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599771, "uuid": "3c4f577f-2bcc-4184-a55b-55fc212fb2b9", "value": 69402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599771, "uuid": "acdb333b-71be-45f2-8363-6a7bb111d39a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599771, "uuid": "a42fe573-499d-464a-874c-ddf6b5d21a79", "value": "10e70019a9d557f113fd69f29b2319e8.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f9e0a9-36ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691597173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597173, "uuid": "53704f06-ae59-414c-bee0-0bc81c7a4983", "comment": "Malware payload (RedLineStealer)", "value": "5bda63e8d1776f44b55d7fd8e130be25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597173, "uuid": "88f1cba0-a990-47c5-85a8-2623b9f9e955", "comment": "Malware payload (RedLineStealer)", "value": "4987b1e4c2b3ae64cd004caecea2652c13b96a75c06b71a8ffc8c157541c1245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597173, "uuid": "f186d752-53d3-454c-b200-47202b9e40c9", "comment": "Malware payload (RedLineStealer)", "value": "5ebcc8062a1fe0e5a9500601e917232d051f7a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597173, "uuid": "ee35cdcc-44f4-45d1-b917-3cd1d37358e2", "comment": "Malware payload (RedLineStealer)", "value": "98f9cd58ccfde51ddefd4bd6edd777ceec5d8149cbdc780be6828b1ea6fd83a592821822cb2b9e53cc720e49e5f593ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597173, "uuid": "4044f7dc-e82a-45fc-b77f-6daf7cbc5abd", "value": "T146C41212AAF99032D9B02BB05CF702A31E397CD299BCA3577741651F4C73684B97272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597173, "uuid": "17e1d619-5d9d-4833-9611-51d930c0d43a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597173, "uuid": "9346a177-407c-41ba-a7a8-6d9e23bd3848", "value": "12288:sMrcy90n0dWVZ9o51pNbS5+zY0dgBYC3jRCK4sfI4zTyc3ePCJ:QyU0dWVZ94pBS+Yjz9L4sNyz6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691597173, "uuid": "80db6625-e26c-459e-a6a9-d72e7d42ff2f", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691597173, "uuid": "0fa052f4-cefd-4c03-980d-eba04331d920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597173, "uuid": "95c7262d-6237-4f03-9979-834a01447b61", "value": "5bda63e8d1776f44b55d7fd8e130be25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e12f82-369f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691577052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577052, "uuid": "64e1a97b-ec64-4936-99a4-034647b6338c", "comment": "Malware payload (RedLineStealer)", "value": "3cb99145d04f1d2ef7b26c7f0d710b72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577052, "uuid": "7a44f21d-258b-483a-b1df-5b2abde539bf", "comment": "Malware payload (RedLineStealer)", "value": "4a31f53b40cc7a07dc00e0183aa9b0b5d5094024d011203c81c5b1f6b245d20f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577052, "uuid": "d1c28091-d472-4931-bc0f-17c36f7bf71e", "comment": "Malware payload (RedLineStealer)", "value": "7dedf3919dd5d1e69ee2221169ef2a90e3eb471a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577052, "uuid": "794d293b-bb83-4176-a2da-a39b757b56c2", "comment": "Malware payload (RedLineStealer)", "value": "8c3cd09546ffbf319ac0ef18293df8e42623f3539c652145db81a95696f8bacc39c958f9c263155a8bae99b066933246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577052, "uuid": "aa2d1b81-1d8c-4fdc-b452-73713ca8c31d", "value": "T13AC41213EAD850B7C9B22BB058FA17931F39BCA15974921B2795988F0C723C4B93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577052, "uuid": "b5339876-54e0-4505-8d65-b1135c1ad400", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577052, "uuid": "fa33af7d-7d68-4260-b5c1-e42b49bdfc49", "value": "12288:BMr6y90fRBCQ/dtsA2FUli4qwETELu1z3:XyoCQH92ql5/ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577052, "uuid": "3d5f2bc2-777c-47be-a712-ad393dc0d2b5", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577052, "uuid": "3c03b26a-8d28-4748-8a4f-7f70cb26c71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577052, "uuid": "7eeebe9d-e822-467a-a898-159e4031dc4e", "value": "3cb99145d04f1d2ef7b26c7f0d710b72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e240ca-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691599681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599681, "uuid": "e5ccd2b5-d728-464c-a7bd-276b565c628c", "comment": "Malware payload (SnakeKeylogger)", "value": "e118c77c53f9373ca0486d13714415d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599681, "uuid": "f3910b26-26b7-4c79-b903-b5eb8476472a", "comment": "Malware payload (SnakeKeylogger)", "value": "4a370fa829cb0f180e99f740484a2b46a23b9c2ac70b5b70171e64b9951a87c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599681, "uuid": "55f83271-4bfb-4710-9f0a-2da463b80801", "comment": "Malware payload (SnakeKeylogger)", "value": "3f22d9c54b79347b1af4595681b4127d0a1d2f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599681, "uuid": "e61efc3c-f29f-4b64-b570-8120956a6385", "comment": "Malware payload (SnakeKeylogger)", "value": "85062ef3da59212a33006c40c451e1b447fe1c0f2c6bc3a3364b6379177078cf9c1aa64ae46043b347eb93544254d8bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599681, "uuid": "92c29ea5-2f01-4564-b187-900badef42b8", "value": "T101341218BA95D4C7ECA20AF2283A1A1676F3E92658A1875F13415F64FC225C1BD0F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599681, "uuid": "d82be66d-b78b-416b-b9d8-d787ade6c589", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599681, "uuid": "4bf68530-f0d9-4e20-8efb-ad39a131804d", "value": "3072:lfY/TU9fE9PEtuWXYbLx7+pEEl7Qv5fYFEqm55rKJzDbRwabmv0g4F5vUxQD7ZWT:pYa68XaLx7UEv+FsHKJzPbrz4zMDa0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599681, "uuid": "01e3a952-81c2-4530-a7d1-eac3677dd207", "value": 239013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599681, "uuid": "38e00f80-6e00-4d00-9081-f00d5c764346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599681, "uuid": "cebb0d6a-7e21-4302-82de-bf8f0d51f504", "value": "THK097654578-098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3160b3bd-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691571631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571631, "uuid": "2d105817-c055-4043-8b4d-f8851ce382f3", "comment": "Malware payload", "value": "22dd2c96951c83bc937121aacb38087a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571631, "uuid": "e4a05082-bdea-41b0-8dbb-e94ec7dc0820", "comment": "Malware payload", "value": "4b6f37b342978d9b1ad89e814a86644eb7aabd539b72cbabc91c0c5a1ae858a1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571631, "uuid": "0820c4e1-df60-4607-b60d-6d127d7986dd", "comment": "Malware payload", "value": "953700e19565a943a760313d4191f9ad98afe3ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571631, "uuid": "b901f640-74de-4571-9268-30b2788158ae", "comment": "Malware payload", "value": "3b60e37b15ef6615d40c38641b6150deb4744a5d241e83ea16144b9b2c1ad38ac48c7a7bf6e6c027cfcf836ca3fae823", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571631, "uuid": "906f1f0d-9504-46a8-b84f-f101a29be857", "value": "T16B23F1327409C9E1E5A1C4633DFB8F0816DA1FBEA08F66A45285F29447F504B7DB942B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571631, "uuid": "52ea4776-c285-4213-903c-91ce65086207", "value": "768:bPsX+8coLeSYce10IyGWpLDw/RkTb3XN4hD9TlXfyIrhBwxChUdT3UWT:bf8lKee9GZDw/6TLN4dRlXBtBUBdFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571631, "uuid": "b8db5826-d8bb-41d1-9387-42ce51fe6347", "value": 49412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571631, "uuid": "5dc4e16b-1a1e-498c-b6ee-80470c085da4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571631, "uuid": "164fd551-d212-418b-b448-8327912c9af8", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df77cc8-36aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691581557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581557, "uuid": "2c02f24c-4f40-4c3e-86e7-e4923b03010a", "comment": "Malware payload (Amadey)", "value": "580ab56c2c0eac89a7c5f18373ea1530", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581557, "uuid": "85772045-cfe5-400e-94c9-6993e1a2146b", "comment": "Malware payload (Amadey)", "value": "4cba63cd5edd72644d59eacacff40a9224f68d3a628b1c9da0a6259acaeac206", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581557, "uuid": "32006c9a-8a63-447d-b0c3-c0958b7f30a9", "comment": "Malware payload (Amadey)", "value": "1a54008061a2912d74de955565ca67592420f88b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581557, "uuid": "0bc9810c-4256-46c4-ad5f-f89622ec23d7", "comment": "Malware payload (Amadey)", "value": "0b1a0ffd4ab816b49e5bf457bfef4ad4ea1fcc6e6b6ffc308a1aa08513777d41f22ce2c625392a4923bc18cde93f4436", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581557, "uuid": "14715b60-9735-4df1-b995-2f2e7c39c82b", "value": "T1AEE41252BBD95033ECF5477088F603E32B37BCE199B4836B2752A96D4872654A43633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581557, "uuid": "37c657f0-0b3b-4f0c-b3df-c5b979ec7961", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581557, "uuid": "110a258a-7a08-4c73-b21d-75c7195a68b0", "value": "12288:3MrOy90HvYe/xDfQKKKd93ENZ5x6pROxZ88mkiuPdbbcYydPLE7C8:1yEYExDIKK60L66g8IuPdbMdPLEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691581557, "uuid": "6a73a4a5-eea7-481e-ae16-659941453b83", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691581557, "uuid": "786fc1f5-f41b-4a02-90a2-8469d727d059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581557, "uuid": "1240c0f2-c4c3-456f-8bf6-0c712da1b6c7", "value": "580ab56c2c0eac89a7c5f18373ea1530.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4aab639-36b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1691586910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586910, "uuid": "39fd545a-2e12-4483-8463-9cfe6d4cb7cb", "comment": "Malware payload (ParallaxRAT)", "value": "eb11d76f4db6786d48ef7ae3f6c3ad9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586910, "uuid": "239ed271-0bda-4373-927f-23af66bad02e", "comment": "Malware payload (ParallaxRAT)", "value": "4ceab10c2d3cdb9ae245f25c67fe95e5349d3c632d3b9140112e7d77720b5252", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586910, "uuid": "a73718aa-de65-4e7d-b672-e63b80f38d1b", "comment": "Malware payload (ParallaxRAT)", "value": "294482263073bfcc916e0ef6112031e6a195c28d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586910, "uuid": "62a87c25-18d9-4fb6-9435-274fa83b76dc", "comment": "Malware payload (ParallaxRAT)", "value": "042fc02bf6686f6e32d047f8233762bf5ce8f0404044b27436feee37586da63c7fb7128c56737eff1b18a91139b70eae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586910, "uuid": "31263bac-e0f7-4eda-9cd2-045ee5c9985b", "value": "T14B754B721109A41BDCB4C7752353FEB5A871EEE5BA1EC2A21BD0BF6B783514C096B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586910, "uuid": "1f39a888-c9ef-4df0-b35a-c0aeb7998dd2", "value": "c4d010441c17e8245adced7fdcad59f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586910, "uuid": "c946b0ea-dd6d-479d-85ad-abb0aea21dad", "value": "12288:8NVVyrGvaRlb2nZS1dUpSp3fHdSF9e+dy0p1i3v7fjAu1X:IVNPnZSXUpShf2c+dF1BuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586910, "uuid": "8c2b48f9-c6fe-4aae-8202-ba98b640ba0f", "value": 1693184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586910, "uuid": "30f9c672-d0d1-4646-88ba-87a45a09f6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586910, "uuid": "853b7935-cdee-4483-afc0-1679cc6f0997", "value": "defense.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fbacc1-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549409, "uuid": "fc4b3d13-df6a-455e-bc0d-77f1eac9e8ae", "comment": "Malware payload (Mirai)", "value": "59da200fd31ca3463509eca8cb177da3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549409, "uuid": "8c32549f-ece3-4bdf-8370-8451c63c019d", "comment": "Malware payload (Mirai)", "value": "4d688af6f281453d66876337adb7be73bbceabeb4a77ad58378cc6bbac5a4495", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549409, "uuid": "d5c68dbe-2228-457a-8d53-f09331402dda", "comment": "Malware payload (Mirai)", "value": "09b08c48afffb36b2901ed2dd30324dfaef86740", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549409, "uuid": "80d99242-079d-42b8-a1cd-224ea42b14ce", "comment": "Malware payload (Mirai)", "value": "029e13464f2b7a64775322c66fe1824bcdf77111a32b7bf33929ad7acc3b752eb01c03b3873b55f13df0b602ec215d88", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549409, "uuid": "17ca6d63-b09c-49ba-879f-bbbf008f305a", "value": "T1FAC2D1322EEE39B1D2A420BAED7CC6C7620F4BB975F15521324057A1DED200352BA8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549409, "uuid": "8bfae37f-ffd7-4980-bd2a-87218a438802", "value": "768:AjKX9vt6GqA3Q0jzV7EUyUq9n9+s3UozR:AjqtBqoB7EUBA9jzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549409, "uuid": "3f85c6e3-1a25-4e41-9c8e-6c33dd5225af", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549409, "uuid": "aef3467c-bae5-46a8-b2a8-cfe3b88e39a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549409, "uuid": "2fd76519-095e-4441-a71b-dc2c919766e3", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070865e6-3696-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572848, "uuid": "c5690686-a818-45be-84d9-475e87641e49", "comment": "Malware payload (RedLineStealer)", "value": "416ab6c7341087f3d1938a5cd812d495", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572848, "uuid": "4132a976-9c47-434b-b534-ca22681f1b45", "comment": "Malware payload (RedLineStealer)", "value": "4e0fbf7239b6d31f5af30c131e8fe301f25b38ee43037ea179cf931851a25c47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572848, "uuid": "618ea15c-aa54-4dd4-9a38-a93bdbcfda16", "comment": "Malware payload (RedLineStealer)", "value": "3c4a4502ce4c86d0308420fd19b05c2b93565f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572848, "uuid": "74b14d03-8140-45ed-a883-a29e29008158", "comment": "Malware payload (RedLineStealer)", "value": "83ae3f57dea660cd8d9a92720038e77273e1ccd5c6fa1e2628d9c8ed5b889a7e7d7cada8ae98a5447ad5e35ce2bff921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572848, "uuid": "02b5b0e2-f7e5-4758-9070-9a11a4cbf9e0", "value": "T17CC40203A7E88472E9B127B198F216931B357CA19C78972B2741DA1F2C736D4783277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572848, "uuid": "e2fbb745-8ef0-4574-b6db-bc4e61dee806", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572848, "uuid": "5a526727-2c0e-4336-831a-416db0c47c6b", "value": "12288:iMrgy90HHdPb2LKnewNG7RnEM1izxgBYCb8Gyfbr1ewb4id4:WyiPozlzQpnd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572848, "uuid": "8f02ddf3-3442-4290-ba77-af94380fb811", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572848, "uuid": "8f1cb58f-7989-46e2-9e2a-25de8a3581a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572848, "uuid": "d79a5fa4-5d03-43ed-bc58-93b3bc8e952c", "value": "4e0fbf7239b6d31f5af30c131e8fe301f25b38ee43037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac69304-36e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691607375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607375, "uuid": "1751f212-3491-49f3-9236-f2cbea065218", "comment": "Malware payload (RemcosRAT)", "value": "eb52088866688f0203b2f5d5114a2bd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607375, "uuid": "385fe2a4-c4ef-41ad-8bd8-b1d740a3e4e8", "comment": "Malware payload (RemcosRAT)", "value": "4f827733e06b0ec1cb7edf3b3982487e6be429842e0cb09ff7900771ab58e8bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607375, "uuid": "2d3e33a4-bbf3-48d7-a5b1-b2e388bad078", "comment": "Malware payload (RemcosRAT)", "value": "70676fcadc7db3a2b5ca567ffa41115736ea0df1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607375, "uuid": "57166252-adb8-4281-bdd0-74c6cf9725a0", "comment": "Malware payload (RemcosRAT)", "value": "ea7e1f85322a73235269a6fdf5ea22a10835ab27e38c3144c50e027dd48db262ff24a99203f9ab57c1088d8283cfac64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607375, "uuid": "5420946c-63d4-476b-b8f3-db2d61cbdd04", "value": "T1F52522B9B2EF4E71C7982436D693280453B95B8BA523E70E115813D18A0F7C6D392FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607375, "uuid": "a4df4750-a6f6-4d90-b2d0-8251cf1ed56e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607375, "uuid": "7c4f6d13-c289-429e-a389-7d2ce7d9e801", "value": "24576:7wexIYlVNw1HX/Fuh0Q7CaLwbwGSxEItdmHZcd6IY9CC5LLzg:wYlOUhLIudYZOC5/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607375, "uuid": "8bcca04f-f59c-43e1-b8f0-c6f7fca49ff9", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607375, "uuid": "b246bec1-a069-4479-81fb-bfd87509b0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607375, "uuid": "2bd97fb0-0385-4417-84fd-bfd982bb7d41", "value": "SecuriteInfo.com.Win32.PWSX-gen.1900.12052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3966405-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691571956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571956, "uuid": "87810d72-e5c8-4e6c-b2aa-7ebfcb93ba4e", "comment": "Malware payload (AgentTesla)", "value": "f0ffc9ea823029c0b1c45026306957d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571956, "uuid": "4468ddb9-6708-4d7e-a5a2-d01c259f539f", "comment": "Malware payload (AgentTesla)", "value": "4fcc49b2eefbff7e79c4ff61b3891f766b8530a75e0a748fd66ffc67911cf377", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571956, "uuid": "c402f258-6ac3-4eea-b45b-242055e77371", "comment": "Malware payload (AgentTesla)", "value": "a6aeae7d4c98b7eb4c32f948b47a584f3ee1450c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571956, "uuid": "94c84d81-dce7-4b8c-bc54-99f2b03d8e66", "comment": "Malware payload (AgentTesla)", "value": "ec6d630c3d18184ca48a240a1c1dec912effc26ce57e03d0906d66818cf6c769da8284cb9795c3addbb6765c2eb11060", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571956, "uuid": "47f2c564-d394-4cf7-8710-39e5bdee7446", "value": "T163E4014537ACAF37E5F4A7F8153520500BF2355A29AADA681CE270CE2D7AF508E20F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571956, "uuid": "98df4731-7788-468d-8d43-b7a55bce9a7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571956, "uuid": "3c6c9aa9-2fbf-4b6a-8ef1-346bf102f80e", "value": "12288:DsE3iF9oJ4q8WSEWgkaq1NVCX2HAmo3Bg+taQFR0JnZUzkf0gD:4E3i1SSEWUA/gm0BgmL6ZUMVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571956, "uuid": "b96dc1df-3cd2-4888-8a9f-c811a94691a4", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571956, "uuid": "bc56a87b-569b-4129-bba1-88498d84edde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571956, "uuid": "1d87fe5b-08eb-40ab-953f-130ae45c6f80", "value": "f0ffc9ea823029c0b1c45026306957d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ecfe16-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691559450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559450, "uuid": "6129cdfc-27ad-4b32-9771-10340b9c76be", "comment": "Malware payload (DarkCloud)", "value": "3d09f5c762c0d1f54be705ad8912d4fb", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559450, "uuid": "c0b658f6-82bb-4aef-85a7-eb2f4c3d132d", "comment": "Malware payload (DarkCloud)", "value": "4fea523f2378186513272cf12083eb535428c11924089bfaed086ae42db1ea58", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559450, "uuid": "f9a8290d-638b-47df-9d92-766ed7d91887", "comment": "Malware payload (DarkCloud)", "value": "bc4bc79d88a4caf463aa184403177d2ce4c44a41", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559450, "uuid": "64cd4296-7eb6-4deb-98ef-db9874ad4de4", "comment": "Malware payload (DarkCloud)", "value": "a7d123d4226ff70e09668c39f82f97f8c3b5630eb7ce01542a97dacb6b1911f522cc3898ba4dd37260b32e4361b5497b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559450, "uuid": "e945599c-3fc4-49c5-b11e-0ca6d2116257", "value": "T121555A21D3BB2455EF16A2F88E5F853278D9EC80F1F2C59863E6284395C23119E25BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559450, "uuid": "a4eca06e-af3a-464e-8141-304b63029787", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559450, "uuid": "aadc9e87-4393-4e15-9472-49121d821768", "value": "24576:FrNh1C141C1lRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOUOgu54nlKzD:dMaMzRs6CE3jLbO9Rs6CE3jLbOEu7Zft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559450, "uuid": "f1f110bc-6349-4747-82d7-e520a00c3584", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559450, "uuid": "109a71c2-24bf-4536-af50-2cc9c535e903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559450, "uuid": "43b67f85-b7e8-475a-abc0-1f9452139099", "value": "Updated SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70bffe5-369d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691576150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576150, "uuid": "07255d65-2d7b-4d44-babc-f17798a74834", "comment": "Malware payload (RedLineStealer)", "value": "f5c27a5fd10e23cdfedaeac995c2f94b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576150, "uuid": "91a80aab-9929-4a25-9ba1-d9a0f93078b1", "comment": "Malware payload (RedLineStealer)", "value": "4fefd0f019ef2d241f372c0451475f7f0288f06b1c4bbcb7fbb1edf499ff8ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576150, "uuid": "4f59268e-e45f-4436-a188-2480c147d500", "comment": "Malware payload (RedLineStealer)", "value": "41078dad57b5e246ae79fcab2e04601c58681469", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576150, "uuid": "2152a4b0-2d93-4c0f-bd16-d6eb951e0c2c", "comment": "Malware payload (RedLineStealer)", "value": "442fb38f6acbd0ad3ad60fdc3fa2dc9a575f9c7f21d37653c1218c79bf1977a578fd77725128bcc8c6788052a9d2e2e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576150, "uuid": "6fd553d4-4ad9-41b4-b683-53662a3dbd39", "value": "T117C41253A6E81032DCB51B7058F602C30B3ABD62AD34935F175AF95A0D73AD49A3273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576150, "uuid": "a73217fd-1d63-4098-8075-18444d6abcc1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576150, "uuid": "931a7017-416f-4535-81cd-d4af85109622", "value": "12288:EMr4y90VCdlHvQsORWLi05oIMlEK5ZgBYCimnnBUY+Er2PeAlHgkZ:0yNdV1ORO7ejozfnSErkRHpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576150, "uuid": "885d72b5-c23b-40db-a622-968368c553df", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576150, "uuid": "02d6d7ec-e903-470c-b676-ad1bb5e8d8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576150, "uuid": "fa94f1e3-bdcb-4a51-84e6-6c8300639fc0", "value": "4fefd0f019ef2d241f372c0451475f7f0288f06b1c4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3947b0ef-36a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691580663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580663, "uuid": "f8c8639b-bbd3-4b3d-941b-ae13dbfc39c2", "comment": "Malware payload (njrat)", "value": "add17b79eaedf16b5e0c76be345e5dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580663, "uuid": "71daf84e-b0ec-488c-b94b-8602b037d207", "comment": "Malware payload (njrat)", "value": "504c2fb0a364d18075dc9c2ab0959bddf74d0ee416c29450132a76e6bcc19d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580663, "uuid": "2d1e4a43-3420-4c29-b591-2c178f4ebe7f", "comment": "Malware payload (njrat)", "value": "b695f71b24e72cbee446b9ea8125354d42ed5637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580663, "uuid": "fa9829c8-7c2c-487f-89e5-ea5d37924546", "comment": "Malware payload (njrat)", "value": "478ddecf50b7c5f324bb13e6a25364d2002553d55ede576431386a85051c85820464c2810f15091b495086df39dcc1bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580663, "uuid": "c0e08895-024a-45ac-b1f3-e21ebd70daa7", "value": "T132F5CF34A541483BC03A0734CC2F977856FD79182A3E6B47B79C7C9EAAE7304B5A5386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580663, "uuid": "f60539e5-e588-42a3-9a04-d7647439507c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580663, "uuid": "64bb750d-160a-4720-b209-374aed2a37ec", "value": "49152:SEmJ3kcQCGzvTbIfP52uAhdtlWjMUNOWgQHs:S53kIUHIfouAzWIGfges", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580663, "uuid": "70879740-7538-4810-92c7-3090c62d74fd", "value": 3620864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580663, "uuid": "aa5717b2-77fd-4422-83dd-681e315c86a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580663, "uuid": "d04c87c9-db79-4e72-8c5d-dca59c584cca", "value": "add17b79eaedf16b5e0c76be345e5dd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8e6cb7-36b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691587863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587863, "uuid": "56019d20-58b9-4018-aae0-128dac582642", "comment": "Malware payload (RedLineStealer)", "value": "d966d697573c6d5f8412f464fe7d287d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587863, "uuid": "bdd5852d-240c-4e95-853a-fd3c52377a5b", "comment": "Malware payload (RedLineStealer)", "value": "50cc9cb7c31ef6c3986fd7e33e6614f8cfb2dd27cf2943fc31d1e10ee537407b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587863, "uuid": "9176fcd1-2435-4da8-b1fc-dd6d2030af06", "comment": "Malware payload (RedLineStealer)", "value": "16409e354c78860821a87b98bb3a7fadd3cd4e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587863, "uuid": "a3420e07-e503-4b9b-b269-1635a5205a47", "comment": "Malware payload (RedLineStealer)", "value": "2a246bfbdc345ccde0c33f30d5a9425733a7910394a41a61ea89b965d8746641a5ee75d6b4d3e63dd3e9d6880608f8ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587863, "uuid": "2596ad5d-5e89-4fcc-b165-3ce4fe6c7513", "value": "T144E41243AAF89076C9F91B719DF603D31E36BD6299B4935A3742984E2C725C0A07273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587863, "uuid": "cd1de801-010e-4772-b6af-7cab5098ee6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587863, "uuid": "82a4ba65-4954-494b-9b9c-80824de55d05", "value": "12288:rMrSy90clicWdGur+sE9duUgdkurGy6MIsaS9pgR7qLecOm+bhE6:tyPlozrEZokubfcKeMkhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691587863, "uuid": "637eb689-cc7d-4137-bedc-6cea7b4f53e2", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691587863, "uuid": "b52c1b97-a950-48ba-9cc1-d5879b96a282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587863, "uuid": "5989d901-f40f-4e13-818c-14676677954e", "value": "d966d697573c6d5f8412f464fe7d287d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce487cd1-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549131, "uuid": "cc207583-48bc-46e1-b623-ab107325069a", "comment": "Malware payload (Mirai)", "value": "d56906e0f63f5ffdf52db16719fd9a23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549131, "uuid": "5092a0ec-e8fe-40a5-86f2-ed734619c8c6", "comment": "Malware payload (Mirai)", "value": "524a2020c11b1c61af31fbfc70fcdaa1f9c35f85fb2db991fafe2b8b2de04a78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549131, "uuid": "e2347156-803f-4c50-bc5b-04eeb47253fe", "comment": "Malware payload (Mirai)", "value": "7c9fc14932d1d8fcf07a548088b73130a74c3ebb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549131, "uuid": "3cea3d97-8a08-4564-b8c8-874dfe7ef251", "comment": "Malware payload (Mirai)", "value": "c99b50a645f9ec3b267bf41c208bafc5c9e9a1addac484d9639de12d2e654350af1473751fab76ce1a4c0afbb66d3d84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549131, "uuid": "dce15b52-6741-4761-9bdf-4a3e71700922", "value": "T1F123B548FA58932AC7D066FBFB0803CF377E17A9B3DB722659311A5533C9E64563A018", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549131, "uuid": "2202cb2a-4061-4cb6-a78b-965c1664f658", "value": "768:VqmL7hHkMQ1LDdSKNXkLPhKRViUw1rSUw4UgeIuWpzXySD0H:/79zcL5hBShKw1rSUIgFtpfwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549131, "uuid": "9a2bb6ab-3a2e-4efe-96aa-3e36b275a7d4", "value": 48680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549131, "uuid": "ab488f38-98ee-444c-a5df-16282977f2b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549131, "uuid": "4d669d43-693a-42db-b744-8bf20ff081d3", "value": "d56906e0f63f5ffdf52db16719fd9a23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f57e5c5-36b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691584136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584136, "uuid": "5ee45354-2d71-439d-b54d-f59df728a0c4", "comment": "Malware payload (RemcosRAT)", "value": "6e898fa3946ea02ec3ea8394899948fd", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584136, "uuid": "d0c2d756-ea87-46a4-897c-400d1ab9aeb0", "comment": "Malware payload (RemcosRAT)", "value": "545163c114ebff59094104e660fe48967a1e23f084f2978b9e0787092ea008f3", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584136, "uuid": "43a0d957-0d40-4f55-ae1b-681420ea34bf", "comment": "Malware payload (RemcosRAT)", "value": "742472ecf37bed8f552e69c73179729de7b52490", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584136, "uuid": "334cbc31-d019-4ffa-9ef8-0f853c312550", "comment": "Malware payload (RemcosRAT)", "value": "63ab69f6db98879bc111e4e8eeb5234ca53d523c1e2ea09321481e2598461d35273573d9236e15b28616676929d354a7", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584136, "uuid": "eeec5e59-9bef-415b-8f07-086ecf3053d7", "value": "T178E4120667B9E05ACD2BAE3FE4E40FC605CFAD6C84D2C12CEEDD95DC6540C6A691281F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584136, "uuid": "070d1187-806d-4b6c-b21c-c1c593ac657d", "value": "12288:ijLEx7DfNe5nyo3dQTaf0A07I+tIb2ni9G86xSq3r2JkZTRWnnZnkqn+PG7:ijLyn1eXB817IwliI9x13quZRWRT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691584136, "uuid": "7c1aa3d1-38b5-4a6c-ac80-c1fc77af077a", "value": 693213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691584136, "uuid": "e76ac3d3-a282-4ffb-b540-ab3a7edcb020", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584136, "uuid": "4a5244a0-0e03-4f1e-864a-d4e11f79f98c", "value": "Fra_1-038.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86a9688-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691599748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599748, "uuid": "d0013e09-979c-47c4-ae76-c7715ad84d6c", "comment": "Malware payload (Formbook)", "value": "76423e939823bb7a5ebccb95e446dad1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599748, "uuid": "1de67d60-c80d-4d2d-ab4c-8fab8636e51c", "comment": "Malware payload (Formbook)", "value": "545d40ade3522c1e3e361746d2575d0713ceb992658cb30cbca4d0cdc824e6e9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599748, "uuid": "f8346a67-7ffd-49ef-9ff2-9a2848a674c4", "comment": "Malware payload (Formbook)", "value": "1263e912a2bd08017a66a27bc057372499c4bfac", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599748, "uuid": "d09a393a-8ae4-4e63-be29-ce224f007ffc", "comment": "Malware payload (Formbook)", "value": "e733967a25c00bd3c20ad8b5e747be48d471650596c83d0d07f690806892984388ea37d43112a9c2e8e15030f7b22c98", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599748, "uuid": "cb2ac893-5f41-430d-82aa-379b1cc15b62", "value": "T18173136EC38F01A9CB565237AB1A0A0542FDB73EB34452B6306C437533EE83E51696BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599748, "uuid": "a1268889-7b7f-4a19-95ac-6a20f0b401bf", "value": "768:LwAbZSibMX9gRWjNXPRWgr/SqgtH1g1qE2zyvryDBOa:LwAlRczSdi1qE2zyvrAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599748, "uuid": "c0d578f6-0b01-4ad4-94d8-24a5bed4c6e8", "value": 76381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599748, "uuid": "7d61aa01-02f3-4743-9ed2-3dd0625f20b3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599748, "uuid": "25ed9616-7c4d-49f7-a524-1ab900d708e6", "value": "76423e939823bb7a5ebccb95e446dad1.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9e949f-3686-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691566388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566388, "uuid": "e0190bf7-eefa-489b-accc-0313b1ea4125", "comment": "Malware payload (GuLoader)", "value": "4c86d493d7393a80dc6638a810daed30", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566388, "uuid": "58dc9ff8-cfc9-4365-a6a5-aa26dff06fd2", "comment": "Malware payload (GuLoader)", "value": "5476cf76d600ffb3bf95b400e39db13fd17acb405acd1216cbe8bcaaa0f5c5cd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566388, "uuid": "ec4681c8-4da7-43f4-8cf8-ae33484338a6", "comment": "Malware payload (GuLoader)", "value": "f487724d581012ecbed824c16a9b76145319990b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566388, "uuid": "441a9c6f-9452-46d1-a3bd-71ff8d28bd7d", "comment": "Malware payload (GuLoader)", "value": "f35d0a31c2996f93beca80d2b9c17106f0a5352a3dade57dde5148b2fdbc87befac724ab9f27eb22bb6a2f1c4f81c11c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566388, "uuid": "521a6a19-2e5b-416a-8a49-c9e7673df9ae", "value": "T1E153586DD34F0269CF5253779A2B0E4441FDBB3AF29112A1346C537933EE82D91262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566388, "uuid": "ef3d8c23-deaa-4083-bfa2-b99f95ad58ed", "value": "1536:FwAlRYcUVEICMCxPAie7tHHi4wviOEAYeV:FwAlSWIDQAie7tHHi4yiOEAnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691566388, "uuid": "a0fa3442-4edf-4ff2-b50f-d58f3b25d756", "value": 62745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691566388, "uuid": "b63cbe47-bcd3-4308-b207-fcdee639ea06", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566388, "uuid": "8a21aefe-c758-4f96-b956-53b8bda20d66", "value": "4c86d493d7393a80dc6638a810daed30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781034bb-3674-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691558435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558435, "uuid": "c8c49530-85b0-43b3-aecd-6c617f14d368", "comment": "Malware payload (RedLineStealer)", "value": "aaac08154b4c5de8a3f909bbe0e7c9c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558435, "uuid": "e85ab671-fdf6-4e1d-80b4-05cc73affba8", "comment": "Malware payload (RedLineStealer)", "value": "54fff29a56ca291cef095ab730b8598899cadcdc0a257dd4fed771114e66b96a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558435, "uuid": "c792586d-0435-4d6f-a61c-b13c51749dd7", "comment": "Malware payload (RedLineStealer)", "value": "1ae0327a49aac2f00b5ff54f3b31ba444698ecb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558435, "uuid": "e9d8d843-3528-4af3-97f8-843cdb53f82a", "comment": "Malware payload (RedLineStealer)", "value": "c3788843afbd1b98de93b8bbf7d4d26abfd9c385e8d8b5ca771e15628f44fb30e0416cdadf1a1d69ffe882865240b63a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558435, "uuid": "6af888b0-775a-4bc6-8934-f3e017bd4447", "value": "T1E813F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558435, "uuid": "8b052e63-e0b8-44b5-83a9-0d279cb499e1", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691558435, "uuid": "ba08a9e0-a182-4aec-9f70-00764efd2ad1", "value": 41953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691558435, "uuid": "87d3457a-48e5-4cf1-8ea9-a8b8f0bc8cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558435, "uuid": "d68c1027-7f8f-4e4b-8a39-f341b033a241", "value": "aaac08154b4c5de8a3f909bbe0e7c9c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de408608-3685-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691565908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565908, "uuid": "5829bcc0-3870-4b2f-9d79-cb4da95a623f", "comment": "Malware payload (RedLineStealer)", "value": "a7e1833abf64a2722abd8c6f06b17f58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565908, "uuid": "579b2a92-6a82-49c1-bf1c-a2ad797229a0", "comment": "Malware payload (RedLineStealer)", "value": "552733bd8b6e970a37f3aee514842a8682b8fa9d0c3a899c3222c4e641c4974e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565908, "uuid": "6faa9a9c-f8f0-4199-801f-14b6b1a5a6e3", "comment": "Malware payload (RedLineStealer)", "value": "b05a4fc8363f7e1347d9cd1218d0045d411cedaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565908, "uuid": "0487feb5-f228-4c9e-9b8b-d0e15d2190ae", "comment": "Malware payload (RedLineStealer)", "value": "f58bfdfc25a4066207c171c4f7034f0a06833e3411cb9f73e092f662ec844b36324da6b5f4d2bd18265ef4851e39611e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565908, "uuid": "07385bae-e4e9-4f4b-89e6-bf6df1013f0b", "value": "T10205AE75FA81D2DEE9116DF0F2E5E266582F00D1BDEF952AF2088F1B35E30985B845E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565908, "uuid": "017b4d74-a6e2-4c18-924c-71a85f1a7da3", "value": "b709114036fa718b86000a1291c56076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565908, "uuid": "effca3dd-6414-41d3-899c-91e564ad293f", "value": "12288:g878nMgkD6xitvirX98f+f9nEWxs0JjpkSOLfQ4wqAPuqBefQy/mjtsbon:CnrdKmVEWmnSOLo4Oxy/maon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691565908, "uuid": "d634c6a6-7e92-4b09-a320-68655b61b90c", "value": 822592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691565908, "uuid": "88f6a56a-54b7-43e1-b9d4-b920e5026075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565908, "uuid": "530991c7-3719-4ba6-abaa-a298aa5bd9ef", "value": "a7e1833abf64a2722abd8c6f06b17f58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c9026c-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691549135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549135, "uuid": "02718842-36a4-4ab7-8ce3-ffef4f84e906", "comment": "Malware payload (Amadey)", "value": "017f015d84c537334cd7ee61402d5a94", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549135, "uuid": "f21acfaf-518a-4a28-a652-400f4de90942", "comment": "Malware payload (Amadey)", "value": "56f0e8c460d5ea71de4a11290d990e3c396919e6c8c2c56bb658b1da305af272", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549135, "uuid": "b0fab9e0-4cd1-460d-8fa5-d9d5a3169503", "comment": "Malware payload (Amadey)", "value": "8b258488892c714f3d9caa4b1d71f0330c5cbc7f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549135, "uuid": "bb32d656-6a34-427e-93f4-19184240deed", "comment": "Malware payload (Amadey)", "value": "57f74e35e81c419cde45ba84cb2c6b4b634ff248cffcdda8185eebbcd3b536d967444809405fd0631a0b8b7b737330d4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549135, "uuid": "ab5ce488-4a83-4f09-a8cc-e0f5308dc224", "value": "T19803F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549135, "uuid": "1f15752a-99fc-45c7-bfb1-46489065031f", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549135, "uuid": "4a78fe44-15be-4fc3-a81d-47f1caea9300", "value": 40392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549135, "uuid": "2e76dc3e-750e-440a-86a3-705a0ea2aaec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549135, "uuid": "04f168cd-b504-4b22-a4bb-4e6a0dc86f86", "value": "017f015d84c537334cd7ee61402d5a94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0d588b-369b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691575276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575276, "uuid": "354cecea-0546-4d20-be9b-d6ce04c0e710", "comment": "Malware payload", "value": "a5c736d2bdc3e8976c13c6aa39be22aa", "object_relation": "md5", "Tag": [ { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575276, "uuid": "9a0b4b8e-3ce5-42d3-bd26-8b698418c4e3", "comment": "Malware payload", "value": "5776515d91706da31329c4350d71d252b22f06640501dfeb8161435033ebd7dd", "object_relation": "sha256", "Tag": [ { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575276, "uuid": "e5fd9c48-f13c-4408-983e-92a166abc199", "comment": "Malware payload", "value": "c9a81d239ae9a354b86c99b677327b6ff65b0fc0", "object_relation": "sha1", "Tag": [ { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575276, "uuid": "55c2ba9f-3ba2-462a-b29e-1ebe22883f87", "comment": "Malware payload", "value": "8bd14f5fbe5e4110e9be3a5036acb933a242bd2b394d80f9b297cd0b393af2f8423688d5bfe72c958c14771caec39cd2", "object_relation": "sha3-384", "Tag": [ { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575276, "uuid": "c8fcc508-947e-4866-9e95-860dadee1e86", "value": "T11D45235667489603F8E5A1AF58071F099D1F6D0C666FE7D3861B78E83E1E28BCF1B240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575276, "uuid": "d54845fc-201a-4d17-a907-87d920a631a4", "value": "24576:L4kfNAQ51Wnj/vsoyjaEKL9z9Hmhqb27v7/GQHzlp4dm1FiStSK8eCSv1gGxvYwg:L4kfNAQ51Wnj/vsoyjaEKL9z9Hmhqb2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691575276, "uuid": "cfec07e5-9db0-49d9-ba10-c3ba87d62386", "value": 1173940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691575276, "uuid": "624d010c-ab67-4738-b04d-4dabae7c7e69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575276, "uuid": "e8cc8fb0-3139-4896-9d8d-3ef2094d9c7d", "value": "cloud2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462a90cd-36df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691604307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604307, "uuid": "b3b0a0dd-597f-47cf-b57a-549b0132daa8", "comment": "Malware payload (AgentTesla)", "value": "510afff1d504a336fce16604a18df564", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604307, "uuid": "90ffbd98-7856-43df-adb9-29286cf49a41", "comment": "Malware payload (AgentTesla)", "value": "57fb4bbec8340a3da56629716ef3716fa14a247aeef941bf37c052a815c1afc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604307, "uuid": "70651250-4279-4ae7-8640-6dbbcaf93698", "comment": "Malware payload (AgentTesla)", "value": "14544cb02b077652312e2e4e5dc3f11c823657ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604307, "uuid": "17a209da-5263-4399-bda3-5f9cedcd1639", "comment": "Malware payload (AgentTesla)", "value": "257224694455f4756c627e3c614a332bee712222c8bc74f12ceaa877407d9b6eb5de96992b5719c3c8d285e4211f012b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604307, "uuid": "2acde7b4-7f4c-45d7-a20e-c6abf317ca15", "value": "T13515383C112D6A8DF3A485FCB6748CFF17A5692F80BBF9F3884CA4D306A97D15502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604307, "uuid": "ad2353a3-4713-4f34-b8a3-bb7283cf237b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604307, "uuid": "ea33a4cf-643e-4c06-b052-27085675c865", "value": "24576:MG8mpEO6YTd8WKrRL1/RyUFauOUi3assb:M6pETVrRL1/gSJOH3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604307, "uuid": "8738f521-3df1-4c8d-8271-01359aa0b7f2", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604307, "uuid": "500099c8-d7e2-437e-8112-fd14db18b2c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604307, "uuid": "34596e68-459c-4812-b5ae-dedc62740b0a", "value": "510afff1d504a336fce16604a18df564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6389984a-36b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691585459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585459, "uuid": "b40daceb-dc67-493d-bf53-9e0924a8c358", "comment": "Malware payload (Amadey)", "value": "a7bfb6cb3d33acefdbb87028bc07f73c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585459, "uuid": "d0a470ec-ec73-44ba-8d0e-8908c6d45c6e", "comment": "Malware payload (Amadey)", "value": "58226a5d50e33a6783ea1fe9ae946e4c8ff0025c6efe00d48c86ef8d5dd981dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585459, "uuid": "f297250e-1370-4fe0-a9b1-41dc377326df", "comment": "Malware payload (Amadey)", "value": "423da6be37ff3a6ee5ed29c9d49f056e2897b00d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585459, "uuid": "e263861c-2f0f-4d79-bbb9-0418548750a1", "comment": "Malware payload (Amadey)", "value": "56ed7fb8398df36c344d352c6b5dc778d63b86641036f33eae871a95302f17e705c47d676bd841fc8b138a4dff3cf8ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585459, "uuid": "718cfc21-5481-406b-b185-9f2a14fdfa43", "value": "T175E4130397D89162D9763FB085F713931A367DB09DB48766334AA80E0D732E1A93673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585459, "uuid": "87fa0d25-7382-4422-802d-4c6a72b2992b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585459, "uuid": "08e2fd70-6c61-4cad-b874-a0493f59d8d7", "value": "12288:7Mr4y90WRuzhCbsJPgqqHA1qn3fS23OSmF21nSnv/2TshrwrXx6c:jyPeCYWC88KYv/Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585459, "uuid": "5e9a41cd-a0ac-408b-b983-996de8d93f77", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585459, "uuid": "92de9543-af4b-406a-8d1e-5934ceb93ed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585459, "uuid": "b2a3ae32-99ef-4367-8081-0fbcd0c2e74e", "value": "a7bfb6cb3d33acefdbb87028bc07f73c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad02d1b8-36ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691583434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583434, "uuid": "b101a89a-4610-4985-81cf-5a4a40d488a2", "comment": "Malware payload (Mirai)", "value": "1012ddd63d43fb84e1afb26acb2f1aa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583434, "uuid": "78ecaf54-7a07-4a2f-ac72-febac77cf6e1", "comment": "Malware payload (Mirai)", "value": "5849a371c12c8c9e360310a20ef39ab1084f4adc6c481d4ae36e8090b9f4bef4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583434, "uuid": "05295bf0-9ff9-4d96-8bcf-f268ba678429", "comment": "Malware payload (Mirai)", "value": "b9f5e8e8da5e5bf2c96beefd4f5992f29c2fe268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583434, "uuid": "f52baa82-edaa-4a8b-9610-cc2e19152365", "comment": "Malware payload (Mirai)", "value": "62d1fd40c1f811c63f851b27c4713b65ea789f8bbe43fed329fe2414d98cb1ad2010d417fa354c2c498728fe93494cc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583434, "uuid": "39db6bce-03e0-431f-9cdb-c9e8c5e32853", "value": "T1E4732A81BC809E15C6C517BBFA6F118E330297A8E2DEB353CD145B6477CA81B0E37A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583434, "uuid": "6a3a1620-35ba-404c-be95-02eb2e006e02", "value": "1536:X1nvlFlubk/M+Oggb+MAYs+y6HNcZsulIw9mrsplDKZUCQBKXAVan5X+F8JyviBH:bFlzO1b/AZ+9HNgs279mrsplDKZUCQBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583434, "uuid": "89ef64e8-c948-4af2-99b8-ce0308719d2f", "value": 80104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583434, "uuid": "b1f946ae-0588-444d-a661-c7cdfa95770a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583434, "uuid": "4e599b13-74cd-44eb-acb7-81b54847c996", "value": "1012ddd63d43fb84e1afb26acb2f1aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdb0f6c-36b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691586063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586063, "uuid": "bf364765-b9e2-439b-859b-11484776cbf0", "comment": "Malware payload (RedLineStealer)", "value": "d8a5d5b59cb3a3da135cdc8faa2f2a32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586063, "uuid": "f131a1e0-49b4-420f-8997-d2ce5c4efa99", "comment": "Malware payload (RedLineStealer)", "value": "58b90cffc77eef61b723157496c955956cd91a76f9e2ae71d0915a71df8b8550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586063, "uuid": "b13fa16c-fbff-4850-a4eb-8ae711f693d3", "comment": "Malware payload (RedLineStealer)", "value": "9d05a174c9302f009c4f34e9e5beef491496c62e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586063, "uuid": "0c6ac21a-9df9-455c-be83-75ba4bbc0954", "comment": "Malware payload (RedLineStealer)", "value": "7c89b8403b83180aaa5ca3a56c2f4343ae35b4b3b4aeafbe2ebff28998285ebe6bf7482371e5e30f42557e7b59f7b493", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586063, "uuid": "e8dd5650-8169-4544-9c85-9c2ab4e4aafe", "value": "T1D6C41212F7D85473E9B527B048FB02930B327D61AD74936B368A985F0D32690B67272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586063, "uuid": "9f90243e-1e9f-4f59-a107-e2941fd0c0ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586063, "uuid": "5d933de4-f695-46b8-9e66-0e663984f71c", "value": "12288:qMrXy90TKAa3ehVevljfxNHn9gSF7GY3PCFKnfgBYCwzpFursPtm:5yi1JQjJJnz3P0KnYz0oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586063, "uuid": "2c357743-2c31-4f6c-af83-e78c080b43aa", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586063, "uuid": "e6288eaa-5468-41fd-a681-b3cebdf49ae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586063, "uuid": "4304bd64-36ec-4b66-afc6-0433ee461ef6", "value": "58b90cffc77eef61b723157496c955956cd91a76f9e2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cf895d-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571636, "uuid": "c1e2af21-0398-4e29-8275-e980f67c4ac9", "comment": "Malware payload (Amadey)", "value": "89a71d456230a3e4ded8f6c242661aa5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571636, "uuid": "5a8cc7aa-2bc4-443c-b54c-1aeb3953e43d", "comment": "Malware payload (Amadey)", "value": "591d0dd7baeed7ea1448965c38b708f3a0362738ac032edf7e3ccf37bbb7cb51", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571636, "uuid": "7ae05e19-06e2-4149-8b0a-c959eb4adf33", "comment": "Malware payload (Amadey)", "value": "2be0a3343e6c6dc5627bc7cf22e675d93c6161f3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571636, "uuid": "64ffaa17-3c01-4730-92a9-3fa054b266c9", "comment": "Malware payload (Amadey)", "value": "f4b993b315eaed0c70ac5e039fd6289ab3a70d79f6136619ee8210458bd5a8058f3b295a92b44e103af10602ea8d0953", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571636, "uuid": "24a2de87-2670-4427-842d-14863c44391c", "value": "T1B9C41256B7E88572E5B117B009FA02930B35BD665D78C35F2246EE0F0D736C8A63272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571636, "uuid": "f906e204-cb05-4404-8bcb-0455de527346", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571636, "uuid": "ef83380b-8cdc-4361-a670-e69748d8f9f7", "value": "12288:tMrWy905nKAG0ruR6ARk+zom8AA0+4lk5vZchXDFH62W:fyenRG9Rk+sAA0TaZctZat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571636, "uuid": "1fff9afd-9ed3-40f4-a103-8f77cc552f2a", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571636, "uuid": "a1bb5cfe-2ed5-4841-842a-4c0c5e04a730", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571636, "uuid": "27d743ac-97b1-4fad-bd49-da36b6e105e4", "value": "89a71d456230a3e4ded8f6c242661aa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04cb8bb-36c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691592943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592943, "uuid": "4f6d273d-c5c8-4a0d-88d5-99ba6d44b3dc", "comment": "Malware payload (Formbook)", "value": "e60881345186f019350a2971642549f4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SCP", "colour": "#156AD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592943, "uuid": "d0f83b97-daab-4a3e-b5a4-8a5d685d0c78", "comment": "Malware payload (Formbook)", "value": "59a791c3025daf18303293afc7eca4d2e8ecfbfa7d3942f7e3bd6e92635538c8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SCP", "colour": "#156AD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592943, "uuid": "09d0bb66-b544-45dd-b7bf-4166d3d09bad", "comment": "Malware payload (Formbook)", "value": "2482ade149122a56ece9aeb171f2296a958f4083", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SCP", "colour": "#156AD6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592943, "uuid": "b084cba6-ecf2-4546-b8c1-4d45c2f4eab0", "comment": "Malware payload (Formbook)", "value": "d22df54a7eee16ed1041a8d30662578aafb02df8997d3f63827d0e9b012baca6dd65617c90ed69f1b93afcdae7c75fdb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "SCP", "colour": "#156AD6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592943, "uuid": "f0acb7f9-56a3-47e4-822d-bbc1afe3d2c7", "value": "T11F23A48D7C8539B0394A5CB5991F4CBD2970A9266A9A83F81610E7D05CF2CDEBBD3C4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592943, "uuid": "ccd59a4d-7c9e-4854-a255-ec76cf557327", "value": "768:3h9O2+94AQEdQzzZ3ZtBQl4+mVBz/z0hY:3h9O2XAAZbS4+mDz/z0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691592943, "uuid": "f6131944-7df6-4a85-bc49-6d5f3fec5804", "value": 49661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691592943, "uuid": "64bcec04-695c-4660-8c72-0d2b4f1e520a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592943, "uuid": "9aae66cc-b3d8-4fea-b2bc-6668841e5c51", "value": "DypP.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e652cf8-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623595, "uuid": "47d81e27-edd8-42bf-abe0-51de99310f7b", "comment": "Malware payload (RedLineStealer)", "value": "fd8c29df629f4716dc72394007e5b2f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623595, "uuid": "4f14b80f-28e6-4d74-b7cd-bdbb164b7b7e", "comment": "Malware payload (RedLineStealer)", "value": "5a9afd2e2009374e29e2822d1680b3bbe75937b220d4348be9fb09b4d3963f61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623595, "uuid": "757ab4a1-6357-4953-ac51-c561163ec279", "comment": "Malware payload (RedLineStealer)", "value": "2330fb840102cc6747d4617c4790679763a64ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623595, "uuid": "cdcc1ce6-8c87-451e-9ac8-c59634226b34", "comment": "Malware payload (RedLineStealer)", "value": "82c2849443a5c730ee005739309a9f78a7d6d5386bbb6cc5e551c2e230cedd7a7c1c97513098db879d3f249c1d53f67f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623595, "uuid": "51b32778-4991-409f-9233-e122cda2c58b", "value": "T110C41202FBE89572E8F417B1A9F603930F357CA28C38975B3741686A59732E06531B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623595, "uuid": "b2228dc7-339c-4b07-a227-abbf10c43359", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623595, "uuid": "a39db66f-3e1d-42de-a558-bfc6b1d6ee4d", "value": "12288:0Mrwy904/MDxMCFVA0gND5h/cXHNL7S4cygBYCmOEVY4bmK2:8yNMKCvUhKpO4IzTH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623595, "uuid": "d3047a0b-aa67-42c0-9164-6f3ffe470c32", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623595, "uuid": "86c42caa-080b-4723-80f0-9d8b058c838c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623595, "uuid": "28b5fb13-7752-4c3c-b7b3-458379e65896", "value": "fd8c29df629f4716dc72394007e5b2f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb7e658-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691583756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583756, "uuid": "e0b91d3d-2cb5-4c15-b349-54d434cc9558", "comment": "Malware payload (Mirai)", "value": "e138e1363c0a701fb9c0e32db4b699c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583756, "uuid": "ce235f43-7fab-437f-89a2-6d79472870b1", "comment": "Malware payload (Mirai)", "value": "5b62e159f5eec32d608bf20c293f1ace5a97a0d4b2606bdeea88af9d853a335e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583756, "uuid": "d60c55de-2feb-4d22-814d-0b03fd382267", "comment": "Malware payload (Mirai)", "value": "3f76ef85b7cd6edab36c699b1e92347e4ec425f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583756, "uuid": "0b292eb9-44d7-48b6-82b5-b1544f799655", "comment": "Malware payload (Mirai)", "value": "958932600252cd557502e67bdd66bdcd5b9b9f7884bb46b49f3b712af5af08efb763f2817a75c2528edd5c3384633f78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583756, "uuid": "a750f7f8-63f3-4263-8899-53333109f260", "value": "T1DD83954D2E219F7DFFAC823987B79A21960533AA27E1C5C5D05CEA022E7034E741FB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583756, "uuid": "059a63aa-2a87-4793-80e4-4e93acb6944f", "value": "1536:y2MI3DAoc6Qncqi0vLEKN3TgPnEDg4iPK2PQ+TtB:qkDB0T7NanEDg4iPK2PF5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583756, "uuid": "d846a10b-ea7f-455a-b863-93d5cd014736", "value": 88000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583756, "uuid": "4c9dd5bf-180c-46f9-a624-411b8cbd92ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583756, "uuid": "9c4bef8e-82c6-4990-9c7e-219c3acc5f83", "value": "e138e1363c0a701fb9c0e32db4b699c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a85773-3694-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691572262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572262, "uuid": "a9d7e7d5-cdae-4128-a976-9c5e042df765", "comment": "Malware payload", "value": "2b5393174a183610342d1d87ec6626a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572262, "uuid": "e21d0c73-da2e-430a-bd5a-3c85b986ad6d", "comment": "Malware payload", "value": "5b95adb9af5a6630725927c956e8ead9b5493242ac33478e3f8f417658b6ad9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572262, "uuid": "585b8c75-bc85-4ef8-872c-d8e3baa0640c", "comment": "Malware payload", "value": "e1fff377a152747503f86ce6a68efe3f764f3ff6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572262, "uuid": "232ed4b0-768f-4762-af79-cfd41e82edd2", "comment": "Malware payload", "value": "206a7b5f853d77e7319bd4de533f10205005d1369a1589bde2eb4980a9c66d503945c62d87414015f4fb35e098a2b3ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "ftp-mgcpakistan-com", "colour": "#DB1461", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572262, "uuid": "4b91047d-869e-41d5-8f96-830c00daf53d", "value": "T1EC82CFF1A3160F20CAEC9F3636F6ADEB79254A63B2ADD0214321871D1494D085BF0DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572262, "uuid": "99d36f40-bd12-4c89-8816-c183d321558e", "value": "192:FgZSu5dIedZDYnnEllacDvPQuPqkfWS/k681sx+4Prv69MAOIQnjJ/NKZZ:Fgcu5esjja6vPQuyq6QNPryCAOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572262, "uuid": "26f982fc-fa5d-4370-abd9-b7e9d5cf70d3", "value": 17572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572262, "uuid": "24e55dcb-157a-494a-851b-925ba660beaf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572262, "uuid": "a9fc4767-93c2-4c20-8927-89ee47388906", "value": "Order 09082023.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a408fb-36fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691616123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616123, "uuid": "c36ae528-0f25-4c43-a09f-32f3be96b8a4", "comment": "Malware payload", "value": "9f3a752331bb865a82498b80ec23cdfd", "object_relation": "md5", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616123, "uuid": "36634535-535d-4ba1-bb14-33d3f7d181cf", "comment": "Malware payload", "value": "5be83d13f20b4a044a8c8281d13723a808555cdd73a7ddcec37422a4e44fbd4e", "object_relation": "sha256", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616123, "uuid": "c395df91-75d2-4670-8b51-8d5d74ba9622", "comment": "Malware payload", "value": "d25e55d1eed18e55557ee9da7d195748dd2814f0", "object_relation": "sha1", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616123, "uuid": "97d871f4-9d90-4b32-9c0b-4a7d962fbd6e", "comment": "Malware payload", "value": "41ce28126b5f51d28835d5b5dfc7dceb927fb5f1ed7c7a29aefb9387a343ff9d064eacbed8797f4bea1ab9f36b1d9c6c", "object_relation": "sha3-384", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616123, "uuid": "1a471796-69c6-4699-a635-455a6032e52f", "value": "T11895CF42B3B581E7FF5771365ECAF25A1278ED580F12E25F1BDC3D69A4301E126A8322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616123, "uuid": "7ade7973-9354-4b66-b7e1-d032f7f7ef53", "value": "24576:UtncpVGPCNI3/EWVyGalaWXF1Co8yaQSP0fLsoUrftnylpfCBQHPsJ7ON6UPHbEf:9pUPCe3/7AqWV1JDaQi09YQHPsSHbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691616123, "uuid": "7a761322-b74a-4303-a9e0-307a3f892c9c", "value": 1953792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691616123, "uuid": "e9925634-8a87-494b-a0f8-b542e9b3e42a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616123, "uuid": "1de8015f-5b5a-4dd1-9c8f-6e06eeee19e8", "value": "dig region poonch operator details.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f79a9a-36cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691596876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691596876, "uuid": "0f160328-3eda-4259-830e-6d5ed5510ee6", "comment": "Malware payload (RedLineStealer)", "value": "71cc728fa75b0d628b34bdaadf642c09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691596876, "uuid": "d022a65e-68e3-49f4-ac7c-57d839bdd001", "comment": "Malware payload (RedLineStealer)", "value": "5c31798fb020b2f8d5f2bae522d609d1aa7df265eb347ea65bc698c16e2587c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691596876, "uuid": "6b81bd09-96ee-4ffc-943b-1b773c1efcb1", "comment": "Malware payload (RedLineStealer)", "value": "72f8e913d022e7a08d767a22176358054c24a066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691596876, "uuid": "ea9e9102-79e0-47dd-bd16-95eedd38a551", "comment": "Malware payload (RedLineStealer)", "value": "7a693dd7f5d3ae468dea344895e88ba83990feded6df0f786db98180d7c407952230e5d018649776145a099e90dbe226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691596876, "uuid": "2fca99a4-52ae-473b-8b5f-5133f61e8fee", "value": "T137C41213F7E49472E9B62BB058F307930B357D62AC78864B1346E95B0C72B84A435B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691596876, "uuid": "de86f4ca-a212-43fb-a97b-8b402d584e10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691596876, "uuid": "434844ff-f352-49af-aa78-95c371733e6e", "value": "12288:VMrOy90uCkycHejwXuhTP8irgBYCPnS8Ahrr3ew0S17:/y+vE+xP8jz/S/t0k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691596876, "uuid": "1c0d668a-09cd-4920-969a-c08edc4e66a3", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691596876, "uuid": "6b7af2a1-d492-4779-80ac-0bb52b3eb6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691596876, "uuid": "99593768-f2da-4ed6-af32-6c13e43abd27", "value": "71cc728fa75b0d628b34bdaadf642c09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ff2f4b-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606295, "uuid": "350e0d8b-9076-47d8-8c69-b199cede3c21", "comment": "Malware payload (Mirai)", "value": "2659be7f5a263234d35f614c88594832", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606295, "uuid": "7194fd71-11e9-448e-ba84-3e9792ead38e", "comment": "Malware payload (Mirai)", "value": "5d70bbb4b1c31bf44aab0b7326dfe0db313bbfba2bd3ad98df0a78a4192c2ab8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606295, "uuid": "5b976397-34e0-4c78-ad0b-f145ca50d140", "comment": "Malware payload (Mirai)", "value": "bd0ad06a1cb7255ee067328908a8cf687297362e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606295, "uuid": "45da949d-0c30-48bc-acb0-9ccb21078e64", "comment": "Malware payload (Mirai)", "value": "b62fd11f2803f1e95fb513d0d1f36bf0ce7c262f189f3cabbf48eb47804f204c98212c849e20bc9f25e2a7843dd17b93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606295, "uuid": "631fa4c3-1354-45bd-b81f-06f629f257c0", "value": "T100539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606295, "uuid": "2d03bddc-58b4-4f60-9ed5-384ec6951168", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606295, "uuid": "c6cac925-3b89-405f-b40c-2298aa4fd219", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606295, "uuid": "7044358c-2665-4816-b056-46c116037dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606295, "uuid": "6d9d451a-49d1-42e6-b0b3-3248dd74be6a", "value": "2659be7f5a263234d35f614c88594832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9504756a-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691599715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599715, "uuid": "0c20d83f-c54d-41c5-a570-f54fd275e8c1", "comment": "Malware payload (SnakeKeylogger)", "value": "6bc9a85bf072cb887161b9529cd95edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599715, "uuid": "94d32e35-8ca4-4bd0-a014-f23855e291a5", "comment": "Malware payload (SnakeKeylogger)", "value": "5db8a4211272018122f3de2f5c87f098f125c5257f135c98e2c21a507e40dad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599715, "uuid": "12fca9d9-4755-432d-ac7a-4d79e958388c", "comment": "Malware payload (SnakeKeylogger)", "value": "0358cadcb79dc502f111932768fd349af02dfcb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599715, "uuid": "b757ddfc-b9d3-4ae3-a11b-26cd453bfa0b", "comment": "Malware payload (SnakeKeylogger)", "value": "ab0401aae4786bc0b2fbeb46ef546448c42627604e7fa90578cb4aeb706f81cf33055606359835159efe6eed6ca393f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599715, "uuid": "71107454-d1c1-4fcb-9b5d-f148f4ce1af8", "value": "T1A5C42314327F5AABD67921F157A90981C7F2126DA53AE8CD2CE910CB42F2F44C981F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599715, "uuid": "4bfee291-59d9-4fa9-836c-150a2ef6ba27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599715, "uuid": "b0381091-2ab4-48fd-9cc9-f5cd013dd89c", "value": "12288:rhOSLYTyZgaFmIlOetm0hiMR3XInu7zup8/BbEQTCMFpR:rQ6YTWbL5hiOvzup8Jff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599715, "uuid": "1d3f7ebb-fc87-4999-98e5-f1ffec02dfe6", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599715, "uuid": "13d78588-0e18-4ca6-9142-00f419447378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599715, "uuid": "5438f6d6-18f1-4ffc-a3f2-09f8afcc1937", "value": "comprobante de pago..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493278d5-36b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691587562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587562, "uuid": "82d13b70-a733-43cd-b69f-4370edfb6cfd", "comment": "Malware payload (RedLineStealer)", "value": "407d07c0c7065e6e8ab17053feae96a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587562, "uuid": "d0ac822f-da55-42af-8258-20e7ea083c9d", "comment": "Malware payload (RedLineStealer)", "value": "5dbcbe8d4b6db423e7b0da0991367f085d8bf89cd067501fe9600571ff9598ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587562, "uuid": "d93959ac-7adc-4c29-b9f1-cf22625f47fa", "comment": "Malware payload (RedLineStealer)", "value": "0882bffab116bcd79611a25f5d026c02c2c102ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587562, "uuid": "b28ea28d-a3ce-443e-a45c-86387fad50e5", "comment": "Malware payload (RedLineStealer)", "value": "c4c667ebc3ec01521cead5757d4b2f071e41245d0934c878a2f706ca5b6209b55b83bbb13eef3113ecaf5603577b315c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587562, "uuid": "9c51c34f-f981-4c97-9fd4-5239b73fd2c0", "value": "T131C41253EAD44173C9F66BB018F703930B36BCB14A64472B2B55AA5B1C726C4B432B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587562, "uuid": "4aba2a26-850d-4bf5-9813-beb1a4a1924d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587562, "uuid": "d51f88e2-1892-4314-be78-a0027294e892", "value": "12288:RMrey90SAmG73PUAHuefjno0cZQZioTCq21nktET0HF:nyNV03PUJefjoxKZ3o+tET0HF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691587562, "uuid": "5c2d8fb6-66ff-4fd2-a87c-050dc13e7f29", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691587562, "uuid": "114d3e24-84d4-42e0-ace8-2d936899f120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587562, "uuid": "5fd75805-737e-466d-b0de-82fb24582c4f", "value": "407d07c0c7065e6e8ab17053feae96a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d1e364-3696-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572844, "uuid": "49ba9a99-c167-42e6-bb31-07ba6f5946d8", "comment": "Malware payload (RedLineStealer)", "value": "e5ba967c5e96779731bec2fac8d84222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572844, "uuid": "79bbf3c1-20f8-481f-a0b9-9229dbbaa9b2", "comment": "Malware payload (RedLineStealer)", "value": "5ebad60d560b8be0c5b1ec23c63e18f39f1208c68143c27031993e11d943670d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572844, "uuid": "bb9fa2be-c9f7-4599-b36d-de78c1f055ae", "comment": "Malware payload (RedLineStealer)", "value": "f007f93c052055a35771204ce3ebdb32d49ca1af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572844, "uuid": "762eeb88-b64a-4652-b308-64a8b7569920", "comment": "Malware payload (RedLineStealer)", "value": "596b00bfbdf4e59c8ff5e50752c124d2c2adc9dfcb94948c0190161f51e6168893e5fc45c23f6f4e9fce4b1bcd8ac997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572844, "uuid": "1ddfc456-1673-4e61-92df-47be2299c07e", "value": "T15BC41212B7EC817AEAB5077429FA02831F36BDB14C74873B2385951B5D736D0A9B432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572844, "uuid": "29e54390-7f31-4586-9fa2-8caf6f3fa7f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572844, "uuid": "527c5415-1cf8-4387-ad4b-6e515a761c07", "value": "12288:PMrsy90DMlltt8QEOV0bYiZSWYEzMIVRTw7qw7:3yMUtHV2YgldzFVRMz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572844, "uuid": "8ad0836f-cd17-450e-8c94-5c4a9a54dffe", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572844, "uuid": "036f3dd9-c878-48f2-be23-547e98a08e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572844, "uuid": "2782a604-31ce-4723-a894-a715b57169b9", "value": "5ebad60d560b8be0c5b1ec23c63e18f39f1208c68143c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520be8eb-3695-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572544, "uuid": "94af47ae-25a7-4993-ab3f-3dee0e429712", "comment": "Malware payload (RedLineStealer)", "value": "ce81635fd316c3786d716b1dad11eca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572544, "uuid": "afeb0f9d-9d77-4dc7-8c16-cfeef1164a1b", "comment": "Malware payload (RedLineStealer)", "value": "5f71008120a47f2e7e955b68afa14315f79b2a6087550dc9a974194ff51e37f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572544, "uuid": "261c96a8-ed61-4a2c-8d3c-98528e9e952a", "comment": "Malware payload (RedLineStealer)", "value": "03fadfbef55ac34341b2b02f202f88f151d70447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572544, "uuid": "c35eec24-08ae-4e6f-adaa-1fbd7583a1e0", "comment": "Malware payload (RedLineStealer)", "value": "b134a0734b13dc886ea0080d1082d6dc369240fb7b15ef867d8105a03cd077cf45fc9d3fd1eb6b5203a6d1a717f8977e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572544, "uuid": "cd4c85c5-b0ce-4574-852b-346f0d5e3210", "value": "T1BCC41207F7E88532DAB42BB008F303830B3A7DA45D7883B63245595E5DF26917A7636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572544, "uuid": "5d71c892-e6b1-4dc6-bcbe-45208b9a7f66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572544, "uuid": "7782a0d0-b328-4267-8963-c8a2624bbdfb", "value": "12288:oMray90l8QnMN8ABdYYhZz+2N6s8mFv1iJQ:CyZQnnABdYeRZN61mnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572544, "uuid": "287542d5-8ee6-4a00-8ef0-8bb79d090f5e", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572544, "uuid": "dd0bf29d-1c28-4bc1-926c-217e1b2b3426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572544, "uuid": "196ab693-0485-4dcd-9017-d0afc29a7b63", "value": "ce81635fd316c3786d716b1dad11eca8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f782c74-3673-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691557991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557991, "uuid": "45c5ddd3-b911-448a-af93-9ef803ff2d96", "comment": "Malware payload (Mirai)", "value": "bdacb9739060659e39f49e4b52db10be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557991, "uuid": "97cf4b45-26fd-44be-a6b8-a5115e6ce145", "comment": "Malware payload (Mirai)", "value": "5fb95061fae0a0689c11169589dcc3b47e8369955c5a03e68c7825bab104c12e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557991, "uuid": "a31df3e1-8067-48f9-bfbd-115e9ae1ae5f", "comment": "Malware payload (Mirai)", "value": "bada23b4300a1d49a6cae1cf38bd2570bf8585a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557991, "uuid": "cebf0b66-c288-4a1e-a3c7-69ca1c0de3c8", "comment": "Malware payload (Mirai)", "value": "6c7caa3d4fcfc289dc1960915ff09301d0bf3090a2dd111801658cc54f84ddcc0856eaf90c8f687e6ee35fcb2dc49373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557991, "uuid": "2e16385f-c2cc-458d-9da3-930840478b3e", "value": "T10213E145E158E0A2D07E403A06ED3BAA19A1D51F9360F6E1EAA0741224DDF40FF5DFAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557991, "uuid": "84e0bad7-f64b-42fe-aa90-83da6f0c3611", "value": "768:9RuPmJj/FCYtbI8FeDKSGQ5gZah57RdWAxa2eqTMnbcuyD7UiyqR5:9RuPmJrFXtGd7gZy57JxaWMnouy8Zqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691557991, "uuid": "91c9da7a-613e-429d-9fc0-bb0e515998ab", "value": 43608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691557991, "uuid": "2f04f2dc-107b-46c6-911f-1eefc36f7d7e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557991, "uuid": "5410f964-d866-44d2-9210-943b98001873", "value": "bdacb9739060659e39f49e4b52db10be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97934526-364b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691540878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540878, "uuid": "1ffd7ac6-96af-488b-8572-7cde4e43c6d9", "comment": "Malware payload", "value": "250743d687baf8d8390954aeda8afe87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540878, "uuid": "135956b3-8fe3-4b45-a708-676a89d3d628", "comment": "Malware payload", "value": "6085d4b1d55cd54445e5e35cf8ec37009ffd3b3842ebabf214e0b643334cfee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540878, "uuid": "6610edb4-dce4-4869-a477-2c15e9a3cd42", "comment": "Malware payload", "value": "06a1e1eba8c12755728a5ae2264e9ba82c18eec1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540878, "uuid": "29667024-540d-4ef2-a865-7332ad98534f", "comment": "Malware payload", "value": "a7872b10ae4d9d4b30593e2e39f75bb30f47202f6656f3684ad38be776b5813a476ec769217b1bba362d2886f244bf3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540878, "uuid": "f54070d0-b942-4989-8b27-be99b2484268", "value": "T12C92CF0D521D04FEDE0AC8B083961FB43F900866D982CD6B54EDD2879C8A5B53D63FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540878, "uuid": "4f10f557-8a5f-4417-b772-5cfe223557f4", "value": "384:9xeqRd0ypNBADj5XESy4oD4VWYbCHCCWIj1JgGlzDpH7uNj1Jbm:jeqnR3UlLKpYbxCWA1JgGlzDpbuR1Jbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691540878, "uuid": "d2e4e395-6ee5-41bd-97d6-647f6ee80b07", "value": 20920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691540878, "uuid": "d2e3dfb4-75a3-4dcd-a6ba-b9acc1898685", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540878, "uuid": "f1056300-c090-4b06-a08c-ff7f4638c27b", "value": "SecuriteInfo.com.Linux.Mirai.1288.8605.15573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce37a3d-36b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691584186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584186, "uuid": "9586f252-d215-4912-96d4-66228a406df6", "comment": "Malware payload (AgentTesla)", "value": "50497b1c8ab4ec5f705fb627f674e9d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584186, "uuid": "540ccdb6-4277-44e8-a2ed-2bbc873c899b", "comment": "Malware payload (AgentTesla)", "value": "611c2554010bd61aaa8078e53036b00dd268c5e2a5ba02bfb86626125ac13cdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584186, "uuid": "259b5874-891c-478d-99de-07abd80c95a5", "comment": "Malware payload (AgentTesla)", "value": "692bb739c23b6920b766bf9a3333cb46465b85ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584186, "uuid": "3da1c751-6106-4c96-8858-0380b335857a", "comment": "Malware payload (AgentTesla)", "value": "77f24e1bb10b7167d5dc20426fc6a06a5ae505f09be6a15effccb2b899a740e4954858e8e2c50b55ee940cb4e0602c03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584186, "uuid": "00aec2a3-9ed7-4701-8d1a-bce22b5c89de", "value": "T112D423BEE03EB4CA0214B046AE4563C96B59D541FCFBDC7A17B183C64A013BE3856F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584186, "uuid": "a98e7f1e-2da4-41d7-8740-3650d1a5c3af", "value": "12288:0US8mHfq9V/RqzqNCMW1XWiiT17ozkQUpYutqI6KFXCcPHJXwH65gQt:WfqvlAMeXRIqAQUXBxPJXwaiQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691584186, "uuid": "94d39de1-92be-4251-93b2-d32bd7d8d95b", "value": 639519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691584186, "uuid": "792ea584-219d-4950-aa39-519f7b481724", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584186, "uuid": "d2660e41-54fd-4e0c-bbec-b7e6f15bb720", "value": "BOARD PO 8.08.23.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15781bc-36f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691615627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615627, "uuid": "6e8815fe-1f6c-485b-8f66-d4551554c5a1", "comment": "Malware payload", "value": "66930bf82bfb024b844350ec701d6839", "object_relation": "md5", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615627, "uuid": "66638906-8bc8-4888-9d78-84587e8e4f50", "comment": "Malware payload", "value": "62fbeab3567dcd10f2bbe41bd5d0c43eba86ef750a9136455ec9961f39a5c01c", "object_relation": "sha256", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615627, "uuid": "d2996a06-c3bd-421c-a9ae-e037d692bf87", "comment": "Malware payload", "value": "fac19741869f0cdd7ad06a27fcb69f5f568ee2cc", "object_relation": "sha1", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615627, "uuid": "b5733e94-4cbf-4262-8850-745efe8a9b8e", "comment": "Malware payload", "value": "da2d7f2c683a2b7116c97700364ddf18fbee2b3aabfc53ad1cefd72a25e0871ace098781a28fd65bc923548fed163bf0", "object_relation": "sha3-384", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615627, "uuid": "423a17e7-7d72-4b47-914b-f2cadc56714d", "value": "T1D07423331EB949DAC5622C1273964B492A76CE20A1D9C36C67112C0CE5F9BB3B44FEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615627, "uuid": "bf3a8725-4444-4b55-982b-6b2704dcfff4", "value": "6144:wH+R6aFV71t/Kp4mxWvGkZSQQyCmGQ+6gnDeKjylLnGNu7x2hmEAmopzNfo:weR7FVht/K6mxWJSQQyCmGb6ajylzGNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691615627, "uuid": "e16c68c1-fa5a-4246-b869-bb2afb0a018c", "value": 370402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691615627, "uuid": "4a0e8671-5fb1-487d-8bab-4c381e768645", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615627, "uuid": "d35159e5-55ac-4880-90a9-5ea53af0cbde", "value": "update.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da8fe49-364f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691542526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691542526, "uuid": "e275fc88-562a-4de3-93d4-b3901d896275", "comment": "Malware payload (Loki)", "value": "137141a66c13ca84d8d5856f1bc176c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691542526, "uuid": "62399389-2b2d-4ee1-8074-b8603acaa3f9", "comment": "Malware payload (Loki)", "value": "630821bfae07b41945a9ebf48d20eabdb4ad0e7b74cc58606e45597287a48738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691542526, "uuid": "489f301d-197b-4522-b440-da08f7f6af08", "comment": "Malware payload (Loki)", "value": "0daf2cd04303ef97a87f94ac77d99fd4c0a94f4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691542526, "uuid": "ced71ad1-181a-4a9d-bab6-cf22af69e3eb", "comment": "Malware payload (Loki)", "value": "d54970f2aea6d13ba6b97a5a39e65069cee300f0d5defa3fc4d9bfde256f638ed17cf5b8d824ba329e7155c352b0b2f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691542526, "uuid": "e16bdf45-3c80-4761-96ac-d38f9c0a60db", "value": "T1DB546DD366E07861E6274B32BE6AC6E83F2EFC618F1577DB12586A1F09711E1C632311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691542526, "uuid": "cffb2b1a-7563-4cf4-b5c0-ec2ff4acf469", "value": "8b04667bf7005dc7bdd7ac468a9f7241", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691542526, "uuid": "caf1b25b-9248-4b3d-8c69-70a7c25c483b", "value": "3072:sWsDZj7OP37/58Lknj0/JBvOb8fVUHIYV4MIWLCNIktSRw2mw+:zcm37/584n4vw4g3ub2m7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691542526, "uuid": "bf759b9a-0b3e-4799-b22c-baeba63cb17c", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691542526, "uuid": "c15b8397-9f0c-4e30-adcd-de427d1cd104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691542526, "uuid": "441af67f-f465-4793-9a14-e5ccbf35a47c", "value": "137141a66c13ca84d8d5856f1bc176c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b741beb8-36ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mimikatz)", "timestamp": 1691595478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691595478, "uuid": "33c00c75-1ac0-450f-bdc3-150f00561cf7", "comment": "Malware payload (Mimikatz)", "value": "7050dedf587b4d4d5d97469da5c67ca1", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691595478, "uuid": "232fdc2f-0147-4f71-8fc3-28a1ed11acb7", "comment": "Malware payload (Mimikatz)", "value": "637a6e90c7e5ed50c6c460b7a03dcc63698de2f2a62cc468f6ca1394c084c1aa", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691595478, "uuid": "839958fa-f3b3-4bfd-9708-c80699a1ef36", "comment": "Malware payload (Mimikatz)", "value": "a4b7302562132044845d33ff486aa1905c7027df", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691595478, "uuid": "b0cf212e-956d-429b-85a3-dd7cd82c20a7", "comment": "Malware payload (Mimikatz)", "value": "f5171d5125aeaa55eaf55f4176c0613e084d3a0827efa43f8ffffc5d43d69ecaa5dab5822777df368fd5afee05941242", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691595478, "uuid": "462ef287-2843-414d-be4f-b38a04acb314", "value": "T1D9B57C39CE77FCD5136D3980A4103E5A1D6C2A4783B8665CF9CD18BA3FA8614CF2D5A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691595478, "uuid": "6cea4711-a031-4548-86d9-334e645a643f", "value": "24576:Ma1T/9/L9IoVvl/5eBALhxPOiBSQ8JHOopV5keZaPeK:MuT9xx+1AEHOeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691595478, "uuid": "8bd2bb5c-d570-4faf-b219-d3d3d9086bc0", "value": 2395877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691595478, "uuid": "ebdd642b-41f7-407a-88c5-a0c3243b2742", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691595478, "uuid": "af03d84f-d5ba-4d3a-9e4e-d956d77a9b52", "value": "Invoke-MimiDinos.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a2aea2-36e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1691607385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607385, "uuid": "49983978-5c16-43d8-8ab3-89e9b02de830", "comment": "Malware payload (DCRat)", "value": "b317958148be2e55f24584346118fcb5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607385, "uuid": "811a9b89-8aa3-472b-94bb-1377a5d2f42a", "comment": "Malware payload (DCRat)", "value": "63813586a21e0d32c6823c38966801e5ec1ff5f6f4845f5ccf5e91382e060b07", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607385, "uuid": "a2e6ffe2-9fe9-4b16-a2a4-47e1fa3fce01", "comment": "Malware payload (DCRat)", "value": "d408fab9e26a9b3cbc35214fd4783f85f692f66b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607385, "uuid": "b5028a55-a849-4301-aefc-ed05ea80e39c", "comment": "Malware payload (DCRat)", "value": "957b33b10e2014600777e73a7da2ff04621a813edf4f8d519c8de3f9aa029b34484c1cb8304e2015dc0c6e3b6abd08b8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607385, "uuid": "d53c08cd-d22c-49fe-8431-54a1e57d242c", "value": "T1EE658D027E54CE11F0082633E2EF494847B0A9556AE6E72B7DBA33AD55123A77C0D9CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607385, "uuid": "a2fb5fb1-2d6e-485d-bb51-a8a4fcfb9bc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607385, "uuid": "a84fb38f-b5b4-4f1c-878d-70088bf50e8f", "value": "24576:N6/16VpovBLQonrdrcseFsaiM+hOMBrFfzNJR:4/wVpqjoiMKZp77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607385, "uuid": "82b2ebcb-0465-4d66-98e6-9e1dc89c6260", "value": 1518592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607385, "uuid": "f4dabbe3-465f-49b2-beaf-17ec17d24bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607385, "uuid": "999587df-0031-4077-81bf-88dace40a6af", "value": "b317958148be2e55f24584346118fcb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82d34d7-3708-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691622081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691622081, "uuid": "e0cd57c4-4916-4d93-b977-b694c42f3d61", "comment": "Malware payload (RedLineStealer)", "value": "278407b5fc22674fd7834658e88c6fa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691622081, "uuid": "04c5f4bd-f69b-4bfd-b248-8c7709db41a2", "comment": "Malware payload (RedLineStealer)", "value": "63abf9609e4159af35c76ea9d68e913d6a535699375c4719a22f41d47df03629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691622081, "uuid": "4ab183d6-9cf0-4142-b9f5-d6709567087a", "comment": "Malware payload (RedLineStealer)", "value": "0b0bc9aa570d20a1b3641c143679e4df596a53d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691622081, "uuid": "3aeaed01-cb00-4e3f-a168-541d13244877", "comment": "Malware payload (RedLineStealer)", "value": "e3e625814197de13cefa8ab5ac83c93e3e6eaad549cbba7e65c3bf858ae620e9ca4e78b219dc90b07bc79c70f32a991a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691622081, "uuid": "2ca415b6-2de1-4aad-841d-6df734c539f9", "value": "T1F7B41212FAD89033DDF6677054F603C31B367EE4A93893AF2389955A0CB3684657272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691622081, "uuid": "29a8d2bf-7eb5-4bd4-8c56-18294632d9c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691622081, "uuid": "53c0c8e3-12ad-4e01-8dd2-043da1ce360d", "value": "12288:0Mrzy90CRiGSF4E1ihEMe35UKk9U8XJdMZ:/yxRiGE1eEMe3yKi3MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691622081, "uuid": "90a34d96-c97c-4157-99cc-b8133b0425cd", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691622081, "uuid": "137cb8f4-2f8a-42f1-ad1e-a2eba42b74e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691622081, "uuid": "f8aa07cd-85cb-4b1f-8572-00144ba955a9", "value": "278407b5fc22674fd7834658e88c6fa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1476c105-36c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691591768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691591768, "uuid": "2ff760c7-3efd-4ebe-9ad6-2bcdc67bc274", "comment": "Malware payload (RedLineStealer)", "value": "6c59c9d011581c5691685901e6acc68b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691591768, "uuid": "7f2fea4c-a133-4868-a910-f37cf12f1aef", "comment": "Malware payload (RedLineStealer)", "value": "64027025b3386c198f71174a03f00abee8c76f3993f0b3de9ff7583aada13cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691591768, "uuid": "93cb07ca-ea50-467a-a293-28e6503fd1ac", "comment": "Malware payload (RedLineStealer)", "value": "c869646b869465fade91b9b2737e0ad4128907e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691591768, "uuid": "825fa6bd-cc6c-45f4-a9b2-81bd1c3ca574", "comment": "Malware payload (RedLineStealer)", "value": "8170d1236c5c69de6f8e9a60d8276574dfeabb330f4504a991fdb89920b0273f3df3b8ac1b256ed6752c70aa590ab6c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691591768, "uuid": "9adb5d22-588d-440a-ac7a-261b040e0c29", "value": "T1AEC41202BBE88436EAF51B7059FA07C30F357C629C7493A727459A5A0CF3690797272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691591768, "uuid": "f091bbb4-d857-4307-bee8-ec8f684471f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691591768, "uuid": "c4375162-59ac-446c-b11f-9eafcc40db71", "value": "12288:BMryy90P2nwl4lyjBizolF60ElSUEzQPfJwNjFjdk:/ym27ymojZxz0fJwNbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691591768, "uuid": "8c7ec9e2-e3e5-4b28-97f5-6d1ce8e1ea51", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691591768, "uuid": "25687c78-acd3-4e03-909e-79e1cb1c66e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691591768, "uuid": "40e66be1-f987-4533-9e40-0b334ebb5b0e", "value": "6c59c9d011581c5691685901e6acc68b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a97a78-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623290, "uuid": "16d54ec1-a08b-4ed1-82d0-aef456164bad", "comment": "Malware payload (RedLineStealer)", "value": "4b94a05c28cde62fe78ad9e6f2b109ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623290, "uuid": "210417d1-7e85-475f-ac12-2686444ae9d1", "comment": "Malware payload (RedLineStealer)", "value": "64bc77ff595701610b9efe7f784961b136a8fbb442ceab1ed802e22dbd4b8378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623290, "uuid": "a5fae166-a673-4023-8091-98c11aff8cf6", "comment": "Malware payload (RedLineStealer)", "value": "f1c8b775c7d327f911593ae8596261d88515e723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623290, "uuid": "aa8aed93-478d-4782-8524-7f6d3e1195a6", "comment": "Malware payload (RedLineStealer)", "value": "ece8ff958a119d92de90527d4b1748c64fd4b759078352d85b6f3c8a0bb4720be0a5ce41ca0e56f180a97b93afad2859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623290, "uuid": "f276a275-0396-4fa5-9897-ea08c06996fe", "value": "T15CC412137AD88433D5B56B7458FB03D70E367CA14EB4876B2258ED5A0CB32C0A97673A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623290, "uuid": "bdec8b26-1e45-46cd-b988-18f4b32e9055", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623290, "uuid": "61b4c068-2ddf-4426-9c8d-8a8500b51c2d", "value": "6144:K9y+bnr+up0yN90QE7++fe21QIXiIUNc8uBrrhcTLoUL8v3PPdSO+KlatVIePilr:/MrSy909++GSlUjeuTLEHd7MvTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623290, "uuid": "d172bda6-bdfa-4bea-a1d8-fcc129e6637b", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623290, "uuid": "1e90411c-c895-4c72-b911-9878c1079e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623290, "uuid": "afff1f89-7690-4c19-bf2a-e4b498a48b3c", "value": "4b94a05c28cde62fe78ad9e6f2b109ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae56f9a9-369b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691575276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575276, "uuid": "378cf236-6651-457f-b1e5-22b2c513dc7a", "comment": "Malware payload (Gafgyt)", "value": "6c1dfe1327c5f29a5c83f0530fdf002d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575276, "uuid": "1666dd03-e08e-4119-ba6b-b7604622fa03", "comment": "Malware payload (Gafgyt)", "value": "64d04e2b0f981a8fa7ab293eb001af22e40534158b1bd0b4608a8e87cdcbdb9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575276, "uuid": "aa2e4514-e558-48bb-8d63-74306ce9beba", "comment": "Malware payload (Gafgyt)", "value": "b5d8142e03554b78e0d487832e475fcb54e8e9cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575276, "uuid": "5b79e9a4-2743-40d1-82a9-dc25fb9afd6c", "comment": "Malware payload (Gafgyt)", "value": "b70e84ebbc3448976e979888dbc48c8762836079cde5cf521410b6a6448a5a6d813cbe471df9177399521edf37f10c0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575276, "uuid": "bc1ad8d2-2f23-4a41-91fd-16247723b2a1", "value": "T1DE248263D60288A4F11858E2216B3140BE95977F8CEB31D3FA5B2D51FEB589B2077EC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575276, "uuid": "a5a0537e-8c8e-4a32-bfa3-d99af53064cb", "value": "3072:a3S7k0f4UGxzDxfTbe3CAFT250/symg+c4z35YTMTTxErNt9r:ahxJTi3CAE5pymcTMTTxEf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691575276, "uuid": "ea256ea5-c03d-4852-9755-d253caee7e00", "value": 223984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691575276, "uuid": "4bd38847-4074-46db-9098-66368ed59f3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575276, "uuid": "8c062f2e-082d-4c9e-a8d1-66e6c6a3525c", "value": "6c1dfe1327c5f29a5c83f0530fdf002d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b2c327-3697-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Hajime)", "timestamp": 1691573649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573649, "uuid": "1f71f792-2886-417e-970c-757fe65f47fd", "comment": "Malware payload (Hajime)", "value": "77143de7de37a46c4bd6fa421395356c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573649, "uuid": "f4b3c596-9f73-4a1f-9cc8-739ed5259c23", "comment": "Malware payload (Hajime)", "value": "64d34ff91f0346ce6092d79bf99cf0a4a9151da4105272afbad3c86ef053383c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573649, "uuid": "ae54fb22-0e48-484a-ab72-23c9491cc31c", "comment": "Malware payload (Hajime)", "value": "2f6579741d2a18472ffe05748ac3a43e217a5c07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573649, "uuid": "0747622d-9059-44b4-80d4-6163f4224b64", "comment": "Malware payload (Hajime)", "value": "7c6491fedae68588d822fc34b9506e09c9dd942f020201560e4ec6f5f2702e6b9bf4ec8038a313956f4ccfd32be11394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573649, "uuid": "c6c01971-7bc0-4a9b-b201-6898d2ba8267", "value": "T10192D0A1239236A8D722CE7D3BA8340F81584917716D5B406DA0A609D95FB205CF9FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573649, "uuid": "46484261-6974-4169-9e5d-dcac8df837e4", "value": "384:yb2eX3zAKuiNPZRwwqdvrrduMXbCAk6Y53:/kAKuobq1rduMGAXS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691573649, "uuid": "5c99a406-9506-4e9b-bf6a-8ff4aa1874a6", "value": 19650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691573649, "uuid": "26c0bb49-57b4-4b73-a6c6-caa5a2a86d08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573649, "uuid": "cbbdfcf9-23f8-4d4c-9c30-d76073cb2d80", "value": "SecuriteInfo.com.Trojan.GenericKD.34055387.24084.14488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae45b58-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691623294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623294, "uuid": "f7566237-f1de-4eab-8a8e-2e52fdc81808", "comment": "Malware payload (Amadey)", "value": "cdb89d06acbf33fe63e959d08b059ce7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623294, "uuid": "91e6ec82-3177-419b-bd88-5a3a4fcdb8e0", "comment": "Malware payload (Amadey)", "value": "6566bd6b437881c97451348fa56eea886d4c6a1a6cee15add94b70ec32792ab1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623294, "uuid": "d527ade3-ea5d-408f-8555-f2e65896c681", "comment": "Malware payload (Amadey)", "value": "0351b05f147344414656301a5b3794159c7f9ea5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623294, "uuid": "084fdf34-86eb-4a35-b0e2-bf80757adcd9", "comment": "Malware payload (Amadey)", "value": "f5dc0be7aa6a4f67f950ac95020abfd18a81a3c58da693fb4b005066c3fb43a327e6a8709c42d8a329290c4d900ebc3a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623294, "uuid": "d5321d97-10eb-47e7-b59d-f734e8d7b117", "value": "T1AAE41253E7ED9873CD791BB058FB06C30B36BC74AD74826B1381AD090DB3694A57632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623294, "uuid": "3ddc273d-7e0a-4c80-ba17-b0bf8198501e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623294, "uuid": "159a22d1-32a2-4cb2-a8b6-fa9698b34484", "value": "12288:cMrgy90m79K6GDoLtrOcdkzRJhhTS7F21nGmWcnp99L4hjkB:cynJGEL1Dd4JYKlL4hQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623294, "uuid": "0d30d2c2-7172-4e3b-99c1-f1292cbea1bc", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623294, "uuid": "a767108f-d11a-4dde-928e-46825e9eac28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623294, "uuid": "8033d467-1806-4c75-a001-d2928183e62f", "value": "cdb89d06acbf33fe63e959d08b059ce7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8448ffc-36e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606619, "uuid": "240f14f1-cf3d-4755-9100-f4987ad9cea0", "comment": "Malware payload (Mirai)", "value": "aec820ca9b53037437d7cf04ff13c765", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606619, "uuid": "49d7596a-2764-4204-84cb-e0ae9aaeefee", "comment": "Malware payload (Mirai)", "value": "659cb6ed401b3452b449dc9f8a40802fc3b61d0ea13ff5de48c1fbc9fcc9c187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606619, "uuid": "1fbbd08d-b086-4ee7-8023-96ce8e984d01", "comment": "Malware payload (Mirai)", "value": "72a6d7ced56e95e7049e06fb1bec2a80dc15151e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606619, "uuid": "07e406c2-1e6f-4a57-b516-c0cc306a6f00", "comment": "Malware payload (Mirai)", "value": "93421dfe3a35bb6ac0ea3fbfece2e84084aa95cd1d10ccc868babfd6028704c191fe8080fd58098bc06252bd06479464", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606619, "uuid": "f0ab77c0-8001-47f0-8d88-346a5fb9a39c", "value": "T15F536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606619, "uuid": "8b6b6759-0453-42d1-bceb-8901ed4c5c9b", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA8E:p5ofF8I9cKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606619, "uuid": "645c1c28-abc9-4406-b373-f92a6e48ff7a", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606619, "uuid": "33c1040c-551f-46ec-9d5e-9b8d2ea870c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606619, "uuid": "7be224b3-139e-415c-a0ef-b16775e28ff6", "value": "aec820ca9b53037437d7cf04ff13c765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fcd61b-3705-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691620554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620554, "uuid": "909304b0-7d85-4ec1-bb69-9203ded27183", "comment": "Malware payload (Mirai)", "value": "d0144c78319933d9f3f2d050bf946aa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620554, "uuid": "215795b1-ec3d-4327-bd62-488eeb2335a8", "comment": "Malware payload (Mirai)", "value": "660aaf788fb9a3dc7e560e34c9aa8b0d91f1f35b4b8b745fba12435021712104", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620554, "uuid": "3dd3ab81-2e2b-4a09-8840-fc095de46c74", "comment": "Malware payload (Mirai)", "value": "4e536ad3d57856c8ee7f8deb6766e41af3493060", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620554, "uuid": "e357251c-fac0-4542-8ac3-4ad09c1759ec", "comment": "Malware payload (Mirai)", "value": "4b02729ef3e2feb4c45ecd86e24efad4be79c16ba12b3073239f6763f95147bfb75475e81cf0611474b0fa3efc813196", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620554, "uuid": "be57e1ad-5078-42b6-b14a-3abb6c3a2ceb", "value": "T11753E681B8819A17C5E412BBFA6E018D373563F8D1DF3216CD226F6476C982F0DA7792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620554, "uuid": "ca33484d-c2d2-4436-b8e0-39db517ee9ee", "value": "1536:PjZTH0sjiwKJ0I0MNSksKYrbIlG9WQ5sAdKbd42+:Pj5PZnrb8G9n5JdK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691620554, "uuid": "08892fb6-6bdd-42ef-b6c4-ad7ccebce5b5", "value": 64396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691620554, "uuid": "75c136d4-391f-4aa1-9755-f33f985d47f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620554, "uuid": "c851d59d-945c-4b00-9d85-f7008bcef15e", "value": "d0144c78319933d9f3f2d050bf946aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39726718-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571644, "uuid": "c6178a10-5aac-4692-bfc2-7e80e53088c1", "comment": "Malware payload (Amadey)", "value": "dbea63b745fb99b2ab38ebec98da66b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571644, "uuid": "ff8f098f-d400-4152-b3fd-24f61f7a8124", "comment": "Malware payload (Amadey)", "value": "66b4e06b9aca7cf7a5f212d9e29f282a45a95d895a9b413343f82d340c14f12a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571644, "uuid": "6812a5bc-788a-4d1f-9875-5e17e38d6ebe", "comment": "Malware payload (Amadey)", "value": "50ddb387bead53ed880d4ff087dd14fea51f61cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571644, "uuid": "857071af-80f2-4692-a11d-64f172f8dc05", "comment": "Malware payload (Amadey)", "value": "7b4608c4f6102e27374ea068362504205c5acb994d9274b4d132bdabd66ae0310b482ef95b662fbb4789ad3f0e677ebf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571644, "uuid": "1535140a-4f0a-463d-98ca-df17a03120c6", "value": "T1F4C41206A6E84072E8F1677059FB03C31B3AFDF14D79872B2786696A4CB22D4583177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571644, "uuid": "49bdbf1f-b07a-409e-9cc9-12eb0303b8e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571644, "uuid": "9a79193c-a3ff-4677-a5f1-98b562adf047", "value": "12288:OMr5y90PbBlJhzPXJV50agBYCuQe+sl4R9q4:Dyc1FSpzel4R9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571644, "uuid": "7c381a84-7a80-4b04-b993-96029d326504", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571644, "uuid": "11365de4-4a04-4dc2-9575-8fe0ce6a95d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571644, "uuid": "2b800ac3-2130-42b2-bfdf-49a5263fda1f", "value": "dbea63b745fb99b2ab38ebec98da66b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa77c914-36ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691583430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583430, "uuid": "e17d3e61-875f-46ba-a573-84707cd3bee5", "comment": "Malware payload (Mirai)", "value": "464a340be2d661004b69bba67d6f4933", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583430, "uuid": "ad8265a9-551a-494b-b26f-b9bac8668f1e", "comment": "Malware payload (Mirai)", "value": "66bddf6f619fc1ea7fb73fafd823eed9333ee724fb1934556114a65df213f731", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583430, "uuid": "28a6cbba-be34-4eb6-88df-3710199e7b8c", "comment": "Malware payload (Mirai)", "value": "75a6b1eee006e36fc726ad7d56b2f669a46ab765", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583430, "uuid": "5fbc0b59-cefc-47df-a071-714fbe287c11", "comment": "Malware payload (Mirai)", "value": "f9af05ae0da504494edd59af781ad021927c720b4f561e3677d12a1ef06088e43957d3e56c728f335088ee75e7673035", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583430, "uuid": "104667ac-a1fa-4b73-baf9-bdadecee2886", "value": "T178535C02B7584E0BFAE61AF5343F1BD483AEED8025E4B585A90FD7464235F33459AE8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583430, "uuid": "c33103f6-ce83-4f76-9b47-5f98e19f9dea", "value": "768:epni/131WU8gTTl1LVIlnhpA5WE4usllk5Mb7NcC9ykOBHW2MT3src84SDAVO14C:j93dl1oAALk5oz4N7dDf1Ki7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583430, "uuid": "3bcd1bd7-19a2-46ab-99e3-ebbf10767be7", "value": 64180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583430, "uuid": "9e12defc-1e85-4cd9-9b8b-dbaf9dbee18b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583430, "uuid": "ace6294f-8efc-4c1f-b866-fa3522284b63", "value": "464a340be2d661004b69bba67d6f4933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84998668-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691599688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599688, "uuid": "525eb848-cbaa-4021-920a-f78563a6799f", "comment": "Malware payload (SnakeKeylogger)", "value": "adb993eff9ba1e824e93392fb01d5f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599688, "uuid": "5e9f0524-9120-41c6-9a5e-3eac51ad7376", "comment": "Malware payload (SnakeKeylogger)", "value": "68cd899c048a9b097d438260f9a92513b6cc42fc203c8126df2bb35b86c50671", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599688, "uuid": "135ac52d-0e42-43f5-9ab2-3ec0f19c7e42", "comment": "Malware payload (SnakeKeylogger)", "value": "e6a30a0ff0175ac10f3a81afe7d5178be332dc09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599688, "uuid": "83b2a923-7428-4990-b9aa-008f33efef0f", "comment": "Malware payload (SnakeKeylogger)", "value": "fbf3d32221d16268b2bf5820cdd0d2186ceb58b8408f2c1b04f7781fc902c3f10e53fbed92da20afc4785b1a087e9ff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599688, "uuid": "bc2ebb9a-e15a-4347-ab1d-982ec6657304", "value": "T1BC846D81F3449A6AEC1623F1D836C92106BFBD699437C61E25CB72A95EB334314A7D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599688, "uuid": "b37181bb-5e5d-41e4-a194-13c3ed088a66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599688, "uuid": "00aa77bb-e5ed-4173-a9d0-f9e0b238691c", "value": "6144:4/Al8AicJkF2BKad8oKMslp2TN7KjhhiO7wK+sW4xO93kZ:4/Al8AicyJiN+hiCzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599688, "uuid": "bd5db3b6-6ed5-4236-97cc-285f734d9b4e", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599688, "uuid": "1e5dc022-2159-4c94-9478-da9f07e92fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599688, "uuid": "7f4a2d4e-1cbe-43d8-8c54-b32cd10795be", "value": "adb993eff9ba1e824e93392fb01d5f05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eece290-36d8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691601369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601369, "uuid": "39915eb0-476d-4885-bf36-292b7c13abdc", "comment": "Malware payload (RedLineStealer)", "value": "605fe312cfa3a6adb3dcd14fa7062b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601369, "uuid": "48ca9069-3f9a-4b61-8c72-dea81b45f159", "comment": "Malware payload (RedLineStealer)", "value": "690206b7cf8cb74aa8c1d253d94e5fc8d9ca8944e433aa9302e092c028fcc0fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601369, "uuid": "ed536258-bb81-4ea9-9741-f7c61ac98504", "comment": "Malware payload (RedLineStealer)", "value": "7f92404e36769a16b1f34bce69de1bcf5a070edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601369, "uuid": "3988bc9f-e9b5-4d83-b51d-7b70784a6ed6", "comment": "Malware payload (RedLineStealer)", "value": "4926a7987b670dc0291fb492d4d03059c0f8a9186aad5f0ecba9cd90ee0eabbe90408b66b4421b91ea4e465667e1a137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601369, "uuid": "d9a81e9d-d2ad-4f1e-9b31-a15d7f867820", "value": "T139940120B562D0B2C99B84755C34CF60AEBFBB3255708A4B3795177F5E303D08BA6B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601369, "uuid": "8af43f08-c1e0-4161-82a0-fba16af44043", "value": "21e75c39e5b8b26ccac618e4f1755b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601369, "uuid": "92e141e7-184b-4757-a44c-562202e06fc9", "value": "6144:IRZzQcLpOmZAXmiXQSNQyuS8RJnUu1kbbX4NJU+ct5iz8SR7K:IRj1ZAX/Tub+u1kapX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691601369, "uuid": "01ce479c-364f-4540-8092-147f4a6c6819", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691601369, "uuid": "4b4a78ff-4a96-47ea-a286-a8318336ac81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601369, "uuid": "fe745942-a01c-4167-9578-c8e111ba01b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09f8e66-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602848, "uuid": "09c4213b-513c-4192-b2f4-15311c813337", "comment": "Malware payload", "value": "29db88e325ae5e1689130f70dedb46d4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602848, "uuid": "139743ec-abab-4839-a261-74888758a3f5", "comment": "Malware payload", "value": "6a6dbd968531e4acd0e5a66f3429280c4c96dc6b73cd5e0dfd68ac39a5187015", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602848, "uuid": "a4f76780-fcdb-4792-a700-4adfbdfb65fd", "comment": "Malware payload", "value": "7e84aea44237ea3e55d7b6ecb042f61e65d92098", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602848, "uuid": "39b49a2e-96d1-41c3-baca-07f30bc7c98d", "comment": "Malware payload", "value": "4a97f8b37af3a91fb57432e8a821774061991d0097db233cadf87e63e6c21177a64240f07de94f67ff047f0bf6255e5d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602848, "uuid": "0eb8ec1b-bb3f-422b-9d8a-519547972bb7", "value": "T1A2E423CC881BDA9DFA52A9F607D5EB073C422685320E75019FE9C38E6CA339A7C5458D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602848, "uuid": "104af7d5-afc5-4e2b-b8a4-120f3b475703", "value": "12288:T/uXJs2gh0gDauILz7Ki7JJrio4miUM1Nu0CAbSr8ZOzQeBSElN4i/SOa7ckv5KQ:T/uXJ5gh0OauW1JriqgGK4Qk6ySlhKDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602848, "uuid": "ac14b3f4-7a39-49b2-97b5-92b9e3e83ec5", "value": 688656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602848, "uuid": "94fc6108-f0e2-4d61-9a60-49becbb929c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602848, "uuid": "52114afd-5888-469d-8276-d74e1f37207b", "value": "Yeni sipari\u015f _TR-59647-WJO-008.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab6e346-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602865, "uuid": "9f659a19-ee0a-47fd-9895-83372b81012e", "comment": "Malware payload", "value": "1d5b13e8e1e6c90f96ccbd9642f254be", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602865, "uuid": "284edd60-651d-4f95-bb99-36abd23ea331", "comment": "Malware payload", "value": "6b5ffd475ed1287a9ce3eb7bb71a2f3c6bf680914166c36c2daaa9eb11f06f01", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602865, "uuid": "3c5fc4c9-911a-4d9b-a1b5-35cd6cee856d", "comment": "Malware payload", "value": "7cb249e588bc141980f035fb57ed42e6f8dad4b1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602865, "uuid": "b01df6c5-4f88-47b4-bbc4-d4d7983b607d", "comment": "Malware payload", "value": "5610cb4bd61064219f7b0e92a17f717df3406fee43259237afd8d67ae110806342fa296c0e2543ecd1b0a26a767d0371", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602865, "uuid": "2c5a945a-ad7c-4329-ab67-b35271679d46", "value": "T107F4332C5271439D19F325E2BAC2B91E9F2401B029641D909F3EE947F497E33DBCB869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602865, "uuid": "c467c410-3d41-476c-8141-3d9b759a0ccc", "value": "12288:mCLvBYIL/QcQ1VDcOFQSVkBPNbmpSVGzd4KVvJ1m0DGW4VuSKxA84c3uA2MtoK:m6/QbDDFFrKP9Wjd32qGd8p4HAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602865, "uuid": "5be752c8-2028-4bf9-aa7e-257e178d9017", "value": 745732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602865, "uuid": "bb5b4402-b97f-4930-b17b-2534b963f3a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602865, "uuid": "81621c4c-499f-4af2-905f-e5fa9801b8df", "value": "comprobante_008.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481cabbb-3679-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691560502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691560502, "uuid": "64e104a7-c567-4afe-a689-34b2d559d47a", "comment": "Malware payload (AgentTesla)", "value": "86588b34f68fad2817ac9c8b7eee8568", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691560502, "uuid": "460fce80-605b-4a5a-987f-f929fa99be14", "comment": "Malware payload (AgentTesla)", "value": "6b62a57ec7a1e73957db53f846dd364108781a6464d4d800470c2c6d17614115", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691560502, "uuid": "8bc44744-8532-4617-9472-d96e619283c8", "comment": "Malware payload (AgentTesla)", "value": "59aa9c71fe3421e2134e57ce6ac0d67034ff9d1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691560502, "uuid": "0e3f6a28-e44c-4e18-a817-2c72559617d0", "comment": "Malware payload (AgentTesla)", "value": "ec08fc38f24bfb06dfedc3aaa606bf8e0c964cdb08ac96f4d5b9651d669873e0b667cfc47a8b1eb888e110e244368888", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691560502, "uuid": "21e80be5-5f44-48dd-bd11-30e2e8a48116", "value": "T16A63252DC34F0169CF124377AB2A4A1542FCB73EB29552A1346C537433EEC3DA2662B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691560502, "uuid": "a0834d6e-38ec-41c0-a5cb-213e1adfe33d", "value": "768:2wAbZSibMX9gRWjCaO2Onc/itLwlbUsGJt6y9K:2wAlRW3Oc/itLcUptXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691560502, "uuid": "a5c3ebab-efeb-40a4-a319-cd7ad8ed1449", "value": 70664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691560502, "uuid": "2a6d6a1c-1a97-4ec0-a331-bb23aa664642", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691560502, "uuid": "0c14a315-8219-4907-911e-497eb7c2b052", "value": "86588b34f68fad2817ac9c8b7eee8568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80297474-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691583789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583789, "uuid": "3b38125b-eca7-44fa-a86a-2b35dd0bd098", "comment": "Malware payload (GuLoader)", "value": "1dca92f621f119d5ff8f3c3f54ca77cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583789, "uuid": "da38ebd3-3180-4ec5-8cf5-0a742e0906df", "comment": "Malware payload (GuLoader)", "value": "6b91613f78377d180e0385169b9582636dabd880e7e956b2d42495d1b627e7ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583789, "uuid": "fb3c9b8e-610c-450e-aa77-d8148f53f935", "comment": "Malware payload (GuLoader)", "value": "ae78cf63bece66ba97fedbfa9f3a0f935739d54e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583789, "uuid": "88f139b9-9ee0-4a4e-a562-392e83cbf5a7", "comment": "Malware payload (GuLoader)", "value": "374d09c316ea6fb5eff17350e6d6770f94788cbc581bf66ce5572ab50df66d8ada1cc7e63859a57eea033f85d19fb30a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583789, "uuid": "285665e3-8a07-4fe2-ab34-e0b662659eb2", "value": "T13EA4F1A0F3958CDAD86C53758873FE172066ED69ACB14A0F11AE77E86E73383105784B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583789, "uuid": "b50cc6a9-312c-4b1f-853f-8241add6e363", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583789, "uuid": "5af35313-1fe7-421d-8e63-0ed6a8aabad4", "value": "6144:flgvTRHybTTgNYUqEyobcc1SbRATT7imFqJXWAxi5n1YLLUUyfipeDOhbn43JkSP:92wgNYGbc9RA+mFqJQ0IfeeD7CSi3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583789, "uuid": "1401beeb-7640-49f9-bb32-2dcfea4cb76e", "value": 477552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583789, "uuid": "e3124315-5a7c-488e-b48b-3dbb63aa1d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583789, "uuid": "b1055f56-bc2e-4b5b-853c-572b0045a8f3", "value": "inquiry 0093848831 xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2949f467-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623586, "uuid": "5c1649a0-bf64-4eb9-acaf-65bec3ac1020", "comment": "Malware payload (RedLineStealer)", "value": "167a4a2edb6d4268f2f93977f38bad9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623586, "uuid": "3d74936c-fabf-4f0d-b12d-84ba5da45718", "comment": "Malware payload (RedLineStealer)", "value": "6ba681d472699426012d8bde5b0e2d5cefc40c4336202f53914a351a61c3393e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623586, "uuid": "7a17d3cc-a3c7-4c4e-bd37-623aa274da16", "comment": "Malware payload (RedLineStealer)", "value": "8d77d8b9c292b8d0ff5f086671321025d3c4d788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623586, "uuid": "4d90bc21-bf84-49b6-852a-ac25b27c1d03", "comment": "Malware payload (RedLineStealer)", "value": "04007975598b2ac96ffe7e00d9262f86dda35f10c982f908dcbb3ed8d7f4bd780c3764d43989d727f320ecd1ab21cec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623586, "uuid": "e7e3a45f-7edb-4fa7-aa14-476bb7f4fdc3", "value": "T169C41243B6E84072D9B527B045F613D30B36BDA15CB8C3AB2744A96B1CB36C4B57237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623586, "uuid": "475fa80c-1623-420f-97a1-62cfb2ef7a6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623586, "uuid": "b0f799b3-f57b-4a12-a12d-e9f447de7471", "value": "12288:5Mryy90Zpj1/EOnrxHHXzcTQOlQ/gBYCniRqy3bW1BY2MXzGky4:byypj1/EOtHHDq3lQ4zEIxky4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623586, "uuid": "df680a68-e464-4fae-9587-cb6e71627c0f", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623586, "uuid": "7177fab9-2f98-44d6-9ccc-4b2205745f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623586, "uuid": "91e58689-42b5-4ce6-b903-0f76e5d83fc9", "value": "6ba681d472699426012d8bde5b0e2d5cefc40c4336202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e664dde0-369e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691576659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576659, "uuid": "cade1b93-3826-4f9b-8819-e971e1204d94", "comment": "Malware payload (Formbook)", "value": "0f2757b784b5bd4aeafef8748a4d1327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576659, "uuid": "6a8e47b8-784d-4ee5-aade-cbc5732c1c0e", "comment": "Malware payload (Formbook)", "value": "6c4adad8e0d6b38d395fcd69b65d45b000b898bd73067d580a93cb6c26d92331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576659, "uuid": "43edf023-4109-4374-8e8e-01417f2875d6", "comment": "Malware payload (Formbook)", "value": "ba23c0412b24ab866c95c73fd8b05366a1bd923e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576659, "uuid": "6d480c18-b4df-4c27-9bf8-b387d15c04ed", "comment": "Malware payload (Formbook)", "value": "149e5d941be78e2f3ef739bc514d7feff29c97400a7e54ca68e51e8f1b52735227b6f8beb05cd8f01427ec8fa6541329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576659, "uuid": "f1f2ba10-b9e8-430a-959e-402c58bca848", "value": "T175D422445E999D27D85F3BF60002B6F683754AD8B91AC69BCC0EF0A5AE7734E8E50703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576659, "uuid": "96cdda7b-e036-4414-ad5d-427f4c085ee3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576659, "uuid": "c8f80938-cda7-458e-8b2f-8df456da0d54", "value": "12288:umAY2kcdbL4Efw+tpHM7LlQGllkrALicoV9pL5cNfFwO9soa3/:XN6GEf9fHIlRjkrai5V9MfFwcsoav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576659, "uuid": "e5496741-97f5-445f-8025-37ecbb58267d", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576659, "uuid": "6833a889-3fd1-4272-bc9c-4d1a57e87d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576659, "uuid": "25512341-37b4-4922-ae6e-d9b0293e3f43", "value": "6c4adad8e0d6b38d395fcd69b65d45b000b898bd73067d580a93cb6c26d92331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4727ff8c-3696-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691572956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572956, "uuid": "c484db4d-9619-4aef-b158-75285c08fb2b", "comment": "Malware payload (Formbook)", "value": "bc36cbac9941445da0337d8afc09d8b5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572956, "uuid": "babd2afe-9ec6-4320-a710-6331f95be8cc", "comment": "Malware payload (Formbook)", "value": "6c4f47d89d91e7aa5de46046a33056e09a2a5c6455e668a6708fdecefe1db9a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572956, "uuid": "f1bcb505-76e2-4df8-a9bd-0386d3427fb9", "comment": "Malware payload (Formbook)", "value": "0f7257e02cdc8f193491d1100798b317044d1d52", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572956, "uuid": "a5852dd6-65b9-451e-b3ea-5d47dcd2a996", "comment": "Malware payload (Formbook)", "value": "6bb9cee6bf56f7d0feeab27c2bd2892fb63885512adf3f61db39cb3c998b8b720bf0c07be49bad87020ebb6f12168925", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572956, "uuid": "d771a559-b468-467f-8531-13de161ee968", "value": "T11934CD7091F26AC9F896CEB29E61E609FFE70C819951421FE17839F61233B84C6451FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572956, "uuid": "8af952f7-ff43-415a-9a12-ae86e94f0d4f", "value": "768:sHatbrd+uZj3ViIisLk35bQzQ95snIIIIIIIIIZnIII2nIIIZnIIINsHIIILHIIz:Qa5R1ZjhGIBOrPaOYdSkjiRNqOP3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572956, "uuid": "11ba4557-bfed-44d1-9b59-03f1e5188a62", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572956, "uuid": "b6f4c132-59cf-4d75-9938-340af797637a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572956, "uuid": "137b66b2-2dc7-4acf-a35d-dbcdb1ebe807", "value": "Befehl.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e558f3f8-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602856, "uuid": "20088fd8-5e8c-4982-b267-d456a40a2b52", "comment": "Malware payload", "value": "36cf5c495f1196fe1d037f06869b1f30", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602856, "uuid": "655e8eed-aa65-456f-9e25-1b6c05f2edf5", "comment": "Malware payload", "value": "6c7f6bd9d05bcacce7c0821b3d25f41cc96632d6febd0bcbd460c134df739f9c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602856, "uuid": "ecf4c2e8-35b3-45e3-8f34-c16303e2fae3", "comment": "Malware payload", "value": "a35f55c1d53b41424905cf7f061c5950ec21e653", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602856, "uuid": "f1f1f718-d9d6-4e01-82c0-e975b2a6075b", "comment": "Malware payload", "value": "dca87ef782df26b0adb2623939bdd836648d26b4709b45357d9f0ceb5cd87fc0bdce933cc9687814022533665bd15e38", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602856, "uuid": "afdafb56-4ccd-49b3-9923-7a81a17e9e15", "value": "T19DE4236C54538F6BEC3C4035B01F3281DEF7A9F618948712B1D9788645A507E2B0EBAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602856, "uuid": "5e69033d-5bdc-4e1e-8971-b44c82ce60d0", "value": "12288:OEnWEPt1rC9V1bkoN16yIGiAt2/56rxUNXqfXF0jcUHSbgZofD82aKvSLa:T/D7ofKEt2stc6F0BMg6fD84vSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602856, "uuid": "b78fe4f3-6577-4294-b644-14b364b2ed28", "value": 709754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602856, "uuid": "75f955a2-5c0e-4bfe-8aa5-48e0d316f499", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602856, "uuid": "69dac643-a796-405a-bd1c-d5518c3b60eb", "value": "Invoice.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738671be-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (zgRAT)", "timestamp": 1691559286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559286, "uuid": "7a7a54c7-d725-48d3-9f84-37f7bffcfc36", "comment": "Malware payload (zgRAT)", "value": "d41a3af7fd24c5fcd33c83d09cd998cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559286, "uuid": "bc1cdd46-92d2-49dc-8bd1-345427e503a0", "comment": "Malware payload (zgRAT)", "value": "6ca0ed133471b321bb4ebccf23b95470d6499f6614d93db6929cfa88fbfa7758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559286, "uuid": "1ee8b436-eb5d-421c-ab50-57ba2e9229d5", "comment": "Malware payload (zgRAT)", "value": "5b0c7d126d508aed5bf7fb837d005167fb338100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559286, "uuid": "5511cc26-85f7-4b96-bd56-65b6876ebdbf", "comment": "Malware payload (zgRAT)", "value": "1439196e68556ea950a950772908ef36e6908025250a83b28f929d10e83d735ed0acc7c010ffcc364d487bd7d114a168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559286, "uuid": "14de5dc6-e3b4-4691-83ea-ad4b430a35ae", "value": "T1E3F22A049389597FCBAD48389493A10C23B6D66B6452FF4E2FDED4E0A8533CCA5643E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559286, "uuid": "6fb253f2-8204-4135-85ee-5f078df605ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559286, "uuid": "c1dfa115-80eb-43ae-80af-704d0926308a", "value": "768:0akl/pCitQFpMlSn/j2O0Cl7ZTtj6sGMK0rFHdjdCQ1s0HC+6mSmptRNZlSnnP7K:0LNtQ4y/j2O0Cl7ZTtj6sGMK0rFHdjdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559286, "uuid": "9db87ebc-8d7a-49c5-b4fc-9fa04590a7dc", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559286, "uuid": "c7dce13b-0041-40d5-a656-1cb72221342d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559286, "uuid": "eb7a5a3c-5cd2-4cdc-9fcf-2e3caa744d78", "value": "Factura Pagadas al Vencimiento_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c004df-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691574965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574965, "uuid": "a63cfc83-8a20-4352-8f06-53902824f741", "comment": "Malware payload (Gafgyt)", "value": "e5fcc2b09924bfc970b8ef780ec31012", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574965, "uuid": "492cb195-dd44-47dc-b210-0190c6cf9a9c", "comment": "Malware payload (Gafgyt)", "value": "6cc1798c49d346c7e87bd1dd24d991dcaf35d8614273115d57ca59cc2f45bb32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574965, "uuid": "4ee79aac-99d1-4c42-9f92-ab31f0bb5ecb", "comment": "Malware payload (Gafgyt)", "value": "660387a9eea7d32b04cbb84f25d587c339a7c7fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574965, "uuid": "8126d2bf-5236-4a37-8677-e4e058e35334", "comment": "Malware payload (Gafgyt)", "value": "98fd54eb53cd847079f6dd3e6445c3b7de54d8e0f20deed0c1ce876ae738dd8e46aeb7ff68f9d146f633e8809e32e857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574965, "uuid": "3e40c2a8-50c8-4bee-9d3d-f50705fabfc2", "value": "T1AA247463D62548A5E11888F121A732909E86537FC8EF31C3F92A1D90FEB599B117BFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574965, "uuid": "2521f808-c3c7-40cc-a0c9-ccb487b5f74c", "value": "1536:fA4EqvqlzPpgW0I5XIKhKMOFG1OWXzj8+mCQJX6NF3vvf6hreF:Y4NS9uW0mXvhB1O+mLK33yhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574965, "uuid": "5b1c1c0d-900d-4218-9224-17c33f09e99e", "value": 221576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574965, "uuid": "2486db79-a5a9-428a-8db5-7f1dc14fb473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574965, "uuid": "dd0f310f-6d9e-4032-82b2-e082412b6a84", "value": "e5fcc2b09924bfc970b8ef780ec31012", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87af5a7-369e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691576689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576689, "uuid": "ca3314ab-cd50-49fd-8b1f-d12070a50466", "comment": "Malware payload (GuLoader)", "value": "847dab92c51f863adda217e425e01b13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576689, "uuid": "a4b95c57-c450-477d-b5d1-40f555dea2aa", "comment": "Malware payload (GuLoader)", "value": "6dcb111567598ac2931058e72acbfd03eb47e11b21a32738f846de0e42732ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576689, "uuid": "11b06ece-9c4a-4c43-8285-5e21c7eb07aa", "comment": "Malware payload (GuLoader)", "value": "b850a0ebd45c4861a83899bc3e67bde973fc75d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576689, "uuid": "d82e97ee-a5df-4ddd-b102-d0f32bdcdd11", "comment": "Malware payload (GuLoader)", "value": "cb1143dfdcbf331c27099a60fd8b84561a6e81d621914ff507932a8d8776f2c1bc089f15d4040b678ab13fd198e37620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576689, "uuid": "47e0f056-a0a1-4607-b3c4-c8f93632206c", "value": "T10D74E030B6457463C61236BF69CAD99266E06C039DCE075F3B4C636EDCBA1D18D2BA4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576689, "uuid": "bd03c2fb-a4f7-435d-9a67-a12286ffa170", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576689, "uuid": "41f7a55d-a507-40eb-8e04-dd42bcc84660", "value": "6144:iaof4q7bBHc4P8gMtfL90fhd7Jqp7zmIJPmgM+8:iwGFdMtz9SOzzPmgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576689, "uuid": "6af28ce7-cfb9-45c2-8afe-9d3638887a05", "value": 365312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576689, "uuid": "a90da4a4-1bb8-48aa-8cab-b53654382a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576689, "uuid": "0be58998-b944-4536-a8c6-585e9a6163e8", "value": "6dcb111567598ac2931058e72acbfd03eb47e11b21a32738f846de0e42732ac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384b0792-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571642, "uuid": "1cdad081-f371-43bd-a6d5-2c1617e8e022", "comment": "Malware payload (RedLineStealer)", "value": "344bfcd8cb3abe479d3914ca38a86912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571642, "uuid": "13fc0979-38be-4994-9e4c-8bc0537a5da0", "comment": "Malware payload (RedLineStealer)", "value": "6de881fde7389d9e5cff47f74bb234d4916ede670069fddf40e04ebbbd94745f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571642, "uuid": "909c7bdd-af22-41ed-b7d3-308d25883147", "comment": "Malware payload (RedLineStealer)", "value": "a60badd19837f9270b82c27f3b7c129ffbe72738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571642, "uuid": "e089c32a-451d-4325-93e4-92e7237f3147", "comment": "Malware payload (RedLineStealer)", "value": "6bfd9ac344b85aa0646815fd9e44a35eb8c4d98ba36a9b6ff85f30efe4c1f993a409bfe9e10f5ba35dabc9731b4e9207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571642, "uuid": "0199ded3-8a35-4513-8667-810d709cf5ee", "value": "T15DC41223ABDC8173D8B497B044F613930B36BCA15DB987762746A96A4D335E4B832733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571642, "uuid": "9d8ffe0e-29a4-4b24-98b7-418edb3a9b37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571642, "uuid": "4ddb2e76-d187-4922-9024-48a1b2429722", "value": "12288:PMrBy90NT+mPt2Ft5D5FyVfeTugBYCWEAEAKX6P9b:6yISmVg5YfeTtzTAKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571642, "uuid": "de0070d7-55e5-4862-8206-8b33b95b33ba", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571642, "uuid": "68a60b64-db51-4500-9cb4-8b5d443fe0f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571642, "uuid": "485ab33b-3587-416e-9afa-4153c203f2d7", "value": "344bfcd8cb3abe479d3914ca38a86912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceae5d0f-36a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691580055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580055, "uuid": "e688acfc-1afd-466c-97ee-f542742a4acd", "comment": "Malware payload (RedLineStealer)", "value": "76060f7548fa2f179e7e51df78ae8754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580055, "uuid": "8c12a762-f609-4e1f-b0a5-12dbd50cba50", "comment": "Malware payload (RedLineStealer)", "value": "6fc6896da541bbd7b22b122c8a0cf806c0825c4e674b1e8a635b6b7006cfdd2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580055, "uuid": "ea8c3203-9adb-4bfd-8c44-40dfe3c241c2", "comment": "Malware payload (RedLineStealer)", "value": "d37f5dd7d0ff343a916583dae6abc552ba280739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580055, "uuid": "c6cdf74e-9277-4a24-8380-7a03cb25025c", "comment": "Malware payload (RedLineStealer)", "value": "d72fde1334a9e218e1bb91a599a47c32d3f8ef26fd8ae585b41e804466d3d08a9d05f16cddb450a3b79b1b4c98fa44ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580055, "uuid": "91393a93-52ec-4589-b343-dd9b62527f87", "value": "T1E9C4124BA7C98172DCB1277008F706931B367C928C79936B6741E94E09B22D4BA7673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580055, "uuid": "ee415fb9-565f-4be8-b4a0-8fa247e91b3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580055, "uuid": "d6fc0343-a306-4c64-8994-50c7279f1ca1", "value": "12288:zMr2y90zbxwAs69eXYDDnxRWQSVkzNP+gBYCtVUmHFPd:xyMbeAstkbWQkuldzUid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580055, "uuid": "cca280b5-ebda-4c64-a8b0-8be7b1f9f4dd", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580055, "uuid": "37538b55-a5dc-4da4-8fc5-a3174722ddde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580055, "uuid": "ae2588d1-cace-4974-b5d6-8d835fb9a745", "value": "76060f7548fa2f179e7e51df78ae8754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36960e38-3659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (N-W0rm)", "timestamp": 1691546729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691546729, "uuid": "0b5a0c23-0a5f-4c9d-929a-d8c23a338323", "comment": "Malware payload (N-W0rm)", "value": "a9fbcacb2a62569888063fed2fb9b863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691546729, "uuid": "61c2cf55-514c-4d44-9d79-c5604b0c0911", "comment": "Malware payload (N-W0rm)", "value": "7034324a1226bb831130c09a09337594d0e442178fb580618d009bbdb8708a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691546729, "uuid": "5c2cf101-6991-46ab-8340-bd472f345c36", "comment": "Malware payload (N-W0rm)", "value": "21bca7e29ae7b8d166cfd1df2f8cff200efafeb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691546729, "uuid": "6c771452-7fc7-426d-aea8-f02662ae056b", "comment": "Malware payload (N-W0rm)", "value": "c26b810a82ba838e7fe2a727c8fe62c690a73cf295de5376e70ffa905c591733e37d701d578d2a73f3e7f5365b976a26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691546729, "uuid": "49e27a84-76df-4f2a-ab3c-fcbae1b9b2b7", "value": "T142852289D21ADA6BF6391877C0F2CD86F539956E650D82FA3E4C513ADB401A301CFE4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691546729, "uuid": "513c75f7-8eb4-450b-bf90-5e253b89dc7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691546729, "uuid": "44406515-1bca-4b83-98f3-3d4c6353e31c", "value": "49152:Y0Z4ZiFe1t61m4tR7j7JmHuiicyE5q5naLF8Kh:po2W61me8YIM5i/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691546729, "uuid": "9b07cd4f-9f9c-43f5-b2d5-3ddafe120470", "value": 1782272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691546729, "uuid": "f867cfe4-69ea-432d-b083-1e7b30646f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691546729, "uuid": "e5a757f1-ac00-40f4-9034-ba81bdac4aa0", "value": "a9fbcacb2a62569888063fed2fb9b863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd6aca4-36a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691578252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691578252, "uuid": "587202b9-5fab-414a-9973-fe6564047ac7", "comment": "Malware payload (RedLineStealer)", "value": "68a08a1eed81c8c6d2845e7d9f8c9177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691578252, "uuid": "311dbbc3-63b7-4f27-bfb0-4cc36de7d6e7", "comment": "Malware payload (RedLineStealer)", "value": "703a4154be9f681c1d4083a983f963f8c1eb7f92b965ce0ce098718b0c284f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691578252, "uuid": "349043df-0af2-4f81-ac76-8a7ca2d38151", "comment": "Malware payload (RedLineStealer)", "value": "3c9ee1237c55a42eb5f154acf67a5dba83aef8be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691578252, "uuid": "42b5c7ae-dfc1-4f47-b8b2-217f73075b0d", "comment": "Malware payload (RedLineStealer)", "value": "6a89fdb46ab940547133902ac6dc4efc6d221a2bf5860d9b2f86f1c6f76bc9776a8110081ff5a3b3a5099618bef2a8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691578252, "uuid": "2c61d115-b290-43ee-8ec6-796a48a495c2", "value": "T134C41203ABEC8032E9F52B701CF613970F3A7DA16E7442A72745994E0DB3694A87573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691578252, "uuid": "007aa915-8d00-4880-94bf-f03af63c762e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691578252, "uuid": "4a1e52c1-1645-4b32-a1c1-34ac9a76d7dc", "value": "12288:kMroy90AmjNMWPZFm7Nld/wp5SJBNHhguF3D8P0i:8yPmjNzRFmpxBgsgsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691578252, "uuid": "5e86f69d-ce3d-43a8-b130-27fb70f85b93", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691578252, "uuid": "5c49d91e-35e5-4660-9bfa-08813b7abcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691578252, "uuid": "c9ff32fa-31ad-430a-826b-f0af795a7f75", "value": "68a08a1eed81c8c6d2845e7d9f8c9177.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662c64db-367f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1691563129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563129, "uuid": "91fb9e53-8f9f-4742-873c-554c4d940f9b", "comment": "Malware payload (Cobalt Strike)", "value": "e33ef1ece2038f0874d2662147a18637", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563129, "uuid": "3d88546b-0c70-43c5-b0bd-dbeac58154ae", "comment": "Malware payload (Cobalt Strike)", "value": "723427427eaa43fbe3aafce325a18201b65141627181484b2d5f4a1632aabdfb", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563129, "uuid": "b76580ba-97c6-4686-a122-50e6b8f7abb0", "comment": "Malware payload (Cobalt Strike)", "value": "134433a6ee2f6e66581cfa3293b81f2426d476a6", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563129, "uuid": "e238a64f-e745-4738-acae-1c3044d81611", "comment": "Malware payload (Cobalt Strike)", "value": "3f69ffdc8afa187802004bc0fd099712dcba038dc9b7b0456371955e5938fb1955743426eeec4e5b79be7c8b3c0d4ab0", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563129, "uuid": "78d15e1c-2cc9-4f36-b26f-4139216fa64e", "value": "T1CCF48D4E9D77B1BFFB49207BA05E82D1E6561B420A2C8DFF40AAF0340D658715D2A73E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563129, "uuid": "886f3bdf-6e5a-4f04-a1db-96ca61907096", "value": "24fe2f678dd508b74816c233dea97e95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563129, "uuid": "3653ca15-473d-4834-ad9e-81164b8dc5b0", "value": "12288:3YwTnLASvKmugvdYIUPmnqS7dKQqubrv1+opslV0B4+8:3LIgvyxmqS7drR1+opslE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691563129, "uuid": "7819dc73-9d60-47ae-b37d-45ea059281c9", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691563129, "uuid": "75beda08-bbf7-42a6-8b82-e644c81424d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563129, "uuid": "efd6f259-4439-40b0-a70b-b197d1b830a6", "value": "CTjxhc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbaaad5b-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691602786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602786, "uuid": "426936db-e434-4d63-9c13-eda14630f792", "comment": "Malware payload (Formbook)", "value": "7477a7a0c380cdafbdb1b10025a1c514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602786, "uuid": "70b0f55b-1207-45a4-906c-67aaa1f2d2e7", "comment": "Malware payload (Formbook)", "value": "725bd590093b4997559b500248e8a84debbde13ceec846081c78e7ec286a40ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602786, "uuid": "b6864303-44dd-4a4c-b13e-44beb7b248ae", "comment": "Malware payload (Formbook)", "value": "5776114b19f743d969d7b380d76df537b686e504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602786, "uuid": "f6ff833a-9c92-49b3-a649-53684ca4f68d", "comment": "Malware payload (Formbook)", "value": "4caea6a260574012af8e0a3067f5723a24878e177d04a69c31ad8a7846c4b609709defb40ef5cfbd82e11a4cd27d528b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602786, "uuid": "e3ace356-929b-47bb-b789-2b13079336b0", "value": "T19605273C15296A8CF7A486FCB2744CFF17A56D6F80BBF9F3884DA4D306A97D04502662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602786, "uuid": "c77449b5-3132-4a5e-9406-040a61a50bcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602786, "uuid": "78a1d92f-8b44-4754-bef7-b8a13224893d", "value": "24576:MCBqpEO6YTeJl3elejFpQBo+hxED9uNCVn:MnpElJejQD9uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602786, "uuid": "167f3556-f4a8-4259-8644-3c2a56dca02d", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602786, "uuid": "efe2ef17-e12a-4bdd-bb53-b036874c08af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602786, "uuid": "02f66501-aae1-484d-a2e5-b035eb636fae", "value": "ReYeni makine sat?nalma sipari?i.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef0e672-36ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691588350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588350, "uuid": "d503cd36-5b89-4d9d-b81c-a7849c9d2e64", "comment": "Malware payload (AgentTesla)", "value": "ec72886458c8556a11625a19d420db3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588350, "uuid": "707f55ad-3679-4a52-b128-6bb15283dd01", "comment": "Malware payload (AgentTesla)", "value": "72bacbdc8d646e19b79504c879e9efc00e2d3bba427e5873005575db0bdd0c47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588350, "uuid": "a38a1401-fc44-494b-8d54-ad515a6722e1", "comment": "Malware payload (AgentTesla)", "value": "adbcd043c6b913ff13b8151e80314d2ebacffc0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588350, "uuid": "413de6d0-ee4a-45f5-8860-34643ef84790", "comment": "Malware payload (AgentTesla)", "value": "ec5040169aa48b3b560c1e404102685ffd943296ee8d582bc97ef5bb55bb91709684a9c1cc549c366c80c6eb9c231140", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588350, "uuid": "6b7629ac-fce1-46f7-836a-03084306334d", "value": "T1E9254B25E77B654AEF29A5E89E1F847139D6DCC0F1B1C488ABE72C0385C23514E35BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588350, "uuid": "d78600f0-ab4a-4960-a578-e5e9c09c8887", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588350, "uuid": "3fde0844-e2a7-4817-a823-b9db7133f9cf", "value": "24576:W1I1R1I1nRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOYOguQxGHmf6T92:WGvGRRs6CE3jLbO9Rs6CE3jLbOAumGHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691588350, "uuid": "f473b9ac-d05d-45a5-8eaa-9d64160edd53", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691588350, "uuid": "044b0822-11e4-427e-852e-3bf4e2225083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588350, "uuid": "e1a1634e-b236-4c40-a6cd-01d66a6eaa0a", "value": "JULY SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2708dee5-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623582, "uuid": "aa77ad36-9175-4f47-a3f2-bffa8bc27de0", "comment": "Malware payload (RedLineStealer)", "value": "a65b068254e2bb6bd7de06e8e1edd7c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623582, "uuid": "2ea700d1-15f0-4205-9a31-4b2736307f55", "comment": "Malware payload (RedLineStealer)", "value": "72d7eb7c5a2a4a87b583d1bc5537298428030b4d293d9c3fa57208aa98593be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623582, "uuid": "ef70bc15-18c5-49f9-9fc7-422bfa599b42", "comment": "Malware payload (RedLineStealer)", "value": "9faa22f62cc4a553f8e14f673adffcea9975ea09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623582, "uuid": "ae201f40-285c-4d08-b494-4e4c7ebdda8b", "comment": "Malware payload (RedLineStealer)", "value": "b69ba9cd4e6b7493789566a321db2a80638d87746b29b253c3041b5234440d0346221ae2ff5854d95ae54379fa4aa500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623582, "uuid": "c384751f-df4d-4453-ac5d-b8bd20f4c55e", "value": "T17FC41253D6C5A136D8B557F00CF702C30A3ABCA26D7892673B86955A0CB36C0A93777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623582, "uuid": "96392431-628a-495f-b60f-3b204e953af1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623582, "uuid": "36752b78-f46b-450c-9902-7a2383ff488f", "value": "12288:pMrqy90sVAONgMDD4UT9gD1gBYCh+XH+CgmKB:ryzD4UTWDuzMeCgmKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623582, "uuid": "74b7ed5d-0831-4f9a-8222-69111e49b5ea", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623582, "uuid": "c808002f-90ea-4154-908e-b9f41d323d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623582, "uuid": "450a7ca3-69e3-4c02-a69d-0cf52740f344", "value": "72d7eb7c5a2a4a87b583d1bc5537298428030b4d293d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f573a2-36de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691604005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604005, "uuid": "359c2a4b-52ce-44ee-92ca-7dd11ec1ed80", "comment": "Malware payload (Mirai)", "value": "902b544c7fe8819e2f8e9a4f434e6220", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604005, "uuid": "1c9fc23c-ce17-49a3-b63c-632fcb7aac82", "comment": "Malware payload (Mirai)", "value": "73049ec3c1f6fffc51d9307f77f5cc0a466002f6f728e812df085b343ecb17e3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604005, "uuid": "a578585b-d540-4b89-94a3-7bc289e7466d", "comment": "Malware payload (Mirai)", "value": "fdde47571d35caa37aaf94f64cf5a19740342863", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604005, "uuid": "6bd4c012-0249-4509-9b57-0684ca7a9169", "comment": "Malware payload (Mirai)", "value": "bdbb2b23cfa213a9000bd3a9fe34304ef10ca300e03e77b401cf54d9af7d54d2b1131c6eb118e42ab526a9e4cb1a7138", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604005, "uuid": "7dcfd94f-db19-44f7-bd2f-b816b099cad5", "value": "T116C2E16360BACE03C8B3837B6A3D59A622605435A34EED2D77694BC833474D4657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604005, "uuid": "14980082-db57-4118-9d2e-7100c195c5a7", "value": "768:95+Kcrb9VDJee2KTgdTHOBcK5ZCAy7Qk3:elrb9veKTg9QB5Vh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604005, "uuid": "414cc2ce-384b-483e-b25c-2a84d07485a2", "value": 27704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604005, "uuid": "77eaa139-b7be-4de9-a8a6-139e1358daa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604005, "uuid": "aab8621a-0cdf-4750-bcea-0e06272b634a", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed062de6-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602869, "uuid": "76327152-5e37-455f-81b3-ef6debb662e1", "comment": "Malware payload", "value": "e3c746a3da2e47b189613e62d8bffbbe", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602869, "uuid": "ef77e307-cd32-4f82-b0ee-63b2430e2dc4", "comment": "Malware payload", "value": "731152c5bf2f18dbf74c7d36705328154f07a1b540a1b44ca94ecd87b127a013", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602869, "uuid": "e074824d-d70c-4e0d-83d6-33c6ce15c60e", "comment": "Malware payload", "value": "992097d2b130cdf144860a4c75b9b6b9eb7ffde8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602869, "uuid": "521a14be-2d39-442e-9776-e01dc7b11fb0", "comment": "Malware payload", "value": "3c03c9eafc4058cb1e25b87e20ad404d8b17052eed1cc6e05b5806f1668f817731af362213128677c1753584407cfe83", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602869, "uuid": "552779a8-5b91-4236-ba9d-9c4b4343f3e8", "value": "T153E423E8CF2AE665DB564FBA01910D16D4F4B8A9F37F73C96844899C40D60E9BC107CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602869, "uuid": "bae79a44-8983-4314-8674-323c66058422", "value": "12288:CtnWgwJWsOb8KaQw58YMWWVS5I/qkuhroMWkjlXCJ/NabXxNyl4dWnOTEP:UqOb8KmKYMWW8G/qku5ozkj9CtNabXfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602869, "uuid": "40fb24d0-b2bd-4d74-b584-ea44fb9a2b92", "value": 660598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602869, "uuid": "ddaafc5f-9135-45ca-bae2-9f32a20753b4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602869, "uuid": "83c98c1f-7ea8-4705-ae2d-75b6d085f8fa", "value": "79076889381.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceb28f6-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691574952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574952, "uuid": "6ced709b-be6e-46e3-ba2f-8514c8a4aadf", "comment": "Malware payload (GuLoader)", "value": "0d2ca797bea99d6407c7c947f2156f37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574952, "uuid": "8ac299cd-76cd-4ddd-b3e4-c035359c8633", "comment": "Malware payload (GuLoader)", "value": "736c93016b2822e159efe028d05a1028881222f3d5545c9a79bdf7bf3c4de632", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574952, "uuid": "fb3f49e4-1301-484a-b87c-65a9702be0ca", "comment": "Malware payload (GuLoader)", "value": "c595bf8c5e23af1c7cb776cf4987877daa4d8857", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574952, "uuid": "7d96a6b1-9f88-4fcf-a2fb-390844fdcb61", "comment": "Malware payload (GuLoader)", "value": "025c2bba6bc9c7e5807cb8934bbc5fd543157c13cbfb21e87e897b8d0e695213691f4d534165ad39ae50f8d6c3e0ba1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574952, "uuid": "c68aa5da-9634-405d-a2df-88b87e02cb7c", "value": "T186A4020BB52C43AFE79A8EF0397886315A5CEF5315106E4ABAE5FD1D183230DED0A1E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574952, "uuid": "e33a62e8-4f94-41e0-ba6c-6b7610b2e9ca", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574952, "uuid": "5d760fcf-e7e9-4182-9c32-3027dfe29ee8", "value": "6144:cmOPUVBnhRAU1DHgybkLM/Xwfy/pHhsEBUuiOs0D5Fsuc77jKsU4krvzvDlMh/BZ:TjHnkyg/uiO0umvzTk35Mh7won", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574952, "uuid": "8f5c462c-115a-423e-a967-4918b41d90c1", "value": 484624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574952, "uuid": "219e82f9-27f5-4c80-8749-79c2cd8fa03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574952, "uuid": "1e82a228-d280-45a6-920e-ff943c7787c9", "value": "0d2ca797bea99d6407c7c947f2156f37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44203a9-36d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691599445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599445, "uuid": "437eade7-ab53-4559-9544-c937adbac8b0", "comment": "Malware payload (RemcosRAT)", "value": "0f437a25b3eaba231567cc145741fc26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599445, "uuid": "27e99bac-d053-43fa-bd66-f106f190144c", "comment": "Malware payload (RemcosRAT)", "value": "757a10975c36bba76a7585f6c4f8456c2cfa999b8c9002dd09a3099de93f3901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599445, "uuid": "e023f10a-dda4-4654-9e32-41eb66f54c6b", "comment": "Malware payload (RemcosRAT)", "value": "6e46160534d6142cd0d721935bb1964e7c55b216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599445, "uuid": "e8dd709b-f928-4191-a826-4b61fa14e7ca", "comment": "Malware payload (RemcosRAT)", "value": "a5cbe8dc93b1c0ddd8454668f984fece30352b0c2220704faa691f2b630911182a6a3c57d41d60616c3c4d9c851a6935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599445, "uuid": "e1ec8538-4006-477a-901c-7128725ab4cd", "value": "T149631901B78C9331C3A8117A65D6600CE3FED7BE2203D246ED85BD582C527D53EF96AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599445, "uuid": "181b305d-c148-4c99-9416-ccfd0d1f5e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599445, "uuid": "6daff635-0385-46bc-a88d-32c9cef754ad", "value": "768:Vc2a/B89VGuoJks5VdlPuVbZhh55LmhACVplpZSEvymCIgm0IPWL:E/S9VGuoJx5jl2xNmhAGplkKgHaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599445, "uuid": "1704ab4d-482c-4941-8dea-3d4f79c0949b", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599445, "uuid": "46d4b5c7-cab7-470b-9376-6986ad32801f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599445, "uuid": "0c9f902b-b111-4b2e-a90c-cf2926f887f1", "value": "\u652f\u4ed8\u5b9d - \u652f\u4ed8\u5b9d_\u4ed8\u6b3e\u526f\u672c_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ee0d17-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549122, "uuid": "853ed785-fa7e-43bb-8542-ff8f8b340ac6", "comment": "Malware payload (Mirai)", "value": "c36c3506e32c5c746e2f855f9b902ded", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549122, "uuid": "c14ecdba-7df7-40f5-a5ae-b9d703a24210", "comment": "Malware payload (Mirai)", "value": "7657ab03ae55c2668e467f01b6b0d8f6f75facf0650571be5b5e45719a8f995f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549122, "uuid": "9898f01a-155a-4221-8647-90e7d5524c71", "comment": "Malware payload (Mirai)", "value": "62320d6bf5822bd3fa0a8acb6de88213346a24e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549122, "uuid": "a393571e-3ede-4a47-8aac-04308af6547e", "comment": "Malware payload (Mirai)", "value": "9a786adaaeb3fe7b49aee99b17f063ba5d8569aad10e8e27f26efe25e1b511229b75b4a94c0abbb38b879ba2e5f02577", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549122, "uuid": "ebfc8db3-4453-47bc-bcc1-05153d98c010", "value": "T1A3E2E1D145B69479CEB11D76FC334A4D252AC6FCC5FB20226BF8373423F19A64AB0052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549122, "uuid": "8b04da65-7718-4922-9945-2cb79364a0d1", "value": "768:S8Lm6COq1fewdHy62pud4yNOYSOyB8LrvCd9q3UELd1:bLJCmjpkcMKUrCwLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549122, "uuid": "29abfb31-0cff-45a0-bcc2-17505aa36994", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549122, "uuid": "e2ed9aa3-8e56-477a-9a05-4c0c1ad3fca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549122, "uuid": "631edf49-9bc9-4a04-ae89-985733a7e812", "value": "c36c3506e32c5c746e2f855f9b902ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd789bd-36b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691585184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585184, "uuid": "31023c8d-a370-4296-8f85-eaab9c386163", "comment": "Malware payload", "value": "f07505240e3ed7a10b9092fe764a88c9", "object_relation": "md5", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585184, "uuid": "43a0e49e-8a25-4fda-8877-b743d6a404e1", "comment": "Malware payload", "value": "77315791ec0ca15a3d946a623607cc74bd339eb0434c3c4a2320115970c0b496", "object_relation": "sha256", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585184, "uuid": "6241d880-3d76-49bd-b8f3-4fda9e882555", "comment": "Malware payload", "value": "dce08ae7029fde022f34e2707e199d5a3e222823", "object_relation": "sha1", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585184, "uuid": "95615fc1-e540-4ce7-9aaa-82873bf22595", "comment": "Malware payload", "value": "b4186c747b06b642110a635a0519fe0d1b1f1ff35a97b456238713551f7e01fedcb86171f66d10f10d441df7e0cc327b", "object_relation": "sha3-384", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585184, "uuid": "f74070f6-96dc-47e9-9343-0278a953c71f", "value": "T17D2633865CCE2DAAB15A10413B35DCA06FBA5458FE15321DBE218BD88C7F4E8ED4FB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585184, "uuid": "57f350e3-0633-446a-870c-4ae7f9bfa2e3", "value": "98304:PvrIcL5QY5cAGvEUw6Ylr5REKRf8w/C6P7HbLbVK16+xgW1afBk8EbLAXfL:PvrJLyUcAGMU5+rbXdLKkHw8Ugbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585184, "uuid": "4760d51e-4e57-4ed6-97c1-97827cc014e3", "value": 4635268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585184, "uuid": "1561fea8-39d1-4988-8e10-c349c1ee12a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585184, "uuid": "7801f6dc-3f07-4414-aa39-a44de6282af0", "value": "360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d06000-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691602995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602995, "uuid": "d6ac70a7-d842-4c0c-b6c2-bfada1f12722", "comment": "Malware payload (Formbook)", "value": "16f8993271fca454f3cb07443ce40091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602995, "uuid": "a50a9bd8-736d-457c-95bd-27348e57cfa1", "comment": "Malware payload (Formbook)", "value": "7767d8ab0cab91977e3ba3fb74784b15699c62acd71f0e3cf80d7528c6b837d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602995, "uuid": "6bd8adf6-bbc5-4111-b2ed-1abd3447ece1", "comment": "Malware payload (Formbook)", "value": "d30480a9a4aa0e2c14eaa3521447af48e8002399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602995, "uuid": "333660b2-4c8e-460d-89da-1037d6c08b34", "comment": "Malware payload (Formbook)", "value": "d0ee06daceb3b175172e0001dbfc102980805d65e9e2ebd85b7f89485785dd54f373b879ee7459ef23cbf0b4b67e8d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602995, "uuid": "8a106ac5-f5ad-4057-bdeb-9b3fddd49e2f", "value": "T16905373C15686A8CF7A586FCB6748CFF17A56C6F80B7F9F3884CA4D306A97D04502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602995, "uuid": "7b30a710-3b19-4ca2-9d8c-17f38bfd87f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602995, "uuid": "f547e3a9-0e9f-4611-82dc-a9f511ae44d4", "value": "12288:EETTZppEOSLYT3kRUuyc2QQm+Ey2TJCYYNHBwLspoB17fJqQH1yUmzjtK8ZR:EmFppEO6YT3kRb0m+Ey2T8CvDQ+1093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602995, "uuid": "dedeedc5-518b-4b08-800e-0a610aec2225", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602995, "uuid": "e5765d01-1722-4279-8538-6c1804a11806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602995, "uuid": "09c9abbf-3e49-4610-8c48-6d32ed9a08de", "value": "OVERDUE PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d858c3e5-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602835, "uuid": "5fee7faf-aa1f-4290-b850-7d3b22982380", "comment": "Malware payload (AgentTesla)", "value": "2d76f2eea6c1dac78ddf3ac1b07563ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602835, "uuid": "014d6cb1-b695-4628-81a2-fd63c32da551", "comment": "Malware payload (AgentTesla)", "value": "77730222bc33ee734f2ccbbeb6845f8e96057f4a00ef6927d7746fe6005b745a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602835, "uuid": "312ccba9-dc37-4214-b8aa-de8f2891cfcb", "comment": "Malware payload (AgentTesla)", "value": "258d16dd41acf887515a895b8004f3fdd73306b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602835, "uuid": "360d49c1-d9f4-4fa5-bd7f-10b4d9b948b4", "comment": "Malware payload (AgentTesla)", "value": "25419cdb2136b63cf5646c63d53d1a50f248a718df47ba439e517fa7c230056e9aff785b1d38d3956b9a6e9f20da5e3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602835, "uuid": "fd5fe6e5-50c5-4b20-ba5d-5c952bd6a047", "value": "T1A1E4234C947E307ED19D507212F5DA9907A8B38DF0BFE16E9EEC6945BB5A9F4080C344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602835, "uuid": "079fbdef-8b5e-438e-8ffb-9e4d46714218", "value": "12288:bdnW2+LH31UJnAxntW44JW1L8olGWo8yCKUg4fVVpLGcIev5NO2dqeav:pkLX1UJAxntJ8WVFl1oCg4hJIWjLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602835, "uuid": "a837d926-8d90-4f52-9a19-c1386caa41d1", "value": 678499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602835, "uuid": "f25299b5-939e-4bec-8980-3bf74b31e9e5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602835, "uuid": "aca141c1-9be7-4c14-9f66-be4e8b81224a", "value": "C22023080912540.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e89b1b-3680-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1691563417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563417, "uuid": "8572e8ab-e3eb-4866-a493-89af48f5e3d2", "comment": "Malware payload (LummaStealer)", "value": "6efabb64de8a8835ebfe9f189fe14bdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563417, "uuid": "8a9672d6-2c34-4891-855e-9dbe6549a60d", "comment": "Malware payload (LummaStealer)", "value": "77e6f34b7675763be9933089c4d4d52847b435684c026b5e4585e4708b2f3bcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563417, "uuid": "b67a3992-eaf8-4d17-b6fd-15f5bead2e3f", "comment": "Malware payload (LummaStealer)", "value": "d63e12344c172da763dccfa703713273ffd1a48b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563417, "uuid": "fa913600-9712-4ac4-ac3b-67e76e3d0c1c", "comment": "Malware payload (LummaStealer)", "value": "bf844f90d4b9ca2228ef2282e465be04f51d613220dbd598b14f083e2395ebb4ada8d304942e62627d2b5548268332b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563417, "uuid": "18f746ac-52ea-4aaa-99da-3d56acc80d06", "value": "T19365566B1CC750A1C889DEB2E7FC15FD46F59AAF822133A7065167E4EE2060B65138F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563417, "uuid": "73445ae7-1008-4d65-af37-55dd3be8388c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563417, "uuid": "1a727079-5fe1-442e-8ddb-0a2fc3611902", "value": "12288:ZQa6m8uNVO+A3meE+4TyDZ+QmLRw4XbLfrr/c3070vh+HmjBnEle:qawgeiTyoXCQDr/cEw8HqmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691563417, "uuid": "04bb3b76-ce09-4861-af8b-2fb4f4dfc119", "value": 1472000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691563417, "uuid": "cf5845b1-0c41-4399-b332-e9d89d0c8141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563417, "uuid": "a875224d-ffc5-4f26-9433-7a2b0766da30", "value": "6efabb64de8a8835ebfe9f189fe14bdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e4fbac-36dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691603361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603361, "uuid": "0dcce6d1-63d3-4af3-b8c5-91b76f95436e", "comment": "Malware payload (njrat)", "value": "634b0c0b1804d8d62ca8814156047bdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603361, "uuid": "661fd7b9-60b4-455d-b150-4fc4bf6e40c7", "comment": "Malware payload (njrat)", "value": "787ed9aeca155d295395f3ca3ddadf29cfc8c7f66ad01978b61d1a5925b05e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603361, "uuid": "4c816ada-b13b-4ab3-9093-6d88831088ee", "comment": "Malware payload (njrat)", "value": "b7014e954734810d733122013cd88d8645f55785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603361, "uuid": "e7ac8c65-f07f-4dd9-b636-1525114e1f43", "comment": "Malware payload (njrat)", "value": "83406690af47dc81850defd4ee34d43a2ddadc42510aee20ae76974035029d88cdb1e4593eedd11e79abee098f99b5a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603361, "uuid": "2a6397de-ce78-447b-bde2-980ca7a9edb4", "value": "T108E22A467BB58225D6BD6AFC8CB313110772E3438572EB6F5CDC58CA4BA76D00241EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603361, "uuid": "9a95260c-1484-4e61-89c2-884beb72f1b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603361, "uuid": "09848026-b47f-4a27-a037-765895a9864f", "value": "384:X0bUe5XB4e0XmOnCgFS6Z/73DWT0tTUFQqz98Obbm:8T9Bu1vS6B9mbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691603361, "uuid": "96af6993-6167-4e40-af37-136dd82fac9d", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691603361, "uuid": "a8edfe34-ab27-4760-b899-f68e7474a1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603361, "uuid": "290d4a8a-f2e9-4401-9667-aa36a33b9b59", "value": "xxVP3gG1EtTm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd33eb8f-36b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691585233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585233, "uuid": "444167c4-3f83-4056-8f03-8d8d512fd9d1", "comment": "Malware payload", "value": "fcaf06c9449d15342e34b637ee9098ba", "object_relation": "md5", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585233, "uuid": "e64ce95b-f1e9-4003-9c7c-87d1aaabecee", "comment": "Malware payload", "value": "78aed2ca691b89512a6538ea0b8fe4b01a454e872be675b5179caa204773bb66", "object_relation": "sha256", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585233, "uuid": "f7a904fa-dbbb-445d-935c-3651f04b9321", "comment": "Malware payload", "value": "1e5592f47b1ed0473e01f9e2e87ace09481eaa63", "object_relation": "sha1", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585233, "uuid": "193c2144-236e-44e4-bc0c-09b750358171", "comment": "Malware payload", "value": "2cb3e423549a94ecc6e83c5a4450f80f1a1078ddc8a7847bed2b7408a6b3c9e3de8e622aa6dc2296345ece22d0870773", "object_relation": "sha3-384", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585233, "uuid": "6ef75585-290a-4c2b-995d-ce9350adddb2", "value": "T1E33633FD173B49A336F513BD7241898065CABA7994DC8229E26DF25F0B7F2742D82123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585233, "uuid": "6b3359b6-e933-4546-88b6-efba568ff247", "value": "98304:/OYJIwdkbn/lZhqe8eDsADZ2VoPTv1y7LTwP6zyaexyo:mYJI/9qe3YE8Sv1eUCDez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585233, "uuid": "6bc0a7fd-0179-44ea-99fe-7eea1a68ba47", "value": 5200240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585233, "uuid": "0de288fb-1adc-4684-802d-1921b7cec78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585233, "uuid": "3d771196-71c4-4faa-9aab-e7aaf2bd4362", "value": "z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f77c69-3659-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691546731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691546731, "uuid": "e9680420-c6da-4fb3-93c6-b24f143f15dc", "comment": "Malware payload (Amadey)", "value": "a9fb083de13752a39f4c117e9e9e9a89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691546731, "uuid": "b5ab2816-66da-494f-940b-1e31ae6c2a52", "comment": "Malware payload (Amadey)", "value": "78f82d2bb1bbbfebd5ca1f69d00a5001c9c8bc294b29ed91af4fbab165331610", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691546731, "uuid": "621bd0fd-ac64-4cec-a148-97baf5de7f56", "comment": "Malware payload (Amadey)", "value": "ae8e4fe33efb1cc5b72f5868af65e58d9cb3512a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691546731, "uuid": "1afce86b-c35f-4a96-9b1c-a4b072ef8713", "comment": "Malware payload (Amadey)", "value": "dc7c0781dd46b172819a3b000d25111646578639920be4d66c2bcbecf13526d760f619edb2303914d0832fbc4658f69f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691546731, "uuid": "3fedcb3d-c3dc-432b-86aa-d05897c5d939", "value": "T134E41266B7E8A133DCB15B7058F712D70F32BCA04C7882662318585E1C72A98A572B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691546731, "uuid": "a4e8b6f9-93c8-4164-960c-d5467cc3eae3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691546731, "uuid": "ae6555b3-7568-42a0-90c5-ef9d926b18ca", "value": "12288:dMrIy90qARpnrE+orI2wGEusb8fYmzP8tXxLZvcY7MhlI8/lFuMjX:5ykpY+p2wP8fvEtXwY7v8/lF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691546731, "uuid": "fe7d800b-bf19-4c1f-b524-32450a72db4d", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691546731, "uuid": "5d41b7c1-b71e-4397-89ac-287fa7033cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691546731, "uuid": "b46d4eaf-1e5f-495e-b23b-d41f6d367dd4", "value": "a9fb083de13752a39f4c117e9e9e9a89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ceacec-3687-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691566404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566404, "uuid": "24b0a6d5-0d24-4d88-99b6-73dcd15e3fc7", "comment": "Malware payload (Loki)", "value": "7bb907d4c3ec7bb44a0f25f41bad22d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566404, "uuid": "f774e7e8-3ff8-4635-a671-6500f659d3fd", "comment": "Malware payload (Loki)", "value": "7912ad331ddb4d17c37ee3cdc2c5a1d4142c11a07f60f4633f8df706aeed986a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566404, "uuid": "e3dfe797-c600-4e91-bfab-7f201d74090d", "comment": "Malware payload (Loki)", "value": "ff81d85fab7aff6ad3da0d5f04b5fab27c91b2b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566404, "uuid": "4891559d-5bc1-4115-879a-243604c507ab", "comment": "Malware payload (Loki)", "value": "808b41bc56b40b94c4132ec973254c968d0338bc9d8c977cbb72ec1861264b91d14f15bdb38c2ae2032e9d16221c3006", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566404, "uuid": "58ae9264-d2f9-4faa-be70-5b548dbf9249", "value": "T1AEB4121665E95F91E1FAA7F8697C50A01BF321068467FA2C1DD038DEAE77702CA00F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566404, "uuid": "7f6e6c3d-b7cf-4572-9678-3eb7ce65891e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566404, "uuid": "2c19886e-54ff-42cb-85dd-29a4c34b69aa", "value": "6144:vxSuQia89EjGIW4NdxY4oLQoLpUu3ffmkD0t/QK3RnuMiDUJXXl6izS1BuGNywxd:5SniF9zLWuPukD0JbuUNgWSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691566404, "uuid": "ecf986b1-e3b2-4189-88cb-dd72dbb40084", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691566404, "uuid": "baa3e947-56bf-4298-ab3e-c2b41ac76d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566404, "uuid": "3d5e20e0-6e09-431c-83cd-cd530c96757f", "value": "7bb907d4c3ec7bb44a0f25f41bad22d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81743057-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691549431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549431, "uuid": "11a86d63-6c9a-4151-b31c-2739d24d28a6", "comment": "Malware payload (Amadey)", "value": "c9409f7c6bf4c716c9e1b5a45f90b4fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549431, "uuid": "8beac508-44ff-48ab-a55f-d3c6f69834d0", "comment": "Malware payload (Amadey)", "value": "7945d6168125a02619b340308fb9a4bb99c67c40905a002a8477bc7da58af75f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549431, "uuid": "12a4d6f3-5ef5-4650-8243-3fefac218987", "comment": "Malware payload (Amadey)", "value": "12a2ad5a804731f280b07d18e190f489aef46eed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549431, "uuid": "d4a567d3-a7c3-424d-96fa-3cad3f34ebf4", "comment": "Malware payload (Amadey)", "value": "74b85f99bc100131b5c20b1b703303770bb56e398521defc55655fcc7cce05dd9ecf1862df5f0507ed87459427c4c8a0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549431, "uuid": "ebeb1970-df81-4412-8859-588f8582201d", "value": "T103C41207A6E4D533DEBA2B7118F153C30F3A7CA58C7482AB1745992A0DB3A84997173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549431, "uuid": "f35231a2-5de9-4f89-8c3b-82ec204066cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549431, "uuid": "6ce4ba52-985f-4a00-a8a5-8bfa4f06cfde", "value": "12288:DMrjy90spuM9+GzuZMhRDxFWde5LxiWCGC/48:Qy6Gzq8IwGWf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549431, "uuid": "58eab534-befc-4055-86f9-eebf14eaaeb1", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549431, "uuid": "c68eb6fc-ac68-4f07-b954-aa41e0da23dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549431, "uuid": "204b1556-57c6-4654-9e85-03984e09e041", "value": "7945d6168125a02619b340308fb9a4bb99c67c40905a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e9bc6e-3705-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691620569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620569, "uuid": "8db7f028-db20-4dcd-8326-763e7e976030", "comment": "Malware payload (Mirai)", "value": "5268b180f98364ae43052f3374e39720", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620569, "uuid": "616f5148-12f7-47b3-93c4-50c6172e7f5c", "comment": "Malware payload (Mirai)", "value": "79572d36daa9754fbc65956ce97adb1ee61505afa3dd6da1227c6a13da56ead7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620569, "uuid": "ab6dd44c-2a00-49cd-950e-9059862c6145", "comment": "Malware payload (Mirai)", "value": "14e99f427050376f23d43309a83daed8286244ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620569, "uuid": "92b9163f-2a3e-472d-a4b3-2c275dcc85dc", "comment": "Malware payload (Mirai)", "value": "3daa5d43c42b4ec61ff6809ae050dd04b3e4fd0ed1d36479285cfbc2528737df8d131c3a4d1ed0102b31b62d18d59b98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620569, "uuid": "58296519-4ceb-475b-9ef2-15f1cd39038a", "value": "T120532C96B8016D3CFC5BE6BE40110A19F931376129B30F2BD6A7FCA36D321A65D1BD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620569, "uuid": "4b7faf7b-0861-4b44-b339-d55a474b7cc2", "value": "768:QPBaz0tMQaaZ261DmbgiqJNS5LhZFGGuKdOmXPLzqov+9uQ8yhh5Cu7VqntyPGyR:Q/vi5Lh7GGukLXHfv+MQ8yheu5q4PG6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691620569, "uuid": "b9682b5a-1a33-43ae-9c5a-0050cf3b7efa", "value": 61288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691620569, "uuid": "8daf9b33-9e6c-4066-8eb6-d211e87aa570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620569, "uuid": "7fb7d799-4b81-4103-8e72-7ff79c61b6a3", "value": "5268b180f98364ae43052f3374e39720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4bfd54-36b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691586069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586069, "uuid": "59542e78-7ab4-487e-8afb-8c3e680e1a7c", "comment": "Malware payload (RedLineStealer)", "value": "3ed054705ad25bca950b0da23bf83c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586069, "uuid": "a54254f8-3d62-4c20-b098-13aa139b0ee4", "comment": "Malware payload (RedLineStealer)", "value": "7b116f68f4737793e2f43257caf675305c6e920217fc1f00d2fc3437ce93ea8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586069, "uuid": "10ebf09f-c435-4bbd-89d5-722b8e0f0e26", "comment": "Malware payload (RedLineStealer)", "value": "962433cc32d6ce3c8c32499dbcfa017bd410e846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586069, "uuid": "d13f8a3d-13eb-4277-a54f-d2cb06e66133", "comment": "Malware payload (RedLineStealer)", "value": "26f54c60f9cebe4c06587e18fe48e82fd31569eda35d0d3758cef1ae1064c500ed9c3898a6add22cac17bb504e7d5ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586069, "uuid": "ca3fc194-2c5a-41ed-be1b-6bfca9437aef", "value": "T16EC41216AADD8073E8F217B058FA12D30B35BDA24C78431B2AD0A84F5D72AC4F476776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586069, "uuid": "a8bfad59-5c5c-4ede-b216-7380ebb22228", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586069, "uuid": "c8be48f6-9383-488d-b30d-48cfb6330445", "value": "6144:Kvy+bnr+jp0yN90QEGYPk45DxuJEK/r/xjdnrIMg0BXu80uhK6Xeb5TUGCZVwMwQ:BMrjy90QY8yK/VdnewJKBNiwb3SQLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586069, "uuid": "823abb03-0fe0-43c0-8749-98a74aca171a", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586069, "uuid": "c7f3c5b5-69f8-4cda-81e8-ee6432968e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586069, "uuid": "5ee943e0-81f6-4088-8304-a382f2ec5f9e", "value": "3ed054705ad25bca950b0da23bf83c5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c2d4ba-36b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691587957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587957, "uuid": "6c938d61-cf32-4901-80a6-7335301647a6", "comment": "Malware payload (AgentTesla)", "value": "6898e2bb2ac65409456a8f79646eb8a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587957, "uuid": "0701c86f-edce-408f-98e4-5c291ebc766c", "comment": "Malware payload (AgentTesla)", "value": "7b6d0d25e35a359cbfe8eda9e0d9932384287be3e4e5bac2c054d643fc7bd9dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587957, "uuid": "6319ba18-b0d9-4f57-a047-72123cda8b8d", "comment": "Malware payload (AgentTesla)", "value": "d84e28cd16f103bc1f48020ca010bd60b41f9a2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587957, "uuid": "ff657c10-d1f6-476e-a863-aecee1331046", "comment": "Malware payload (AgentTesla)", "value": "b9726eac507ff16c7c360080ad88f14c8531f0ecc3402115f970f2d4d7435206fff09031738ae85ae2c47821004e1f27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587957, "uuid": "388536cd-334e-4285-a19b-2f3d4d2262b3", "value": "T12905F722E77B654AEF25A6E88E2F447179C6DC80F1B1C58CB7E7680385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587957, "uuid": "78f7d2c2-4566-4310-827d-47e636ba7eb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587957, "uuid": "4a0749d7-ad65-4ea4-9be8-bed56166d353", "value": "24576:Sh1JYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOJOgug89qGMaT:0WRs6CE3jLbO9Rs6CE3jLbOHugKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691587957, "uuid": "9e1c0728-0c90-4b67-8c00-f42f035f4421", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691587957, "uuid": "cbce2207-67cb-4e2b-a4b5-9590b07e0cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587957, "uuid": "a6b32c36-60a3-49c6-9254-4ad9a3091504", "value": "grace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c52372-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691559230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559230, "uuid": "390af190-c58d-4369-be3d-3ea37290f43c", "comment": "Malware payload (AgentTesla)", "value": "6cdab224211f65caaf0e30d790cf3de4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559230, "uuid": "ad5e4006-a6eb-4bb4-a5fe-870cdcfb6b00", "comment": "Malware payload (AgentTesla)", "value": "7bb0c7435eac35a50637bb58058fb0b71629b39cc0e7222b991cefeaffdc79a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559230, "uuid": "5e58e419-3f74-4a11-ba21-bc9857501f78", "comment": "Malware payload (AgentTesla)", "value": "4de6cc12d24fc3eac850aec59116dba6865889b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559230, "uuid": "47e30ee6-30bd-4145-9609-72dfd4c79cbf", "comment": "Malware payload (AgentTesla)", "value": "b5ffa05ac53e57c9e3f46c658dee6902b809e03ef3c1d11d81888d22f46b47bb79770d3b0bb402a8b2b68dc9d760b659", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559230, "uuid": "51e79e95-6ae5-4e1d-b19e-2844d23b24b0", "value": "T14215483C15296A4CF7A582FCB2748CFF17A56D6F80BBF9F3884CA4D706A97D05502262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559230, "uuid": "4e7ec976-3950-4df7-a80f-d1f4cd69eab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559230, "uuid": "902c9a41-c002-4fb9-ab77-a3183c56829a", "value": "24576:ZfVEpEO6YTYROjAWyUCl1Mu4DtzA8fCAx/NO:ZKpEnUAo44RzJCAvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559230, "uuid": "402863f1-78bd-43e6-be02-489129410070", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559230, "uuid": "79fa9c0e-c310-4b37-b891-9d2018c929c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559230, "uuid": "3867fb11-7751-4f2a-a824-d9c5a94fc3cb", "value": "FedEx_AWB#503529274643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9373c5da-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691599712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599712, "uuid": "51f034bf-03f5-4871-8721-3ff3a68c86e6", "comment": "Malware payload (AgentTesla)", "value": "8eae2cefa42457781c7d2fdc6a2517db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599712, "uuid": "57bdeced-cf82-41af-8711-c37c31e9bbb6", "comment": "Malware payload (AgentTesla)", "value": "7bc471bfac3991e760471805113d37184733069eea188817e97a08d27627d8c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599712, "uuid": "00101940-1060-4acf-9700-c4edc673f007", "comment": "Malware payload (AgentTesla)", "value": "0ad8fb8bbd7530c4545a204cfd03dad7e16466d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599712, "uuid": "d92947ac-9c66-4d4f-853c-d28e3029b08a", "comment": "Malware payload (AgentTesla)", "value": "f254454e63511e4dfc11707d187eb6ec11062988e1e60143b5e33b473e05b2dd09429649a9b7b4da45b1eeaa5b5a7b97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599712, "uuid": "f067885c-f339-4990-8444-25d59c482e23", "value": "T12305483C15296E4CF3A582FCB6708CFF17A5696F80BBF9F3984CA4D706A97D04502662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599712, "uuid": "a47a94fd-2c0c-4311-9c04-45cf7ec32562", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599712, "uuid": "6da21e16-3784-4cee-8079-2b50c36ce031", "value": "12288:EElpPpEOSLYTADemWENe0m32G72GrQF7Q4CFcty4In1NQPCB+:EIpPpEO6YTAR22GSgQhQ4CYfILSCB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599712, "uuid": "bb808163-23f5-44f2-8b57-3407237ce4f3", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599712, "uuid": "da6d0148-f7d6-4a0c-acb2-66889f16d6f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599712, "uuid": "7a83fbe5-6b93-4581-b860-c72efa93aaa0", "value": "P0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c4347a-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623292, "uuid": "889fad40-34e5-41cb-b803-4300c0df7740", "comment": "Malware payload (RedLineStealer)", "value": "1d8d6e668ba769269e2bb88a669a604e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623292, "uuid": "c6eaabd0-1986-4eef-86ac-d5676a422ac4", "comment": "Malware payload (RedLineStealer)", "value": "7cdfae48d4b65f80ae50705876a65ae4e2612df9f7c302dda28d514f25f25a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623292, "uuid": "f9e961d6-225d-497a-995e-fcab9f63b912", "comment": "Malware payload (RedLineStealer)", "value": "ffc6063387961fb418a9458987e196e19679fb21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623292, "uuid": "327f9deb-3edc-44f6-a336-ce84a8b77254", "comment": "Malware payload (RedLineStealer)", "value": "c70c79b1e83436672ecada8197aaf90c2ceb8b82b7f0906ac0796a1b35e61730f6551ba20291a45b64eaae6900e76f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623292, "uuid": "5ce2242e-ca30-4c77-b0b2-bcbf5528835b", "value": "T1E6E41243A7E88073D9B51B7858F607931B31BD61ADB9922B63299C8F1C736C4983533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623292, "uuid": "c36e5f08-b0a3-4661-a0fc-8b261dbb5704", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623292, "uuid": "f88e19aa-7ce3-46a0-8cdc-0cf47e25a68a", "value": "12288:AMrKy90aaoQMpR5fr+Ip5fIgFUB9MRYQ5cp8FgfkR42/qqx+mwG:6yR8MpRB+4dNFcyRYQEgK7bG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623292, "uuid": "98849083-631a-4166-814c-cf607f3aa233", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623292, "uuid": "183cdc3a-91f5-407e-a767-ffef28b20c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623292, "uuid": "219bddc7-2af4-455e-8753-bed0dc42569f", "value": "1d8d6e668ba769269e2bb88a669a604e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb3c73b-3680-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1691563706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563706, "uuid": "6f02c0e5-20b4-48ab-b56b-69894c009ab1", "comment": "Malware payload (CoinMiner)", "value": "f810de3ef202723a9fa3637e69115da6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563706, "uuid": "1fa9866d-4263-48e1-a67c-f3f0e72de4b6", "comment": "Malware payload (CoinMiner)", "value": "7cecd6d2b7a8c9a835d73e404a1659afeb39e92a59fe19e57c8ab265c9f77c72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563706, "uuid": "fbb07ab3-8f76-45e9-ab0b-22d0ded08b6f", "comment": "Malware payload (CoinMiner)", "value": "06ac4717e846873a31944aa6d05ba3cc317605f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563706, "uuid": "5de5511e-f34a-45c4-8a33-aab40a870c00", "comment": "Malware payload (CoinMiner)", "value": "271aff5fc43b491d0dbf8a9c55ea3fa79b92af01b220e854d6905300094f1498e568196447bf023e0ae21d12fd724de0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563706, "uuid": "b3483fc7-9592-494a-a341-aca524665eb7", "value": "T15726336177E080FCF4886A7406D678A23EB4ED352794A0EB6AF977360871747D73E212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563706, "uuid": "280b6b0d-b0ff-4320-a310-442d0c9294e8", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563706, "uuid": "8f9498f5-3bbc-495f-970a-9a621b422086", "value": "98304:EJ5C38lbZzsxc/QxovXoI1rt91KnH+rV8hliQTqvtqf+XIjagOc:EJjbdoc/QxGv1bsnerVCle8SIjROc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691563706, "uuid": "db2fb597-4940-45d3-811f-b2661cdce209", "value": 4432512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691563706, "uuid": "3f8b77fd-0796-44ba-919e-30e1cd6ce63b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563706, "uuid": "fc5733ff-5675-492a-a228-d1eb7a94685c", "value": "f810de3ef202723a9fa3637e69115da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5611d73-36b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691586965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586965, "uuid": "55c0340c-2e2e-483d-ab60-61935712a012", "comment": "Malware payload (RedLineStealer)", "value": "2ee6d29565d160f7d05a65b81929e745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586965, "uuid": "05406c38-bd3b-40d6-a56e-e5af39242b4a", "comment": "Malware payload (RedLineStealer)", "value": "7d074d0b174abdf9db56afcd9c4ef1277bc2faff03cae632e5bb2ebbebb59c46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586965, "uuid": "af12216b-55f1-43f0-8abc-d571ae530ddd", "comment": "Malware payload (RedLineStealer)", "value": "a6b85752d4681d73541e6374f4fabd0fe22e57be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586965, "uuid": "7fc4388b-d5b1-415d-bfe8-5902e1b98712", "comment": "Malware payload (RedLineStealer)", "value": "ee5be93b8e519643545196940de87ed390ed4c3feb7d281833b8b6a1d1ff0cd151c3723131f1f8f648ed4ec09908ab12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586965, "uuid": "03dcd6b6-596b-4496-b08f-d6fcb6f4ff3e", "value": "T17CC41242D7EC6432D5722BB054F243D31B3ABDA26C74972B2784A98E1D726E0E57133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586965, "uuid": "2b6e3144-0a86-4c8f-bd4f-9ff420a18adc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586965, "uuid": "573fa6d2-7ec8-4fd1-9ae6-a69b44a93ed7", "value": "12288:QMrYy90fsMNPYAvu2AqKYMPd+WnWqhW0gBYCde4xEN2FRlwsmFXU6L:Yy9MNQpqKY4Dn+bzDxVdHmRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586965, "uuid": "e54faf70-5fce-40a6-b5cb-d681da6003c2", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586965, "uuid": "9e98369f-2444-4c7f-b1bb-68699f09e3fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586965, "uuid": "f24608f8-c76c-45ac-9900-933f38a9a48f", "value": "2ee6d29565d160f7d05a65b81929e745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985c7504-36dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691603586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603586, "uuid": "bbf677c2-495a-47a0-85f2-c121a1b7acce", "comment": "Malware payload (Formbook)", "value": "f46119800d530db454ce9d90e12d2d67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603586, "uuid": "d24ee5ea-471a-471e-baa7-d9ee28fbac69", "comment": "Malware payload (Formbook)", "value": "7d571245fea5feb28591ece76b40d68ee5ba265b83d18d762a31c83fd3f2b7c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603586, "uuid": "521ef631-2b84-45b5-9f60-6b4969942519", "comment": "Malware payload (Formbook)", "value": "2015c78cdcc01764d2e436c012598fb87cfbe2f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603586, "uuid": "eca823dd-11cc-4af2-b075-374aefcaf28e", "comment": "Malware payload (Formbook)", "value": "6684c3ee02b02a8ea1ad1679c9fc6c005db6e6c0f290c37959691e78510df8626cee331a3f116c554d32d0737d7afc5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603586, "uuid": "014c8dd8-ac55-48ad-94e5-b0b9a2531aea", "value": "T1E1441211A4F4C477D87107325A362B126FFBE92914A9935F0F302B5C7D27BA19A0DFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603586, "uuid": "fdcc0445-c0d2-4228-a840-ec3f33f1005b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603586, "uuid": "e1a486b0-56cc-46a4-a527-15e06806b930", "value": "6144:/Ya6a+ZJ+EylwsHBTZ84rH69vRYfVC9dDpzALHmGp:/Yk+ZVy6kC4zpUrALG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691603586, "uuid": "cf37e779-5ba7-476a-a5fe-55f4bff08274", "value": 274214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691603586, "uuid": "17a72dfc-0d98-42b0-b10d-4be519f060c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603586, "uuid": "3b494c67-3af8-461a-b7e9-b8a6bc48a708", "value": "f46119800d530db454ce9d90e12d2d67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1beae833-36bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691588775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588775, "uuid": "e5bbb35a-7c8b-4248-8182-9c6974a2894c", "comment": "Malware payload (Loki)", "value": "41d75bd4c5c723b655d5f69a2684c874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588775, "uuid": "2bc0e554-749c-40f8-94a5-f6378ad0bbb5", "comment": "Malware payload (Loki)", "value": "7d725e98de860ace2bbbdc61e1aaa035516d516a3ee0f023f67aa8db3111ea26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588775, "uuid": "fd6c1961-dfa5-47f2-8c00-5ae1f7d7c72f", "comment": "Malware payload (Loki)", "value": "090cc5925dde37a4ed06113b43deac1be064a516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588775, "uuid": "ff1193d4-c4e5-4c95-ac68-fa2e13131009", "comment": "Malware payload (Loki)", "value": "6a751003213efad7d9bb01e187e2b1cff8915bf5a2908d9a083d19a74acf866d2a0e7f2634a6369971b8b5c8d7b0bf84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588775, "uuid": "2c5336cf-ff53-489b-bf7d-3870b6996b34", "value": "T117E30259AAD9C057D0F243315F3907577EBAE91320A49A0F6350AE0B3DB5752DB0E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588775, "uuid": "4de83fad-ad5f-42a4-b401-69c58d268d96", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588775, "uuid": "ffa2e667-52bd-4229-b168-f251753886fe", "value": "3072:HfY/TU9fE9PEtu7bveqPpqZZXI+T/Bpbdx7Ay+fuNFpsFB69fGDQGctpev+TC:/Ya6tvFPG4G/7dx1+fgFpSBu5Gei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691588775, "uuid": "24f275f8-73bb-4dec-87cd-62dd3713f72b", "value": 154928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691588775, "uuid": "43b1fd37-a3e2-4ee6-b74d-ce4f10edad38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588775, "uuid": "79e1ab80-7fc9-4619-b774-c26bb2498cb6", "value": "PO011948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9445bc-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571948, "uuid": "915b66e2-8f2f-4980-af8d-04961589741a", "comment": "Malware payload (RedLineStealer)", "value": "474dc806ec2e116f7e4c3cc84b49f452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571948, "uuid": "1163b220-36c3-41de-a2c3-92b4faaa1812", "comment": "Malware payload (RedLineStealer)", "value": "7d79ed86143c021ad866df3ba4ba87e3dd722490cda249d3d91bcc4ae6ec75f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571948, "uuid": "3d524967-467c-40c1-a439-99f8b2d062f7", "comment": "Malware payload (RedLineStealer)", "value": "cb757262bddaaed1d5d76304fb90959477d439ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571948, "uuid": "20659dbb-10fd-40b0-b495-5a47a1876939", "comment": "Malware payload (RedLineStealer)", "value": "e14e955f7de7ecab1ff1a05c85062099f50a862d8d68ec67092b2b878a06845c6985a366d4b56cb73acdb6a86e27c5f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571948, "uuid": "2795912e-d104-45f8-9d6f-9ee699db33a2", "value": "T110C41253A7E84532D8F517B10CF602A31A3A7CD56E7493672786682A1CB37C4B87237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571948, "uuid": "3f1877f5-e5d3-4812-84d2-c23e8148101a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571948, "uuid": "cc9dbc61-6f42-4360-ab64-1b81899d46a1", "value": "12288:RMrsy90rpsuDws8hQB/vgu2DeO/OidliLXVa:Vyusy98hI2aOFOLXVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571948, "uuid": "63afa66e-5a3a-4ddd-a3d4-cb129f57a15b", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571948, "uuid": "77e4e856-a1d8-4a6d-8e7e-d92b74afa53a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571948, "uuid": "8419e26f-c639-4216-a3b4-a236dbe75d82", "value": "474dc806ec2e116f7e4c3cc84b49f452.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528615cb-369c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1691575552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575552, "uuid": "acd3f8ef-8657-4a83-848b-2258b1d9c8a4", "comment": "Malware payload (Stealc)", "value": "ac2693c21fb21d14754558045c0b5381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575552, "uuid": "d0a9694d-4416-4126-b9fb-c455a3465b92", "comment": "Malware payload (Stealc)", "value": "7dd0884454b6880359cbd1467646d0f2aca59df24bf07d474550bfb5fb0229f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575552, "uuid": "49e4728d-bfb8-4074-8414-354c9c88faad", "comment": "Malware payload (Stealc)", "value": "e4e85ddefa0fb167084526dbffe56ca57f730b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575552, "uuid": "d466b273-c9d9-4182-9422-1115d5782116", "comment": "Malware payload (Stealc)", "value": "1edfebbec30b97f579863d7a728a5b756373f8a83478f70e6cd18c70a146755d322324d4c34b51d6313f364387e74351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575552, "uuid": "742c1f9a-d00e-4d2a-8d4c-ab9f7455e5cb", "value": "T18B36D746A6E501C8D1778138962E3356F83AF4DC4F249BC39FB8968F17E6AD45AF9300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575552, "uuid": "bf3c2618-6a59-410e-97c6-2d9e99f56f91", "value": "eb0ac47a9e5d6c5d01ae13e991bd8031", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575552, "uuid": "a3840afc-22db-4692-b6d9-d9f9f915a6fb", "value": "49152:X2L9bHvrKgHfyXy+EwZ48/qzoj8ReAXWfgQ:mhb6yPXzIAXu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691575552, "uuid": "f2ba3a1f-e81b-4026-828b-640db78358f3", "value": 5110912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691575552, "uuid": "a93030af-ab81-4a25-b6ce-167ec3484d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575552, "uuid": "0b82e1c9-a670-4eaa-9b10-a7455f88684d", "value": "ac2693c21fb21d14754558045c0b5381.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00b2f34-36d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691601049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601049, "uuid": "18830148-fd25-4cce-9045-588514e7273b", "comment": "Malware payload", "value": "4d5a4b80a74dbe8f797e7651ff467915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601049, "uuid": "b985187e-3d37-47ee-b76f-0e058eaf3184", "comment": "Malware payload", "value": "7e3fb0c53da7af1b19f0ffa368565bf6bbc14c5eb2005e60f0fecd2d9961e7e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601049, "uuid": "8b657636-caa9-4959-be99-b03259bfc8c1", "comment": "Malware payload", "value": "e03c5ac35fa00805f74604fe655c29b8f0e86df3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601049, "uuid": "495fcad4-3099-4967-befb-71421d0bcfa3", "comment": "Malware payload", "value": "26f7d4db802e44b32235a06d810d55bec80ca5219f79f353e1063e387d445a5b5b28eb05f5aae0ddac4070bd5c134761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601049, "uuid": "895ae050-5ca3-42b2-a8df-96aaa862fba2", "value": "T152E41246ABF89133E8B52B319CF703D70B39BDA06E68472E6309A55D4C725C0A97133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601049, "uuid": "c38069c6-d9ab-4c54-9de4-07e1eafaf344", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601049, "uuid": "7fe14a9d-9214-41c0-b482-a37d8c4b34c9", "value": "12288:BMrUy905CJMnBbShM/+EIOOEc9tfbC6SYsy/dXgAcwLgT+T:ZylJMBbwG7eFf7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691601049, "uuid": "43bfd9df-b6ff-4725-b3be-6392812f7fcb", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691601049, "uuid": "b75481c0-027c-470a-af4a-e0968cf49122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601049, "uuid": "fdaf6eed-0ca3-4256-97ee-eee6a69e8999", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6caac686-36f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1691612103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691612103, "uuid": "e7848f63-89b3-4103-96c8-c8e3c4bfc44b", "comment": "Malware payload (CobaltStrike)", "value": "982716bca0de500dcfe3ca170258089a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691612103, "uuid": "2f5473f4-57b4-4698-8717-41efd10e2efd", "comment": "Malware payload (CobaltStrike)", "value": "7e86fc3541ca2a8898c9f8c9c5a2dd5602b6d3b88d7b3857cacfa0503232e4a4", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691612103, "uuid": "f92e0bd0-a5b7-4a0a-b544-7f47d0cdf37c", "comment": "Malware payload (CobaltStrike)", "value": "25bc2baeaccd30a1fa247cdadae10ca188966106", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691612103, "uuid": "4744cf44-ebe9-45db-897b-c2073c706924", "comment": "Malware payload (CobaltStrike)", "value": "8eeed31ac7466308f99c2e268db6c318272213b4415cb636e4e19e7fac45c6e14684ffa963d7988fa99c152598478aae", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691612103, "uuid": "dd65dcb0-8e09-4ad7-8103-97eaaccb733e", "value": "T104547D873FA80D0DEB05F4262662B0CA29E5571F6650C881A6F1C6E5E4F56267CFC3E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691612103, "uuid": "2cb61962-14c9-4373-a86d-ef25befcd227", "value": "6144:2LR6mHX+TmLD4eyg16i3RJ3rFI8kHMSTpbJN4aXsxxGu:2Fr4ey7ihFFI3HTr/X4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691612103, "uuid": "5e582463-0a26-4283-9eba-b92be1b3390d", "value": 300158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691612103, "uuid": "611b30bd-42f9-4139-9258-3f1509cda9b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691612103, "uuid": "b08f76f5-6f8c-48df-b39b-a1c086ed0da7", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f11758-36a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691579821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579821, "uuid": "381d675a-8709-43ef-a2f0-53db6f848b11", "comment": "Malware payload", "value": "0b1e8d991a8b2a1ea7c7469a37283a94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579821, "uuid": "9c933918-11ff-4a90-adcf-81f9c53a0f9a", "comment": "Malware payload", "value": "7e911100458427d3fae95f34d3404fd83b677bd17dd4a8afe2a9037d115caabd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579821, "uuid": "f7190af2-7042-4b79-a454-ef2ae960ae97", "comment": "Malware payload", "value": "3d67ff8d13dfee4ebf13e903af81b08515f70b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579821, "uuid": "b2fb0cbf-32b8-4f1a-b043-97b6bdf57528", "comment": "Malware payload", "value": "dd435d5742dd4771fac4fc544a9423d24a623bff59e123b52d4af09bc36a86b3186f47dccd16f9652ae0ab320f5a06cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579821, "uuid": "39b41dcc-7e4b-40f4-a980-e8d13b0ed202", "value": "T1F9E633C11FD60A9CC0AADD302BD7836972D573CAC0FD5A0E39C68C067AE2D5649CB6D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579821, "uuid": "8c25fdbe-bba7-468f-a05e-832ada4f5e71", "value": "444c974be180e5a014ac40402b6bd9fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579821, "uuid": "838b76a6-389a-4205-ab25-9e22b59df085", "value": "393216:SUKZw1CqEDs+PkE156WQWLSB+gRcsLPEivQmM:gj4+cEtQWOpTvQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691579821, "uuid": "5d5225e8-83a3-476e-9264-022413e10247", "value": 14969344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691579821, "uuid": "4b2631c7-a32c-47fe-8526-d9c90736ccc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579821, "uuid": "16a44b2d-9c93-4cce-9c06-05dcb8ef1fe2", "value": "ot3wt39vvarneae5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20453cf8-3705-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691620565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620565, "uuid": "e12ced8d-3038-40a7-8ff3-a78afaf41095", "comment": "Malware payload", "value": "9fb743a0d866a099ea65cd4d957e435b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620565, "uuid": "ddb014a2-9e7b-42c8-bb1e-4ffb03562c04", "comment": "Malware payload", "value": "815f7d2fc87f23faea6952e7d1351ac3d858f5814f8a22b818a846bd69d804b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620565, "uuid": "ff9d3fa5-cc05-436e-a338-ac6082c5779f", "comment": "Malware payload", "value": "2e135d976ac7dc1c31c7d647b94c3772670362c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620565, "uuid": "d0b1a0fc-3008-46c7-bb6c-4e32ccd0158c", "comment": "Malware payload", "value": "e6ed2b7ab2052d0514ed6a4bbcafd916edf04fbee10e6ba62a8c778fe7537ce9d125217160389f1f4ddba5728c83e76f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620565, "uuid": "5900bfbe-46a0-44f4-bd0d-a4d7264dcad8", "value": "T1EA731A46B8818A16C5D813FBFD2E018D332667F8E2DF7212DD105F6477CA92B0E67A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620565, "uuid": "5cfd113e-8536-4ec5-aeeb-59651cec427f", "value": "1536:CNncuHiWFmmhqbnI+l/s/Hw8oXHK+ZvNbSJaOZz1IhiJ4oe/efd42+:mHiWFhonI+qeXZlgp4oe/e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691620565, "uuid": "491c0a43-9d59-4d8d-a8d6-919ffadfb09c", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691620565, "uuid": "1619e782-4055-41b0-97b2-505bd1214c20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620565, "uuid": "402fa050-c059-4862-a4d8-6fd290f35b8d", "value": "9fb743a0d866a099ea65cd4d957e435b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61269b24-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602635, "uuid": "ae445b22-4334-4801-875b-a028e67daf92", "comment": "Malware payload", "value": "543fbea99ce5968873d9b46a566c8506", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602635, "uuid": "fef4690f-5485-447d-973c-6e8eeca27beb", "comment": "Malware payload", "value": "81c049a3459d1d2bc310d77b8dc146e84463e61e65e3eb64f664ab1298808517", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602635, "uuid": "a05a5b54-cd78-4c11-aea1-913d258469ea", "comment": "Malware payload", "value": "5318a9920745c041940fd1cf6ef621c9a73ec91b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602635, "uuid": "80bc933d-e10d-4321-8654-2e7c4d535c63", "comment": "Malware payload", "value": "a496a05c6266e0494f8ca509301841e96cd8194a41d913a979c551a4d9ffdb5b50b376f05180b38ad375310a56d261a8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602635, "uuid": "56814fce-9607-4d61-9b6d-0e66310fd22d", "value": "T12A8423178986EC9F8A9F30789E7B610C6DBB60EBE4079925E0D1A33C5ED430B9997C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602635, "uuid": "b14273f8-727b-4cd2-adfd-f8f709ec11cd", "value": "6144:XYIPsizfVfupTsbx+QJ84CYYp+fVErR/b/2IJhBPrYxm8ltkb8i+LFf5C:rEizfVfuWO4CYs+dEF/buIvBQbC8NPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602635, "uuid": "bfaec994-8b90-4d3e-84b6-4d02b68d13e0", "value": 374336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602635, "uuid": "a4fa86ae-e889-4780-8001-8faa55732d81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602635, "uuid": "45c45a58-61ef-4c23-aa93-542a0f74b7eb", "value": "Scan_0024034.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62419d44-36b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691585457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585457, "uuid": "bb33fcdd-08ec-49c5-a9cc-eb0d89d043a7", "comment": "Malware payload (RedLineStealer)", "value": "8883ebad022f1a4b6f8eeb52d23cff5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585457, "uuid": "a3395595-8d64-4923-ae63-17a4cd5d52e3", "comment": "Malware payload (RedLineStealer)", "value": "81eef97276bd4a5e6a5f6315313fb211156426afb6860fa57eac5f03c98c9cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585457, "uuid": "f2b273ed-dc3b-4b02-b3fd-2be09ab75760", "comment": "Malware payload (RedLineStealer)", "value": "28f6a0bf203b55139b3456c2440cf5a0103d23f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585457, "uuid": "b3eb32c6-4bfb-442d-ab54-542a327a3c06", "comment": "Malware payload (RedLineStealer)", "value": "069830f14b07627a1275024b09dc585937cf6650a80edf1baac11b9180089c6eca1e32b2b2fc45a7edc5e5119b5242df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585457, "uuid": "048d3834-1d87-492c-97ed-65548c7a8d86", "value": "T157E41207E3E8D532E875673048FA06A30B357DA05C69826F2349AD1E1DB29C4A57B73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585457, "uuid": "f2ebbe4e-ebfa-4652-adc3-d87754485062", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585457, "uuid": "bdc0c9ac-6452-4157-b050-eaf1c52d0a6e", "value": "12288:2Mrwy90vXrFKSkpC54s1jlTGiMzi3RHfDEh26MBxsDMhlMxF:KyYXD54sfTGZi3lfDC26MBuWuxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585457, "uuid": "30a50063-7b47-44da-9e09-e751c446e3cf", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585457, "uuid": "f0f82590-f487-4fa9-bd5e-2a0431cf812e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585457, "uuid": "d09518aa-4a52-45d2-a7b8-1bed1c353dc0", "value": "8883ebad022f1a4b6f8eeb52d23cff5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff8d819-366f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691556327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691556327, "uuid": "70056b1c-9a48-4005-8e55-f188067c8884", "comment": "Malware payload (Formbook)", "value": "c6b71acb6ebc1a3a81ab3aad0d520185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691556327, "uuid": "c2624c54-3873-4669-af9d-20f5c9edff4c", "comment": "Malware payload (Formbook)", "value": "8249e88d3b270dba037eae0a0308f828f87e6a5c2c61678ef4943293cbe26fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691556327, "uuid": "58009e16-d078-469b-b3e6-64bea210c9dd", "comment": "Malware payload (Formbook)", "value": "16fba75bf072b4de822e76bebb313bae46689f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691556327, "uuid": "3c455fae-257c-4071-ae2b-f7a2d78f1715", "comment": "Malware payload (Formbook)", "value": "a5c89d40da33632fd08de6301fe3be07d0ce307bc9fb434f09e92167398f47a899d4d4496881d9a0be493ec297aa7565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691556327, "uuid": "31465971-f99f-4bc3-866f-084267e245d7", "value": "T11B541201BAD18CBAD8670E310F7A5AA75EFAFE0208A7465F2B81372C7D77513A90D311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691556327, "uuid": "85791ed7-0e06-4d28-95d2-e339f52c181c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691556327, "uuid": "52bb6ff1-02a0-41c9-80af-260cc56532ee", "value": "6144:jYa6tQDznXayJ6k9wpwU5p1jlSdNu0eQiMhtyz2:jYvGjXRJ6kypJ/s/Re2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691556327, "uuid": "7a37d337-405c-4888-b447-a16b1763382c", "value": 293294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691556327, "uuid": "61b343cc-2a76-4584-8fb0-4fbfd50afdda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691556327, "uuid": "d62fed03-1675-4084-9428-f53214c9dea7", "value": "RVEG00123737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43391b7b-3696-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691572949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572949, "uuid": "891c45c9-7a74-4a6a-abb9-daccc9488e33", "comment": "Malware payload (Formbook)", "value": "bf928c0a4fbfd9b36c2d3fadcb99197f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572949, "uuid": "234cce94-ae8f-4eb7-a05a-d694d584d9e9", "comment": "Malware payload (Formbook)", "value": "83486e9c90423ff3dcd923817140140c22f5e77a84f87cf5301bba30453f5172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572949, "uuid": "d05d7058-de24-4bd5-9b75-44a595ba469d", "comment": "Malware payload (Formbook)", "value": "a5be83b11c53d3e5b1b34154625396f3d7211446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572949, "uuid": "100253ed-83df-4314-85cf-c9616b196684", "comment": "Malware payload (Formbook)", "value": "b1f79053efe3196c3d28c19f674d61b4a4bf4b4d02be56b08916f01a2a67a8860ca1e81a75ef11e3aaf1e211b9603a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572949, "uuid": "72b7d3ae-fc86-44de-832d-1b064257dd3a", "value": "T12004CB74A1F26AC9F896CEB29E61E609FFE70C819A41421FD17439F61233B84C6451FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572949, "uuid": "781621a9-e235-450b-9d88-20507bc9cc51", "value": "768:1atbrd+uZj3ViIisLk35bQzQ95snIIIIIIIIIZnIII2nIIIZnIIINsHIIILHIIIu:1a5R1ZjhGIBOrPaOYdSkjiRNqOP3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572949, "uuid": "ba5ea791-333f-4a89-8fbf-8157d938c546", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572949, "uuid": "435aceb7-66e5-4d16-b389-e7694c417ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572949, "uuid": "b3882d4f-d82d-4865-8c85-c5ceb7f9c463", "value": "N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912d373c-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691599709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599709, "uuid": "250a42b0-94b4-4666-a819-fff33a313cfd", "comment": "Malware payload (SnakeKeylogger)", "value": "3984fc648a194b8d22a4f520954b8daa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599709, "uuid": "47cbc8c7-bddc-4e96-a0d2-566ed8f581d5", "comment": "Malware payload (SnakeKeylogger)", "value": "83886cc5b64dc1581f187cda78cbd61800d0f785f1c95105d7065b308eeeebb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599709, "uuid": "d1953765-1302-46ad-8e4f-f24902984356", "comment": "Malware payload (SnakeKeylogger)", "value": "80edbb0b8460f847345cbd31c5e76c9b2e9c5b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599709, "uuid": "34c48a45-faba-4476-871f-5498d84de9ac", "comment": "Malware payload (SnakeKeylogger)", "value": "e1b0823b96cfea5f6edb090f4b08a0cda63c045a137e00848d438a28206aca0165697947e31e5f18b9abc8128ec586b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599709, "uuid": "90f1e10c-afa4-4819-8914-263363495ee2", "value": "T10C05383C15286A8CF3A486FCB6744CFF17A46D2F80BBF9F3984CA4D746A97D05502662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599709, "uuid": "6be7ed5e-0cb6-4ea6-8a53-ae0e7a173df8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599709, "uuid": "0663b7f9-752c-4f3f-b67f-a5ec80cd09dd", "value": "12288:fETnf9pEOSLYTZi3xvwQdzzH5V3hfXmpL5vCjBY1lt:f2f9pEO6YTZi37dvH/38L56j+1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599709, "uuid": "53df8c85-633b-48ed-9eee-38da314a890b", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599709, "uuid": "b6e5086d-2b9e-4f0e-8649-b42de3869bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599709, "uuid": "fe5cde0c-8d44-4d8a-a35a-9f1e7964558c", "value": "EJfOvqNUMfrYfsD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327cd849-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571633, "uuid": "bef529e0-7476-42d1-b297-498ca616913a", "comment": "Malware payload (RedLineStealer)", "value": "dc22ec6ed3105c299c8d5d7e86593b00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571633, "uuid": "492f1660-5566-41b8-b1ef-38730fd0e616", "comment": "Malware payload (RedLineStealer)", "value": "83bf42af69a87d03b2ebc530b383dcdeabe093979af37040ec4be747fd1b5e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571633, "uuid": "52588ee8-af6b-44d1-a722-1d2663f35340", "comment": "Malware payload (RedLineStealer)", "value": "bec58f1a001fc60dd8fc9accb279b89120072cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571633, "uuid": "4d8eb6ac-c4fd-4fb7-be13-b78c61a35c03", "comment": "Malware payload (RedLineStealer)", "value": "d2183cf3189f8f67b190eb6134f6b7006305892ba79270cae1a7fe80f80ecde50ccd24e3484152483cbc5437fb982d9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571633, "uuid": "45cfe97a-6877-48cd-932e-3eb819c9277d", "value": "T13EC41203A7ED4562DCB62B7008F507D30F363CA65D78835B274AA4999D732C4AA7273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571633, "uuid": "092d96d8-9561-481f-aeb6-1c624644f3ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571633, "uuid": "dbda8f52-1917-4367-b001-4b7329285e2b", "value": "12288:OMr2y90r5tWyITQCCPzmHnYskaFAgBYC0eq3ifKI2:cyYITQVmlvz482", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571633, "uuid": "dfb734b0-b688-4c9c-9fcb-2049dd276f38", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571633, "uuid": "18830af7-813e-4a55-ab43-e172c4c58df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571633, "uuid": "99f4975d-01e8-4894-a7f1-5f205f5bd131", "value": "83bf42af69a87d03b2ebc530b383dcdeabe093979af37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308032d4-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691571629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571629, "uuid": "c12fa5df-4138-4965-80e3-2eb1a725f766", "comment": "Malware payload (Gafgyt)", "value": "215cd9caca2cfefbdd18572ac3868a5d", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571629, "uuid": "88c4b446-f78f-4f9d-8b5e-88274f193c78", "comment": "Malware payload (Gafgyt)", "value": "842878c18aee84a296e37a6859147df2273d852b493bb4ba7d692f29d0380e7c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571629, "uuid": "6afedb6f-a834-4d3e-85cf-933a2f173fd7", "comment": "Malware payload (Gafgyt)", "value": "6287f382312a67cc8007cd942d564bb04668be6a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571629, "uuid": "e06d8655-a3ea-475d-b91d-4289e6cd4abd", "comment": "Malware payload (Gafgyt)", "value": "12739c6daca21d4d53aa1672d47033e96d119b4c0872d858d23089377a3bd5d88fa7c9ef6346e83ee1ddcdd194040798", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571629, "uuid": "0c001c48-2465-4ea8-bf7a-7eef913ee4fc", "value": "T13323F1036FE7427AF3DC60746CFE286F091A100D90560EF2AF9C6A3985B0E5A1B79526", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571629, "uuid": "07f5f5fd-5cb6-4746-9e3a-acacbfc5a0a3", "value": "768:nAXAtekmLaFvDmd4F1wDqtQUoX7wgExWAX1J79+2du7CEjp8vUQnbcuyD7UryqM:nAwek9qe1wHUuwtX1J82du7BjplQnouO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571629, "uuid": "231336ad-cfd5-402f-9edf-24616e449d3b", "value": 47368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571629, "uuid": "01f346c3-88da-42bd-b49f-0e51973c7058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571629, "uuid": "f3744f4b-6f75-4433-a710-3d3e53b4eda5", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990d090e-36e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606594, "uuid": "7633735d-dde5-4e8b-adb1-07c9f3ab8c6c", "comment": "Malware payload (Mirai)", "value": "59108cdc67ba0ce747db94c67e894e6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606594, "uuid": "6c9de2f7-681c-420c-906b-ec74b7ed3d71", "comment": "Malware payload (Mirai)", "value": "84628a9efd0e327dd7291f9146d6fda02c8f1b4c573c1b643cc60e7863eee605", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606594, "uuid": "124d45d3-d771-4963-b5d2-3dda2dd04827", "comment": "Malware payload (Mirai)", "value": "c4f64176ca0816b97f80ae6ea147897002fbcde1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606594, "uuid": "cf1b34af-a307-441b-9a6b-e91872f745d9", "comment": "Malware payload (Mirai)", "value": "98261559855fc730415220724e435850ee07336264cdcb86f0f9e5cb6be3a1b474fc3c73e82436149549128954178d5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606594, "uuid": "6260d77d-a5cf-4af9-a2f8-0dd598142dac", "value": "T152732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606594, "uuid": "76e8c9ff-d212-42f7-a465-0eea09b7b330", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9Wl:927jqCt8v3GI/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606594, "uuid": "155decbc-a061-4e64-893d-9492c07bd158", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606594, "uuid": "9248fa2d-fff4-4cb0-9830-66e57820938a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606594, "uuid": "d6921e84-b851-45fd-ab77-f8712d40ac22", "value": "59108cdc67ba0ce747db94c67e894e6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe06459d-36b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1691585288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585288, "uuid": "b10df708-dc84-41b4-9753-95ea19d59c4e", "comment": "Malware payload (CobaltStrike)", "value": "bff3120685dafe9e31206887df290c02", "object_relation": "md5", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585288, "uuid": "9fbd005e-fe3a-49eb-8db4-a1813e33c5ef", "comment": "Malware payload (CobaltStrike)", "value": "848323f362252e7704f024c82b362f1c512974b462e1bf8e9e4595464f074bde", "object_relation": "sha256", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585288, "uuid": "42c6e1f1-6df9-441e-9b27-ac63249afa6f", "comment": "Malware payload (CobaltStrike)", "value": "b0e77766317be53990ff0f3bfc397ea06304a07c", "object_relation": "sha1", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585288, "uuid": "44cc37d3-3fe6-4cfb-a77c-eb077f0ef371", "comment": "Malware payload (CobaltStrike)", "value": "15fa9aa19d71443265b63a9abb5a886d397669e1b9bcd9e5e2e293e7eaec06ea10f5979cbcf92c839f40df16de19f7f3", "object_relation": "sha3-384", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585288, "uuid": "c0c2f4ae-8ddc-477a-a80e-599b842a3a14", "value": "T10EB63947F85580E9C5EDD170CA299292BA703C894B3073D72B60FBB92B36BE05A7D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585288, "uuid": "a83a8b45-c32e-4780-8b33-7e8903156576", "value": "ff9f3a86709796c17211f9df12aae74d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585288, "uuid": "2f910816-e318-4604-8f6b-480b27ae7788", "value": "49152:JM2fECg63nOYO1rrb/TXvO90d7HjmAFd4A64nsfJvlTUWpGBwCRMq0O4kdgYg9j4:n37D+WzmC8saFioUhvlE1ui5wOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585288, "uuid": "dad8c5cc-a5ab-4576-8b42-d75166e11cf5", "value": 10890240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585288, "uuid": "ad37d51f-4d2b-4d4d-9799-e2f9b3f7c81d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585288, "uuid": "57b41019-a070-4e7f-b09c-255e4821e510", "value": "LogonFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd026aac-36b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691586065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586065, "uuid": "e3c72fc1-fae4-4c91-8e7e-a7bc94afdedf", "comment": "Malware payload (Amadey)", "value": "e587b80a42e65ee47548f1d97e936a19", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586065, "uuid": "ceb839ad-07b5-47c3-ab8a-465a95a9aef3", "comment": "Malware payload (Amadey)", "value": "851dc931bab0c274d5b2af548d030ccb29f5d73ca44c9c96c598b383f0f0b323", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586065, "uuid": "7efee88f-352b-43ee-9a2d-7604164d412e", "comment": "Malware payload (Amadey)", "value": "2a7182c28d837467b5256e46df0c268d5d5d81ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586065, "uuid": "3381b88f-e0f1-4054-8e5e-bde0cb52025f", "comment": "Malware payload (Amadey)", "value": "24b889016c2963f018597236887a0c57290a3788457349a9dd546b03617db8cb0fa5e13f3a9d7b1acaa6b2a2b4dd851a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586065, "uuid": "1427f5a5-d62b-4298-ae77-edf1336451e6", "value": "T1BDC41202E7D98073C9B037B06CFA06930F367D95A978826B3346A55E4CB3550E5BA73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586065, "uuid": "996834df-421a-49ba-af9d-83e9f4171818", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586065, "uuid": "0376eaca-a81e-4d87-ba43-7ee0b390e1ed", "value": "12288:tMrly90CCP0G0WPsYY0q47wNFX2HzEzA5pwsB0P/yRr:4yYMGY0qwWFX7z0wVyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586065, "uuid": "b52b5a28-d7f5-4724-8ba6-0618adf4432e", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586065, "uuid": "eaf6a835-8fda-4e27-9cb7-e082bda1fa4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586065, "uuid": "bae49cd4-7986-4a47-b423-281ea4374812", "value": "e587b80a42e65ee47548f1d97e936a19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e3a737-36df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691604334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604334, "uuid": "e6ee77d0-aace-4479-b984-b6ef06e00255", "comment": "Malware payload (Smoke Loader)", "value": "fe0ff5a1d60878d6fcb20d31189ae6f5", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604334, "uuid": "d1ccaee2-a147-459c-9ee2-92659b90f2e0", "comment": "Malware payload (Smoke Loader)", "value": "85c917e7448dad92ecc81787e6441b6b9caf55bf49b706aee38e8850691ab042", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604334, "uuid": "3f24ed3c-ae34-4d91-bed1-6b2c3b693322", "comment": "Malware payload (Smoke Loader)", "value": "b397f40acca91c7ad2793d26b2a67e2ec8e4b766", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604334, "uuid": "5112860e-7018-4853-aa16-7d9dc5863545", "comment": "Malware payload (Smoke Loader)", "value": "9bc06297e363b8c9bb60b1361c97fc4dc9ca391a333de3da46eadd8f02926f68ce533d545544c9893453ae5e5969746c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604334, "uuid": "b636863b-e51c-4039-805d-c0ae42614c14", "value": "T17F44DF21B5A2C032C49B1D708834DBA0BEBFB8365775854BB764177E5F703D19A7A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604334, "uuid": "d74a7e12-f66b-407d-ae2d-593198fa7815", "value": "21e75c39e5b8b26ccac618e4f1755b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604334, "uuid": "fb5d2715-9ad2-47f2-9271-56b6ec90da56", "value": "3072:DGaXuJTL6ZObahHLxGGC+VRFtIHPFrUIMZvMSaWS0b6X020Sb9tF6yY5xbIOw2o:DJuhLH6LxlC+vWvdSb6XXLb5Q4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604334, "uuid": "2b55700a-a879-4942-9702-0cd39b5676ce", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604334, "uuid": "fab8b7d0-968a-422f-a6bf-7765f1cc8281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604334, "uuid": "db28b806-9006-40a3-801d-15f8e30be81d", "value": "fe0ff5a1d60878d6fcb20d31189ae6f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae46925c-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691599757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599757, "uuid": "e9b78bba-17b5-4bf7-8c14-1049df23add4", "comment": "Malware payload", "value": "c2d9f35e62935d3b41736fabe6175eac", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599757, "uuid": "f8c4b67b-ddac-4237-9bbb-855870369ce1", "comment": "Malware payload", "value": "8649463969233ad84c867e3764d7fa6d95016747914fce9345ed8f568d3a4a43", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599757, "uuid": "288f5daf-fa84-4f4b-8bf1-e33bb9e8628d", "comment": "Malware payload", "value": "761dece3c7d5c164591ad2d854bceb07dce0fc1d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599757, "uuid": "a74e6d9c-d5df-43e1-98ce-38b7952b4f7e", "comment": "Malware payload", "value": "6cb83e1c512dcef9e726609968425a98cd207d3847368b26db319b04552c6de9e3b0afb81accb79779ba9cfc2049d1a8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599757, "uuid": "d03acc2c-d436-4d1b-aff7-04cbf4f60f21", "value": "T1F6150103E900DB83D40D83F87D930ED60F0AAF19ED9969D715527F9B3B70B6209AA52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599757, "uuid": "c4d9c33a-794c-44f1-89c0-e2cb5d043049", "value": "24576:O0Zyqw6VCjKaWlEzp7acHdlPZb1QA3Qp5E1IwWx:Ome6VCjKjOzvdX1/3X1IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599757, "uuid": "c7e47933-ba73-4992-a17b-3123621e3806", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599757, "uuid": "9d3f18a2-092e-4826-b3fe-07f87da8952b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599757, "uuid": "a73509e9-54c2-4e7f-82a5-975fb1852fe1", "value": "Invoice for Quotation of Sept order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1cc986-36cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691596878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691596878, "uuid": "a9f1daed-629c-4c31-adbc-344bc8085fe8", "comment": "Malware payload (RedLineStealer)", "value": "63cf02e5cad34ec14cc86f8bc936f79a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691596878, "uuid": "9ddbd020-c821-45cc-975a-f3d573b969ea", "comment": "Malware payload (RedLineStealer)", "value": "86660b9f1f14b717bc5f25895048b8b0d1e31f2087a608447090aecb2500fa03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691596878, "uuid": "c57e1a3b-4112-4d5a-b138-2cd3a73790e5", "comment": "Malware payload (RedLineStealer)", "value": "c10b33218457f5350f4bfff88aeda7598e7ee5b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691596878, "uuid": "374ed827-de20-4c3c-bef4-680356c978e7", "comment": "Malware payload (RedLineStealer)", "value": "863ea986e4cc4e409d9065c4ca9d546fd4b723d02cd5da8018a1619a5860aa58302c02ba8fca452bf5402f617b006c3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691596878, "uuid": "356dfcbc-0894-47e9-8f57-d3041cc0a0dd", "value": "T1D1C41212B7E98532E5A92BB05CF512D31F36FC71E97483AA5392894B0C725C0A471BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691596878, "uuid": "e6f4f264-ee84-443d-abdf-3f2d83ad469f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691596878, "uuid": "3ab4286c-706a-48b2-a3d1-5affe57523a8", "value": "12288:UMrTy90eL/llyTf+hn8om/PTLyRzJRC2M:ny7lc+h8oesC2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691596878, "uuid": "be4e67fb-5dd5-4728-9ef3-3a8544964f52", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691596878, "uuid": "1332b593-63c1-44ab-9e1e-e85882046260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691596878, "uuid": "66384367-cf84-4cc0-9a3e-9ed090bd9cd8", "value": "63cf02e5cad34ec14cc86f8bc936f79a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40247cbf-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691602579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602579, "uuid": "a6229bd1-38ff-4bcb-9048-6d9993f70b73", "comment": "Malware payload (RedLineStealer)", "value": "077c48a53b5ed5096d64e33d20172be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602579, "uuid": "a96e9fc8-5504-48e0-b78a-85a87160006f", "comment": "Malware payload (RedLineStealer)", "value": "86c78ae23af928cf789193e8392ef108567ea9cbb5f6a846a19bd17605429ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602579, "uuid": "7c843ee6-aefb-4415-8f1c-dd8031392fdc", "comment": "Malware payload (RedLineStealer)", "value": "8ffbecb5389103affed1d0f088f5eb4119650456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602579, "uuid": "da7ebb39-8ddc-4aa9-829a-46557b21601c", "comment": "Malware payload (RedLineStealer)", "value": "ae12d0fde51d8cd6df582fc154723a3505a9d00dea2136e097a4dac883271177e084e312a35f3aa092a63f6358c59d82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602579, "uuid": "c6671a8d-f747-456c-8501-900b70fd0c2e", "value": "T15B13F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602579, "uuid": "2a165eed-1d56-43a1-a528-129f3f19a98c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602579, "uuid": "a311c35b-1fe0-43f3-a71b-b6102270aaf7", "value": 42061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602579, "uuid": "41c5b3ba-0fc3-40a2-b38a-27343da82cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602579, "uuid": "34e3bd67-293e-4b7e-90a3-e87a7529c2df", "value": "077c48a53b5ed5096d64e33d20172be8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affbc462-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602767, "uuid": "33038cec-bd42-4199-b119-4bc37506171a", "comment": "Malware payload (AgentTesla)", "value": "b0f8a6b66bcce02b26ef77827b3ae9ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602767, "uuid": "29f95daa-fa92-48cd-933e-581b44a27b85", "comment": "Malware payload (AgentTesla)", "value": "87426f179dc002c1acca9d50fcf76cad614a4eaf00b81a4a960840ea9d3fbb0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602767, "uuid": "0f4c8611-52c6-46a8-b70f-d49d5b8d4647", "comment": "Malware payload (AgentTesla)", "value": "1b0742f34f262997912e698a589968a3c83fb4ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602767, "uuid": "fff51cf1-9a76-4361-bddb-03106a9bfb43", "comment": "Malware payload (AgentTesla)", "value": "af95b90b3a0f6f9f6c127dd8d5d0a5ec45bf8aa443cfc77028492b22cdc443b775f99db73cfa339c33ca2fff9a9ae1e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602767, "uuid": "7d8b3d04-a324-4c49-996a-d26968008be8", "value": "T14A05E0093114C589C5FA25B6E850A1F80FB7BD25E831C24F9AEE3D6F3BB36564D00B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602767, "uuid": "d16280be-2cf4-4e63-9e18-0946e8992bce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602767, "uuid": "6f7bf738-88a0-4572-8e1a-d33315ba3263", "value": "24576:iIaik1YB0ogi2PSG0SKi6agyY2q20WlJ:iIaikqBFgtPSn1yY2q20WlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602767, "uuid": "9aa8711c-164b-4663-ab88-7b7bc15f3a0d", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602767, "uuid": "bba3287c-7ee9-4cd3-a06b-d1d5a8a9ecad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602767, "uuid": "6196cc78-0744-457a-aa9e-7d8825b41708", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778373af-36d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691598377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598377, "uuid": "25047619-b487-41b2-8b0c-e714bc29a41c", "comment": "Malware payload (RedLineStealer)", "value": "a3e6766523ce231310b1d74ddaa6d775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598377, "uuid": "87f08963-f81e-478e-a947-18a6e2f57852", "comment": "Malware payload (RedLineStealer)", "value": "8790aaf10b3552f961b17fde1d93e5f1d16b6e631f72ac92a8f01fc8ceff75a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598377, "uuid": "7bab3bdb-ccd4-4a99-83f8-5d71eb7ed899", "comment": "Malware payload (RedLineStealer)", "value": "995c486883e483b6b89280f8aae9539494f99147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598377, "uuid": "fba1ec6a-6449-4df8-a16d-c61c5f1e8c91", "comment": "Malware payload (RedLineStealer)", "value": "bec6df444db650ebf8c05e9bf09cfac6df044c8c6324866f9909145ab026b1aa79e6e17b702818c647a784553673e86e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598377, "uuid": "37b39429-0fbe-4885-9292-0d8b82ee3d0f", "value": "T1C7E41303A7E94472E9B52BB4B8FF19830B377DA0997412672395AC0E0CB37D06576B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598377, "uuid": "2e1afe30-e8b7-488a-b3a3-41d021664410", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598377, "uuid": "519e653d-0018-485d-b437-863c29549ae2", "value": "12288:cMrby90/dSI7mluNMxBgyuUHBAHCSB28ZnU5fo3fp:Py4VIFuUHB6qinUifp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691598377, "uuid": "6bfc0071-15d7-43dc-8615-12f3a71a7603", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691598377, "uuid": "bc3d4f48-14c0-4fc9-85f6-c669016ea7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598377, "uuid": "732fac3f-6235-4c11-a1ec-48456b6bcc10", "value": "a3e6766523ce231310b1d74ddaa6d775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9c3edf-364b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691540756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540756, "uuid": "6ee4443a-c85a-43e7-95be-bfb247ae28b0", "comment": "Malware payload (NetSupport)", "value": "f8bf0dddb23f80f69552a2fb661393b5", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540756, "uuid": "8646387a-b98d-463d-9c92-8039b64dccfa", "comment": "Malware payload (NetSupport)", "value": "87a2454abaea25f30348e0662010cc32789ca71faf0151c5f0e151fba6859894", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540756, "uuid": "ec1950ef-9f52-4dc1-839e-e0ba2b9e8bcf", "comment": "Malware payload (NetSupport)", "value": "c5354a9a7c545e5c36aef9b09870c3cb10f56cf3", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540756, "uuid": "fbe24c04-bccc-42e8-b7f2-5b2d6a0595ea", "comment": "Malware payload (NetSupport)", "value": "903b2da425336af37cd4e1fd99febbba0a1476ec4b18d0ab4bb9b28cc5f0b1828b1b0980ad86038c3287a60531ad3e8f", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540756, "uuid": "bd62a911-9487-49ef-a1d2-0d3d9d1f029a", "value": "T1F8C08C24811FCC78C82B4A1D4A0A8D7CA82610C1225EDCB146A41AC8BC4282E6E884D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540756, "uuid": "41bc7246-86c3-4f0d-ad98-dc9f52f678bb", "value": "3:HRAbABGQYmimiLXIhzKEgOMGHJdEPUo1YSo/QJ5eQvyYesbBSn:HRYFVmizLXczfX5JAISoIJ5eQvyYesbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691540756, "uuid": "8357869e-0b8e-4e1c-87d4-0446cd3faf13", "value": 151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691540756, "uuid": "9c811746-bd13-44d4-af08-b1e20d218eec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540756, "uuid": "1acf515c-47a0-481c-b8d0-fb9c973a0ad1", "value": "en-win-upd(localchr).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a29a62-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1691574936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574936, "uuid": "03d54909-fc43-4ad9-b98b-ff75dbdab90e", "comment": "Malware payload (Gafgyt)", "value": "42856abf3cfa807e13cf5502ec430219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574936, "uuid": "6bb75451-6601-4e54-b283-003086c77195", "comment": "Malware payload (Gafgyt)", "value": "883f2486275374742931944b6ec56dad9d5ae387487635e863422acb667b62d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574936, "uuid": "76e1bfbc-6a00-4916-a5fc-7e2a84874447", "comment": "Malware payload (Gafgyt)", "value": "ad4a91820df3c96f917870988c96c44f865e8c6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574936, "uuid": "b786daa5-a8ab-49ca-8dfe-3ce951202aa6", "comment": "Malware payload (Gafgyt)", "value": "4591766c0826df053749bd0374f21a199d2dbb181f9598d6969b71db4c5dc09fadb9221649759f19035ae904d5b78ea4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574936, "uuid": "46a9fb4e-de79-401b-995b-db97ace45302", "value": "T104348227E6130866E65448F121A73250ED97837F98FA22C3FD561D90FE7488B22B7ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574936, "uuid": "721a35fb-cd22-48db-b67c-a75de2679bff", "value": "1536:o3ThWb3vMXnuBl1FApRN95qCBfOtxnbtmeZXKNFnKjGdxOXzx5:Iwb3EXQvMRNPqCibnancqIXF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574936, "uuid": "8511d7d0-66ff-4ab5-ae54-b1198af09565", "value": 241816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574936, "uuid": "98b80390-5132-43be-ace4-c50ccf068b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574936, "uuid": "1de4a321-55e3-4afc-95b6-8ce5b7c53831", "value": "42856abf3cfa807e13cf5502ec430219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4569dbaf-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691559209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559209, "uuid": "4b36d36b-3b37-485f-bddc-989fedeebfc1", "comment": "Malware payload (RemcosRAT)", "value": "56bd266756b2db2299634328a3d3d403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559209, "uuid": "fdab221e-385d-40ab-a6a1-923702107e5b", "comment": "Malware payload (RemcosRAT)", "value": "8851e86e484da01c9cc4aafb401df05999ea4d61c128a236ef9d002a13aeda78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559209, "uuid": "bd485e42-45c8-47fa-87df-f4e8c36862bd", "comment": "Malware payload (RemcosRAT)", "value": "0fa2bc173e57b8f28fb4780ef6c7abc17052d811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559209, "uuid": "390c137e-3e78-4f68-b855-acbba27ee02a", "comment": "Malware payload (RemcosRAT)", "value": "1fe6ee26af2cd653cab7dea6b8ac781d781b671d3fc1c9ca45d352b146648dba27f16076cba2b9b512f86c4ff0a837dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559209, "uuid": "37b38398-37b4-4f39-93c2-9a69b0251049", "value": "T12B357A7C15296E4CF3A486FCB6748CFF17A5682F80BBF9F3885CA4D706A97D05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559209, "uuid": "d271c062-ff29-4f27-aa5e-7afa3976b823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559209, "uuid": "8dd9307f-c9d6-4852-9720-4bdd96720eec", "value": "24576:KDLypEO6YTDVPE+XvDw+mRoLmHc/c/y3t6p7lNKBA:KSpEeE+7B9Lcq3t6RKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559209, "uuid": "530ef4a7-46b7-4e70-ae11-7199964da1df", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559209, "uuid": "acaa95ef-07f1-4667-9754-2960fb6d966d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559209, "uuid": "dc655b4b-0c64-4160-95dd-2101a634f28e", "value": "KWITANSI PEMBAYARAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36ae5d6-36bd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691589968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589968, "uuid": "fdae8a7f-d455-4556-95ac-aa9f24b33214", "comment": "Malware payload (RedLineStealer)", "value": "7e3fbfb6f9328561e3822a40be029fe2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589968, "uuid": "a36a8bb1-a4b2-402f-8d9e-2727b5d6474a", "comment": "Malware payload (RedLineStealer)", "value": "885c188632feceb2e0a61c9dc246017dc64cc197458df2199aae241b678186e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589968, "uuid": "5eed9caa-0950-4036-8f15-4ebf9dc17c79", "comment": "Malware payload (RedLineStealer)", "value": "8523e4018c27a2dda8102d9fe2f5bdbc17c30c05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589968, "uuid": "8b30bfb9-fe39-4061-82a2-ad4b140c2c3c", "comment": "Malware payload (RedLineStealer)", "value": "7868b815aeb5e9edc8d453106ff034b8199120ad8508b739a8600b7b6513a374ec9179473af99383506f5ac60db08dc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589968, "uuid": "901272d0-61dd-4ef9-adff-5480edb9e7dd", "value": "T11CE41212A7E84563C9B517B01DF712C31F31BCB1AD78931A22DA951E0DB3790A936B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589968, "uuid": "24faa23e-99c1-4a5b-b523-6909848125a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589968, "uuid": "f93d4709-0dcf-40d3-8922-751762573d63", "value": "12288:BMryy90TZAI2FxO+NNRo2mYS/0DbLeupiEzO9NUWk03/9AakqWw+cTaq:byw2FHnLmYS43eiz4Npk0PKw+cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691589968, "uuid": "d895259f-47eb-402e-8b4a-d040f99cf60e", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691589968, "uuid": "967eb92f-588d-429b-8243-b39bac52fc19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589968, "uuid": "ef409dfa-84b1-4d15-ae36-69f4a1b8c7ef", "value": "7e3fbfb6f9328561e3822a40be029fe2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e30a08d-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691599731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599731, "uuid": "b0afbde2-66dc-406d-80bd-ad9191f0b7e3", "comment": "Malware payload (SnakeKeylogger)", "value": "884232f05d51ec126225150de2cebde1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599731, "uuid": "dd616356-3edd-474e-a294-549ff76c7721", "comment": "Malware payload (SnakeKeylogger)", "value": "88bc72ae9a0b0d840a8f21a46ff816226ce6b694eaf3005529972a92f8883e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599731, "uuid": "dc164041-e6ac-4a97-80f0-8af7872c3129", "comment": "Malware payload (SnakeKeylogger)", "value": "656dc91439888aa07ade61a4953791b208533fe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599731, "uuid": "072c6d93-de12-447b-96a5-d8fa55e040e1", "comment": "Malware payload (SnakeKeylogger)", "value": "ef9a8c0b8a08a9a88d9604b85ac078641e298af6bcb828371012f95596baae9ae7a41d32bcbaadc5d375d4bb2781dae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599731, "uuid": "a7e400b4-9a48-479a-970e-5c21fd62da90", "value": "T1EDD4593C18BD5E23C075C6F68FD5C061F694C5EB32A28F665BC39A95061EA0229C7D3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599731, "uuid": "a02615dc-f805-434d-96ad-6749f81cbc98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599731, "uuid": "0d0a3d09-c395-42fa-a0a3-33eed2a0a366", "value": "12288:2ymS2iNkHzMZlW1rSaS1y4kKLuqWAO33YAmQ59mDZE:91iMZlWAac99O33YAmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599731, "uuid": "b0f81d35-011e-4480-8a66-840b829ceeeb", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599731, "uuid": "17bd8751-70f6-4346-9a38-ae8a48fd3434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599731, "uuid": "dff9388d-68f8-4848-add8-09753bfcb7d1", "value": "884232f05d51ec126225150de2cebde1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d576ae-36b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691584179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584179, "uuid": "d6b3ed85-1029-4c33-acd5-ed69915f4cf0", "comment": "Malware payload (AgentTesla)", "value": "eb4c0330f9f27406088265104d485e45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584179, "uuid": "0943d1a8-e027-4714-aa52-99ce065dbf75", "comment": "Malware payload (AgentTesla)", "value": "88c478de6ffe4700471cbbc62204d37fdc2e1df2ed7c7361543ca4dabd6e9087", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584179, "uuid": "5c87f701-1f8f-4588-b444-2bab490b4e50", "comment": "Malware payload (AgentTesla)", "value": "adada153778f0d285c59fb96ff0618f47b783aac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584179, "uuid": "8f94fd94-a041-48d4-a19e-def0db43ee84", "comment": "Malware payload (AgentTesla)", "value": "82b26a607928b8e96c6df55caf2f421794deebdfff5403b54e97b5b0ea2d95ab2426e0734c4e001e860b780133fb3847", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584179, "uuid": "497be38a-d647-4fd2-8931-eb80c76ad72a", "value": "T1EC157D819A1825D9CC64CB351736DCFDC8329DB8567C582F28D87F2B3BFEA95102981E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584179, "uuid": "695d6f56-8707-46e6-b910-0bf7a90d7724", "value": "12288:v7BixLRkCMGEFOFknig0q/iySCpQlp8+yMKHFfp5Xh4gdbzsm7PHDP7r9r/+ppp6:v7BsLBMGMOFkiDq3S/yrp5Xdzsg/D1qS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691584179, "uuid": "eed69146-d880-46b9-9f8e-5be37559c971", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691584179, "uuid": "25ca33cd-1653-46ac-8d42-53d07e00ae0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584179, "uuid": "c0e36c85-5d4e-4e7b-903f-4051c2eb8380", "value": "BOARD PO 8.08.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e0a173-370f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691625007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625007, "uuid": "bb55990f-73a3-4981-832a-d1e5d754a961", "comment": "Malware payload", "value": "2ec19a8c17cb3725ec200244e803235a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625007, "uuid": "042ee5b0-19be-4036-a792-120b5992d342", "comment": "Malware payload", "value": "88fc38818a0b0e00c74129139dcb1a5cfc0bd04eaf042069781e5745db974896", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625007, "uuid": "3b8e9371-3135-422c-9f1a-8c39fb10c6df", "comment": "Malware payload", "value": "17997f162a970f666e6a947d9d63db51f307ddae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625007, "uuid": "4bdd781f-fcea-4df0-93ff-142574512911", "comment": "Malware payload", "value": "ece3f327aa6b5c80da80e63a4ddaf3515be62c5128127d8f8880e15f32102259f125570661dbcc29b7d9728e3f6eed24", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625007, "uuid": "69596d68-14ca-42e1-a106-d07f6c0eb2a6", "value": "T1E6234BC49A43EAF5EC120A7420B7FB335B37F07A5159F987D3659932AC42B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625007, "uuid": "99262df3-001b-459a-8daf-6e84ccfc2df6", "value": "768:c8/MjSNW4GBs82WELXamRnWzqNYeZjPhFEwaKXg+ZdG:c8/MjSNW4GBz3ELFpNYeRhRaKXhZdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691625007, "uuid": "01429c71-e77d-46a8-a2ed-b42cb661f2a5", "value": 46640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691625007, "uuid": "92f71e46-5eb0-423c-8cdd-ae4eee6c28cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625007, "uuid": "2a7570da-b10d-488b-9c32-0c5d77155e37", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5797752b-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602619, "uuid": "19dd70de-e385-44a8-a7b0-7e5d583257f9", "comment": "Malware payload (AgentTesla)", "value": "6e5609ade9c5d99ced6b02c8cf088d99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602619, "uuid": "b4ba019c-1b73-4ed5-a92c-4f5be82b8e06", "comment": "Malware payload (AgentTesla)", "value": "8918e98db609f1554686926f48a64e4d5630a34db89e03b6439d9cb4aeed0ce1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602619, "uuid": "9259dfd5-0251-4c7a-8dc6-8672a74a3ec7", "comment": "Malware payload (AgentTesla)", "value": "31c4384efadf816730f159ee41258fd3c41b4534", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602619, "uuid": "5c53cb0e-86db-471b-a0a6-e074d6a856b9", "comment": "Malware payload (AgentTesla)", "value": "9a329dd93eed7486020e1a04de6d2659fddcc2f2b93a6b0cba50c54bd5f114cb33b72bd1050e789286bc73dca42f2f33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602619, "uuid": "614d0f3f-3f0f-48ce-b466-5a1d378ea128", "value": "T10984CE64D2F15A674AC2FBEA35022C2C818D2E8386C395F4840C96F5D7F7EF99635C62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602619, "uuid": "4d810a48-ed25-414a-b320-2a565d2ab569", "value": "6144:LtYhqEziSlNEgEijvQXY43ledYlZYq/E8Lj1KWsHxJNw0:LqHPEgEijv+Y41ed8ZR/KBrC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602619, "uuid": "9fa0f3d9-b9a0-4b56-8381-526300357d01", "value": 374634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602619, "uuid": "7812b6c5-4dee-43af-8850-76cbbd35ca3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602619, "uuid": "96580331-02bc-4564-a86e-f86c2c525b41", "value": "FA150623.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231a5094-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691559151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559151, "uuid": "5942e6c9-b5ee-4ea8-ae8c-04f50fb0b34c", "comment": "Malware payload", "value": "2af93ff580d5d57508098fb1e073a160", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559151, "uuid": "4e58cb4b-c642-47fd-9835-58045e85941f", "comment": "Malware payload", "value": "897465e9560c4f3e1dc0dc36d0eaf0931631fedabc46270e56e723ec4c1da3f6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559151, "uuid": "ed83257a-4e82-4d1d-973d-681b1b5d07e7", "comment": "Malware payload", "value": "ecc8b2e7b3112bddadc279328a760cd3d6285392", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559151, "uuid": "0adb90b9-5bb7-46f6-b192-10f9cb8f1603", "comment": "Malware payload", "value": "5e7e446a8342a027831998a35ad6cd9391cf5a792f8152d2a414459961c0e54a93fd00646355c2288c9cadf6b577ac82", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559151, "uuid": "e122a263-7076-4a1f-ad83-21b24143f1a5", "value": "T133F423B41B0447A9DBEA6D713E0432D872BDB75F528067516E961A3F0B723FC6A4C20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559151, "uuid": "e4539ecb-bf86-4944-a21e-0dfb0b61f810", "value": "12288:WxhaSdNngVLeSOQp9kxnhMRZF6QBWnw5UyanGMiwofPd6hbdZF:ah7ngZnp9kGj6CUoMijIhbdZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559151, "uuid": "37f84d00-522c-4df9-a271-ccc6698e3fd6", "value": 740278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559151, "uuid": "c0c845cb-7d60-4636-a720-fd39464a6b20", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559151, "uuid": "223ad028-508c-4bff-a7e9-d4b4663bef96", "value": "Revised PO-TXASSA.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b23f24-370f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691625005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625005, "uuid": "b7bb7c33-d3fd-4320-8f40-f9d9fca37e4e", "comment": "Malware payload", "value": "e021b1e9d383aa720e866cdfff073c73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625005, "uuid": "9a26e04d-eff6-4f9d-8571-c12e050a8582", "comment": "Malware payload", "value": "8a02df6eda7c646f944e22a3af1568c68b82b9b4466593ec60f4be0038d8ab09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625005, "uuid": "bbcb0a87-d35d-4e22-bf50-b8000c0dbc67", "comment": "Malware payload", "value": "e2966a67bd1357757907a0832afa8cdc5d51714c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691625005, "uuid": "b19e8c54-cada-4faf-adb6-82c69286cfe2", "comment": "Malware payload", "value": "5ea549592ff15c2d4e067dd099ee92d699d781719c3354070d65469b44113abee79bf589095a9a79c107bf414a3663a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625005, "uuid": "ffafa052-d445-49c6-ae23-4851e2c58b01", "value": "T10BC34B46EA818F13C4D5177ABAEF424533239754E3DB330699289FB43F86BAE4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625005, "uuid": "c93c01d6-8cd1-4db7-8654-570f0f177259", "value": "3072:N0C9mNRfMZJwoy3xfvY0NWRTl05z/QLM/9a01U7:N0CUfKaoy3xfQkWV0z/AM/9a01U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691625005, "uuid": "8d152273-f1fb-4d80-8eb8-4da7cd9d475e", "value": 126743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691625005, "uuid": "b9b3f2d1-51c2-470a-8bb5-b96069238e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691625005, "uuid": "2c621beb-a9f1-4997-8cea-dfcfe0191afc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b858a904-365c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691548235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691548235, "uuid": "6711cbc0-0602-40bb-be11-1284ee48ff01", "comment": "Malware payload (Amadey)", "value": "aa14a3de7da6af0a3d192c86b8ef79b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691548235, "uuid": "d64cf23e-50b2-4563-86f4-2fa588b7afa5", "comment": "Malware payload (Amadey)", "value": "8a1640e3f411bfda8da2d5d864f540593c41522ae41fbd2d70c3604541833f69", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691548235, "uuid": "04226ee3-b0f5-4f71-b20a-190497279447", "comment": "Malware payload (Amadey)", "value": "c1b5890975407a62b5c61810d04d4a6e2dd1fa7a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691548235, "uuid": "f4e9ea8a-6160-4cc1-8c03-90177b59ae37", "comment": "Malware payload (Amadey)", "value": "cb85d6fc8e008560ea26bd7e08d7bc2c1eb48409a77432e3c4762b722b297b09eb474dea8d2b0007773e0f96e3ba59ff", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691548235, "uuid": "fc557e59-866c-4c7d-9fcd-d2cd39b46bfd", "value": "T15913F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691548235, "uuid": "a00aab7d-c601-412b-8db7-7ad372faf4df", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691548235, "uuid": "bf2c2ba3-4ac0-4b3b-bf01-2a888642e5b4", "value": 42041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691548235, "uuid": "1f512c09-dcb0-4f65-b862-b4599e7a3ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691548235, "uuid": "3d7c8ccf-a52d-4391-9fe4-dfb28b45f13b", "value": "aa14a3de7da6af0a3d192c86b8ef79b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb88cc6-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691559355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559355, "uuid": "0701c199-d5c0-4ff6-a604-8bd10034abfe", "comment": "Malware payload (AgentTesla)", "value": "7b5e7e8179d5d0307c6a665a17b35e68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559355, "uuid": "e8692ddd-d920-4eee-9d45-77acbd54f29d", "comment": "Malware payload (AgentTesla)", "value": "8a216f81e5d30e4a0039c641570835fa74cd12c17d6bcccdabd7f612fe526c78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559355, "uuid": "388a1315-2774-4d78-abf7-ddee9793278e", "comment": "Malware payload (AgentTesla)", "value": "ca7817eba0f7838859d1d9c3648f093ba220bf6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559355, "uuid": "21a7e495-dfcf-4959-b7b2-4b78e07cbdb2", "comment": "Malware payload (AgentTesla)", "value": "3852fbb833a0e9a07dacb313564eacab48a9d75844bc6c8de0cf9ae6bd4ed1b91cd23bdeea372d5f1d07ed1c48519fdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559355, "uuid": "ea976b35-2ee0-412c-838b-132d621cfbf8", "value": "T1FD251921E3BB2455EF16E6F88E1F853278D9EC80F0F1C59863E6294385C2351DE25BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559355, "uuid": "c888ff99-41d9-4692-9546-606ade1a90ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559355, "uuid": "5f829a7c-3098-425f-9727-9eae66cb3398", "value": "24576:Qro1C141C1kRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOaOgubFpp71Rt:7MaMGRs6CE3jLbO9Rs6CE3jLbOSu17mM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559355, "uuid": "2600cd81-48a9-43b5-bbb8-456bdcec6681", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559355, "uuid": "65b93d66-3f99-424a-be47-002406bdc4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559355, "uuid": "51a2c3f6-555d-46e2-a7c3-d77033703fbd", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea575e0-36b0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691584135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584135, "uuid": "3b0a8a1f-9ca3-4343-bf3a-f0acf645999f", "comment": "Malware payload (AgentTesla)", "value": "b1fb79296c9e73619438b4d8fdd92c19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584135, "uuid": "1d5cf9ee-c51b-4425-9f60-752f65f27811", "comment": "Malware payload (AgentTesla)", "value": "8a3030938e773f36a46ae376e6076bb5fc9990c35bae7763b8d6bd4efc7e6bea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584135, "uuid": "a6a2f9a1-f92e-49ed-826c-2f6026fc47e5", "comment": "Malware payload (AgentTesla)", "value": "acace60ec78effe83843e60df9b6709ca2efb869", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691584135, "uuid": "eafcd041-5c1d-4448-a0f4-6c533285ba4e", "comment": "Malware payload (AgentTesla)", "value": "c44fedefcbf7b7a040746c3fe1edef89cb9d11e0e0c9bc2c5198e7b45e28252033a2eced29e436937e7791405ff1d7bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584135, "uuid": "93a6b094-f26b-4692-9706-ab1505e0dd98", "value": "T1D5150822E77B6559EF29A2E84A2F847179C6DCC0F1B1C588B7E7680385C23114E35BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584135, "uuid": "a9fbddc4-7ef1-4f34-9245-0fac2d656dac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584135, "uuid": "3f6ff9b8-9ed1-4978-865c-0f611cea4201", "value": "24576:FQYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOoOguYMHiUuj6mJRXR97:FhRs6CE3jLbO9Rs6CE3jLbOwuYe86CjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691584135, "uuid": "02a6cb1d-893b-4b1f-8e5f-3444547fd3b7", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691584135, "uuid": "1d2f7693-a595-4b71-bb99-a2950b9beb2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691584135, "uuid": "07fd94ba-5d51-4b54-a6b5-3a6a3ae44185", "value": "SecuriteInfo.com.Win32.PWSX-gen.27008.19376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a379134d-36fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691616490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616490, "uuid": "a08428bc-a9c2-45eb-a99e-79f68fa7a424", "comment": "Malware payload", "value": "32779bb4eda0b1834dc50d88f4930c3e", "object_relation": "md5", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616490, "uuid": "a5eebe8f-3769-4b9c-a873-1591269268ac", "comment": "Malware payload", "value": "8a93eabf56949eb69dc5c81a39645fec215d967d126751a8bb72e2f90a3c41c7", "object_relation": "sha256", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616490, "uuid": "4fde60a7-2c2b-4fcd-94f5-2ddbf07048be", "comment": "Malware payload", "value": "7041fb14c8593d2657d4244d6930a35a2745f96e", "object_relation": "sha1", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691616490, "uuid": "cd5db60b-d188-49df-a354-23d5ed48797b", "comment": "Malware payload", "value": "d66cca4b95391e09a7af65bbf1cd4f5264d039f00b4f7606331b55802094388d49ffdf2f4807831af4f582217325bcbd", "object_relation": "sha3-384", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "darkgate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616490, "uuid": "24945bbd-c1f9-4aa5-9f30-9115e9690598", "value": "T1A1946C36F590D877E0314E78CC4BE2E9942DBA702D3864477BF81F4C9A792826A1B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616490, "uuid": "30a32d89-ff83-42cb-a276-0dde7c3eb39d", "value": "466caa9bcf5a9905cd00c4e158069662", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616490, "uuid": "36eed230-be3b-4fdf-9978-20a3a45004b0", "value": "12288:ObfJmY1oCMa3Wyex7ykWynLSKJ13oqnuj/ro:O7bKCM0ax7ykWynLRJ1Y+uTro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691616490, "uuid": "a1056e45-5d94-4cfd-a232-e94f60259a79", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691616490, "uuid": "9d171745-cb64-465e-a804-dd610fe9aede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691616490, "uuid": "e59e109b-d3f5-4ce6-9bea-319b390463e8", "value": "stubbed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aef92d5-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691599698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599698, "uuid": "2f9e0c13-16b2-46ee-8c71-1948babb1fd5", "comment": "Malware payload (RemcosRAT)", "value": "8a4e1f3276cf0675cfca73e56a33069c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599698, "uuid": "231b11c2-e1b2-40c7-841b-d6856673ad1d", "comment": "Malware payload (RemcosRAT)", "value": "8aae048958f1eb9e76e5b01174d4055763e4af720d0b48c4e2741ee7da3bc222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599698, "uuid": "3bdb2a39-0aff-4fee-9434-5e3af11754f1", "comment": "Malware payload (RemcosRAT)", "value": "2f3a4bd105af7fadc5d6b0bc931da8ffb8260ba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599698, "uuid": "f4417db1-500b-4c8e-8e21-c311b3694ea6", "comment": "Malware payload (RemcosRAT)", "value": "6d8f6cbbab33bea885f7d4242d01c5f250116b7086c187365bb96356cd027c586f12c22c1fad61a729f1b835d6d0005a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599698, "uuid": "bad4dac6-fe70-4a48-946d-8e103e6a4d4b", "value": "T1E515231432AA495BDA7C5DF9AB9D080487F3669F4436E1CE2C8254C7A2F2F01DE50E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599698, "uuid": "4d230e72-1aef-4ac2-b5ea-f6250169fe24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599698, "uuid": "3b4598c4-d01b-416f-99be-afa59efbf892", "value": "24576:ON6YTAOWckJsZikpoQi2wYpjvhVEjC4GW/ElUnV:OEZcPdu2wEL35SJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599698, "uuid": "d5c4ce98-1702-4499-8d96-5b5b31d5d778", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599698, "uuid": "44dcef88-1f7d-4189-802b-5cb14efc1090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599698, "uuid": "1eecd255-66d0-404d-b238-2f9fc0756634", "value": "8a4e1f3276cf0675cfca73e56a33069c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3012fbc-36b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691588169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588169, "uuid": "98759638-1d71-4ba8-ae59-fd639612bf62", "comment": "Malware payload (RedLineStealer)", "value": "e39e8276f13e16d64efbb0b9e15f8023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588169, "uuid": "c4078f5d-ff0c-4996-9940-435581d88fe7", "comment": "Malware payload (RedLineStealer)", "value": "8b7517d0ac5e978b41047353ea040f6c7b59e51404e04936f450bb0ab418bc44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588169, "uuid": "58d74bb0-7588-4e75-b045-ecb7715206f1", "comment": "Malware payload (RedLineStealer)", "value": "ebf30ad3b1d508969262b53dae18c934a322cae8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588169, "uuid": "e948305c-f11a-4750-9684-d969075574d1", "comment": "Malware payload (RedLineStealer)", "value": "39a2701f0709220f4094496413f2961c5596f1f9f1f8d088edbbc25c17676663584d6b13aee68cc8fe21a41b785d6897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588169, "uuid": "d6d5f461-abdb-4cd0-bfee-4f8f1c281c8e", "value": "T153C41223A6E99073DDB61BB08CF603870F37BD729971433626869D4A0DB25C4A67173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588169, "uuid": "16b7f48e-9372-47f8-ac66-f78c40fd3d64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588169, "uuid": "4932aaf9-d9ac-41e0-b579-09ea50af1c01", "value": "12288:HMrwy90Dh6BXAv6uTns/Z5g5l3xtpBIT8b94kvXb:PyY8BXAv6gnQYpBIiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691588169, "uuid": "1a88bdbe-c659-42cf-9a94-5597e6b7231d", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691588169, "uuid": "e6663499-a5cb-4594-8558-45f0becdc2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588169, "uuid": "3b39ce99-24ae-404b-90b9-5ab4a3581c9f", "value": "e39e8276f13e16d64efbb0b9e15f8023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06eaaf26-36a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1691578861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691578861, "uuid": "c54ac654-ad0d-4d3b-a62e-aa97af17f509", "comment": "Malware payload (QuasarRAT)", "value": "ad323eb8e26b79a8943b71313db6bf7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691578861, "uuid": "97c8077a-c059-4dde-9e83-e19e9a4f0862", "comment": "Malware payload (QuasarRAT)", "value": "8be4c83e8b2dfc0c98e9789d9b230601a953b2ea7159249600eb7a30a02d69fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691578861, "uuid": "fd89d327-d75c-4630-a40b-5a9a58c6b6f0", "comment": "Malware payload (QuasarRAT)", "value": "e4bc6022c879b1aeabf5dfabd5c149066dca2801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691578861, "uuid": "f5037954-4b1d-4dcb-b309-532ba42c7494", "comment": "Malware payload (QuasarRAT)", "value": "2400f2bc1aa52846f7837588088e1eb356de1408de5bd7159b3b20c3cc1a8761db00f974a24225dc5c3cbab10d942435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691578861, "uuid": "f9349d73-4dd1-4b65-9a76-b3d4ef29e0ec", "value": "T15586335B2BA214F4F9B3463D8583906ACEA1FC220798CB6B16F493644E137D3AC2F755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691578861, "uuid": "afb922fd-1dc7-4f39-aa70-fa405d8911ba", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691578861, "uuid": "1db31354-142b-4301-8d47-f5e04038f7fd", "value": "98304:ORzdbM+Q2y+CrQjOjFgFQlwq4Mjk+dBZtu9xTtwzGaer6/BXr2ZF9slh2meUgMGt:O7VOjmFQR4MVGFtwKPCr2R0uUbk8h1+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691578861, "uuid": "d227562d-3871-4a44-9108-7be56143edf7", "value": 8317307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691578861, "uuid": "cd6a099a-816e-40a9-b67e-69eec87af689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691578861, "uuid": "04cd52a3-8b27-4e68-ad3e-650815ad0c35", "value": "ad323eb8e26b79a8943b71313db6bf7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6003fefe-36d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691600056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600056, "uuid": "af603a69-8e85-4604-ab3a-d001f65eb606", "comment": "Malware payload", "value": "6038fb0dd91fa1e9cca80ea225d8b59b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600056, "uuid": "cd6ea98e-3de1-4a80-9154-1cfed1f8078c", "comment": "Malware payload", "value": "8c01ef8b6a9cfa7a80fd5bcb640d68a63ef17dd25ea3e260c7971b1fa156c8be", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600056, "uuid": "e6ab8c20-eeb2-4c82-ad4b-3cb12b9511de", "comment": "Malware payload", "value": "98d630a01d50675988898185ac8088673409c8a0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600056, "uuid": "f857322c-d12a-4d0d-9dbb-449512e5c658", "comment": "Malware payload", "value": "d17392ac274a378d410d688863f5c88c9eebc803d3aa26daa6fc5b9ce6f84511da08919cb42cfba35571d6de0e5016d6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600056, "uuid": "417ed612-2e2a-4ebb-8442-40de8031bba3", "value": "T143E6E064F4116938CFF59EF0E35B2A3146A80B6AD3F56C887DD526840EF4989CB87BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600056, "uuid": "5493becf-ef58-4b06-a766-386d642536e2", "value": "49152:M5GNLRU5j+hFQA5PciFvXMhLxxzesjv635jG4uJHsHNZJXC1aQ/9beTR1FL/BqkY:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691600056, "uuid": "6164e808-a57a-4a64-a1eb-a85901c093f7", "value": 14575694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691600056, "uuid": "4190061d-f8da-438f-888a-8f9db3fa2b0f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600056, "uuid": "ba2a814f-0774-46f4-9369-9e751c611e91", "value": "Uni.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16184421-3691-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691570726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691570726, "uuid": "84ae587c-d2d7-4721-bf2c-ff363c5f7766", "comment": "Malware payload (RedLineStealer)", "value": "80b5259923b8014af8964192d1a7765b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691570726, "uuid": "6afc6cb2-9ec7-4982-90f8-cad6e30dddf3", "comment": "Malware payload (RedLineStealer)", "value": "8c7d18a973709669f7f84e2e2046af115b85b2cbe938ad5719953baed63b6c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691570726, "uuid": "e8f70fb8-309e-4d26-ac51-7cb91f64cace", "comment": "Malware payload (RedLineStealer)", "value": "130e58ace75fcffe01f6abb5482cc5feac96750e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691570726, "uuid": "2f7725e1-1e0c-43a3-af4a-3c0a6a265ca7", "comment": "Malware payload (RedLineStealer)", "value": "ca365a3bb8c5dad0df520a20f89f166175088bceff2b2d34b7ca395ed6dd65da5ef9546831af2aba70f151e3f86060ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691570726, "uuid": "4e688246-5c2b-4ec6-ba23-88f0a4f4f618", "value": "T189C41212A7E48222C9F0677058F707930B337D96A97883672746A96E0DB2AC4F53573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691570726, "uuid": "10ef5159-5f58-4bb2-8a79-07834eeba01a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691570726, "uuid": "aaafae1c-5beb-4de2-9064-7da272bef841", "value": "12288:4Mr6y908Pijy0JG9wEwzYhBM1k7xXALwUN+E7UNTv53N8dm:SyOjyzdw04stAL/N+E7Yz53Om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691570726, "uuid": "378dc37f-9301-42ac-b3b3-bcbaa1036fb0", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691570726, "uuid": "248fe3b3-6e66-40ed-b54a-0c90a070cdd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691570726, "uuid": "adb1173f-26b4-41aa-8960-f7f222e57ff3", "value": "80b5259923b8014af8964192d1a7765b.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53d6b13-3679-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691560766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691560766, "uuid": "8b28d19e-398d-44a6-a912-68236dc05c52", "comment": "Malware payload (AgentTesla)", "value": "f46867432dd7f3b315b6c29d52ed0edb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691560766, "uuid": "bf1eea8d-144f-484b-a37c-2de771c018b5", "comment": "Malware payload (AgentTesla)", "value": "8cdb891ac842d6460bfa4132614dd084e690bf4a9160515fb0bdba5dc1f58992", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691560766, "uuid": "4eb94d20-24e9-433f-8366-9d34fef9dd87", "comment": "Malware payload (AgentTesla)", "value": "7fe27e797731e6fb03e87cf39b9dd974011b8102", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691560766, "uuid": "67ea5496-8cc9-45b8-86ca-ee16c1754bbf", "comment": "Malware payload (AgentTesla)", "value": "afca9ce88dbd5d60f580e1f01ae82f58d9c5ba65fdbc9b3d2f3444ac9bbf33b62aed64e32762d135dd2cf4f225acb3fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691560766, "uuid": "50e83f79-3ba8-4d17-8935-8bada415ee26", "value": "T17253E16DD34F02A9CF5253779A1A0A4946FCBB7EF28512B1346C833533EE82D912627D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691560766, "uuid": "2506806b-f2c6-4d04-a731-6551b759bb29", "value": "768:VwAbZSibMX9gRWjOaPCBI4zE2L7MEFeqo:VwAlR3PBI4NLgbqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691560766, "uuid": "e54c2245-27b5-40bc-a67c-00eca2f1b4c3", "value": 66420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691560766, "uuid": "cadd81b8-fa25-4ca1-ba16-b40fc2aa4172", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691560766, "uuid": "3dd9377c-7455-4cba-9892-b2fbf7b602dd", "value": "f46867432dd7f3b315b6c29d52ed0edb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e5c423-36b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691585191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585191, "uuid": "3e92078a-fe1c-4e31-84cf-ae9c93625456", "comment": "Malware payload", "value": "bb7237eadf1c85fc933b38db86a7d7f9", "object_relation": "md5", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585191, "uuid": "cb08f16f-786e-4b86-a3d5-fd5469d6dad8", "comment": "Malware payload", "value": "8d3fb9a982adb40df649c633644d18d7470edfda1c4db353c38c407854125c84", "object_relation": "sha256", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585191, "uuid": "98b302d8-3024-46d6-b6e5-84889f7b7491", "comment": "Malware payload", "value": "0c4f498e9bff46f45b26633139ff3b9805563a60", "object_relation": "sha1", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585191, "uuid": "73f491f7-d5a4-4a05-a35f-00cfd8e45397", "comment": "Malware payload", "value": "8758fc7810c82b847273118ac1a90be23a91742cf12ad150b144cbad62b23ae310a1d045ce03f7c941857f8606d6d508", "object_relation": "sha3-384", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585191, "uuid": "e025697d-7373-4c3e-8df4-ce62c3e38aa4", "value": "T1294633F98B3F6B737AF6033EB3934605A3C65964D0CD81219F1D479B993FAA01858C62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585191, "uuid": "39887c17-118f-4932-9b65-4ae25bd56a5b", "value": "98304:73jnUqYaHzye9y+e5NbV1o2KDJ6wi76b7dCnHBrQJc1JQjzOp1rOOUnd12:73jnmGzye9y+eDbV1SJdQs7eY0OjzOKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585191, "uuid": "5c0c6d3a-edf4-4502-92a6-fb7ffed8aff7", "value": 5638560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585191, "uuid": "e5af4a6b-7ef0-483d-8df3-e33f6982a382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585191, "uuid": "dd9f0dbe-52f7-4b37-b80b-b7f89e1c519b", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f00c58e-36cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691597477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597477, "uuid": "0e04efc6-94c7-4535-b261-ca9676cef8b7", "comment": "Malware payload (RedLineStealer)", "value": "7bd22c9fac86b86013382c95546ba753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597477, "uuid": "a32dee1b-a40e-4a75-bfea-810febce25e2", "comment": "Malware payload (RedLineStealer)", "value": "8d8d79c68e3c97e4c0960ffea04b5c2f76dabbd6ae9c0110c97017ae17a5a8a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597477, "uuid": "b3bda8d8-28bd-40b7-ade7-08ebd28d751e", "comment": "Malware payload (RedLineStealer)", "value": "df9e3cc8328fdaef1ffb1689ff818407fc0b8150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597477, "uuid": "766e50da-df3d-4638-a3fe-245b5694ba8f", "comment": "Malware payload (RedLineStealer)", "value": "e66aecc681c4727ac48a639b87ce3a395166a3f3de677cf40ad54cda987cf11e68eb5ac0e1326eb29ae500dc8ef25162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597477, "uuid": "fb446b47-076e-4745-94b0-ba6b6050f701", "value": "T147E41203ABED4161EDB25BB0A8F707831F367DA599B9832B3786591D28731C05A32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597477, "uuid": "4072cbf3-09d6-4aa7-add8-7c3dc9cee76b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597477, "uuid": "f7634058-218d-4c07-9b5c-9721bb2641ee", "value": "12288:BMrky907LXzbyS0CBgqwGIPcR/5vocNvFSjRHYZTb1:ByIKS0CaqwNg5vNBFeHYxb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691597477, "uuid": "f32d4904-5483-45b6-903a-dad09405aef2", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691597477, "uuid": "636a5fba-7954-42a0-8f9c-0b4e0c17ba14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597477, "uuid": "3d2e0c28-37e3-42fb-a2dc-2dd04f6d339a", "value": "7bd22c9fac86b86013382c95546ba753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e143d5-36a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691579453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579453, "uuid": "dab7b2ae-b678-4497-a2ec-d50c5064e206", "comment": "Malware payload (RedLineStealer)", "value": "0daf96e7900f83efa25a3f02d22e92c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579453, "uuid": "7fdb183f-8c58-4841-8276-6e051259f02d", "comment": "Malware payload (RedLineStealer)", "value": "8d916548da0704efb4cc0c403a7d6c45f33242b4f703579cbe37815405ea0cbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579453, "uuid": "823c49c4-9410-48f1-b271-611e062e354f", "comment": "Malware payload (RedLineStealer)", "value": "dbafb3a12f26415a1fd2ef19c26680e10a083bcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579453, "uuid": "75fbb6bf-ea76-425e-8688-7eb7618b0d73", "comment": "Malware payload (RedLineStealer)", "value": "0800b3a497f3c55792fa9921940ab8b65f106d020a647579f50afebc10ca5830e5e153977fafd5135bff379354eb6b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579453, "uuid": "e58cde19-59a2-426e-be1f-eca7135b4533", "value": "T1C1E42352A6DDC532D97427706CFB02930B3D7CA15DB4437B6B89960E0DB36A0983672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579453, "uuid": "bd6dbcf7-2928-4fe4-b0c9-9d9beaf0de01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579453, "uuid": "b17ec924-0e47-4cd2-958b-4f85c334243b", "value": "12288:rMr7y90NPKOjABWhDL8QEi7VCHX0VnQv6re/Rq1/:gyEAM98Q+H6g8vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691579453, "uuid": "fae57b2c-6eb9-4eb3-90db-02ed4f8cb8ff", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691579453, "uuid": "67c93961-26a2-449b-9d14-928e853f123a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579453, "uuid": "a1ceeefd-cded-4657-9047-f6b258501a1f", "value": "0daf96e7900f83efa25a3f02d22e92c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf99796-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691583914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583914, "uuid": "95ef8c1c-a2fb-45f2-a65a-330cbf03cf1c", "comment": "Malware payload", "value": "b4fe8db07a590864a968bb6a44416549", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583914, "uuid": "91624052-ebc0-411b-b6e3-f1cca6fa1fa3", "comment": "Malware payload", "value": "8e3fccc24097d7b8b4a784a1060e629b2e71ced25cac713858688e7dc6f93095", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583914, "uuid": "ca3dc80c-057e-49f1-8f3e-64b31ab48329", "comment": "Malware payload", "value": "23a11152bcb7529423627bebc95a9dd2537ab3e9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583914, "uuid": "e06521f9-e5f3-4d14-a805-5da44e1c1381", "comment": "Malware payload", "value": "fc7319b17edb46d8171b0f2ed3439383e7c727bf934e149961c60f4426c3757f6a847aa27b71f646b64030a2235998a9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583914, "uuid": "8f041abf-e5a1-4ae2-a6e4-7b8f175b907f", "value": "T1EDD4338E49EA5ACCC56315B0D78095039A8BDEB3B32E81171DECC2EE93E70C924D7657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583914, "uuid": "b0640456-0b41-4334-8752-af4518b8199f", "value": "12288:RgFELvfFklmEscSSC3eelFKdPH2E/t6cG6llIvv/7DkCj7MIh6YBXgOyR:RvHGFs1OelFKdEn/7D3jhDyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583914, "uuid": "ab4c514b-3c19-47f8-a1f1-048156ce1878", "value": 631856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583914, "uuid": "f6900e98-2f24-4f22-a03f-7339f942aa3b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583914, "uuid": "7374f415-9e02-4de3-9872-9d1f9696e4e4", "value": "Factura_809373.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f185faab-36b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691585267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585267, "uuid": "0d6e906d-727e-44f7-aede-5bff3051c8d7", "comment": "Malware payload", "value": "7b11b11cf7af5f4d644ced5f0eaf997c", "object_relation": "md5", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585267, "uuid": "2c9cec7b-4901-4275-8c3c-ed6183318947", "comment": "Malware payload", "value": "8e3fcdbaec14002a141801dee549108c959a718e719dd03349a9b010ac0d34dc", "object_relation": "sha256", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585267, "uuid": "343f3854-51d4-4c5d-a24e-742feeca5a82", "comment": "Malware payload", "value": "8326eef026ba5a01fe40a685041a83df9d629f79", "object_relation": "sha1", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585267, "uuid": "d31edbdf-bfb8-44a2-ad2e-c6f2500d5801", "comment": "Malware payload", "value": "080eaf5e740b0667ebbfd1ac26ee00ca5979374cb25fc9b681ea973fdaeeeac0d385ff3fae38786d63cfc9a2f699ec38", "object_relation": "sha3-384", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585267, "uuid": "89df0140-5faa-4d21-87ef-d27fefa14320", "value": "T15B116317161A3861CAB1997EBB80D51F444FFFB7371720B443AB4D2A2452913AD2CD96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585267, "uuid": "bc6fe67a-b445-45e3-9098-740a865ccde8", "value": "24:capq9Kkm/uJsGtRqnPpoHD5fxEjlrcitGELv:cR9yua3U5JExrvPLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585267, "uuid": "e91bf564-3c8b-43a6-b886-beea6e753fb6", "value": 893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585267, "uuid": "f0cd8a41-a6c5-45d8-8369-aa1a23c19c70", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585267, "uuid": "dcd3771c-5df5-44b6-8795-7cc4eb37a207", "value": "payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77873531-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623288, "uuid": "60280ae5-0842-4d5b-ba9d-5751db7e287e", "comment": "Malware payload (RedLineStealer)", "value": "6b16de6653cbfaf135ccafadc30e50b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623288, "uuid": "3be4fc0e-a626-4424-9872-c66ad06a5bc7", "comment": "Malware payload (RedLineStealer)", "value": "8e43ed9ebe6eb9da5ced18d33aad3a77a2f3664e837f8a996d70189364ca9cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623288, "uuid": "d20353ae-1647-475c-8399-126a7b2a2cb5", "comment": "Malware payload (RedLineStealer)", "value": "397099a666706b43ace5faadceb1fd043d8aa36a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623288, "uuid": "be63a140-c813-43f1-8775-aa9a27a99b83", "comment": "Malware payload (RedLineStealer)", "value": "b6ce45cf48ca1d4023c1d0c43b55cbb22af991ae5ad9be670d0afc6938d5749ca6f74f44be1902d24af70509bbe1282d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623288, "uuid": "a25cbe68-20fc-4dc4-a374-448911306923", "value": "T1C9C40212A7D94572D9B06B705CF612831B36BCE29D78876B3246D81B08B32D4FC7277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623288, "uuid": "0e925e54-8c70-4b13-97e1-a51ada94148d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623288, "uuid": "de6bf4be-477c-411a-86c3-07054bba58a9", "value": "12288:RMrGy90+WFoJcjs3MoGu7CPz14ygBYCHZwDQRhr0j6Jyo:ryrGZo4Gz5Rhrlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623288, "uuid": "57244bc6-82a6-4584-9eb4-dd1fa72dd706", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623288, "uuid": "d8b5c199-7a6b-46f4-9d61-9727873fe82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623288, "uuid": "8ebbfff2-c1ae-4a9f-92a6-06b1c86438dd", "value": "6b16de6653cbfaf135ccafadc30e50b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bce2e98-369f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691576829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576829, "uuid": "51a786e4-73a5-4927-9cd2-60bad133391e", "comment": "Malware payload", "value": "4a3e22f24c328fd3d94b0b9c75dd6cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576829, "uuid": "0d7f2438-6047-4af8-895d-dae5c65120d3", "comment": "Malware payload", "value": "8f31efc0991ea71d13f39a6edd80656fcbbaa24bcd467b4cf7ac325b46409bea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576829, "uuid": "5308a701-aa17-48a4-ae6c-57f045559d0c", "comment": "Malware payload", "value": "dbe71c4259e3a47f4272e6f1a586000467a913dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576829, "uuid": "c4d00fac-fa14-4de1-b0b8-96f413d658c8", "comment": "Malware payload", "value": "e7fa1fecd204b1f8d012cd1bbf5cc3461f769763a056538454a7753050ac25c4d9442460d6d4bea166354bf1b6f638a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576829, "uuid": "0d0fce39-434e-44fc-ab2e-91022fc865a7", "value": "T1F616277B376602E1F126CD78C58E4D03D5B1300287D25EDB901A8B6F0F7B2EA5EB9A54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576829, "uuid": "8e599570-b537-4002-92ca-82d64ab644de", "value": "0e7b145b4d0926e262d8144893339fd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576829, "uuid": "6aad1e6a-2d89-4131-a026-4e02b554b406", "value": "49152:0hso+zITHufcXq4sxEgAdqSg2M7XwAXIzOwR1RFp2PK:kO+ulAYHwlOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576829, "uuid": "baffb806-0d23-4e23-b303-1c0dee97c05e", "value": 4174848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576829, "uuid": "94978dbf-545f-42ee-a904-7b49604ea03e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576829, "uuid": "895cee9a-5b9e-4034-ad56-3ea0316084f9", "value": "CEWE Fotowelt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb731989-3664-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691551676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551676, "uuid": "27912e7d-2582-44c6-874b-78572e6021e4", "comment": "Malware payload", "value": "6791bebd0a9a21b59f615495ea3f5ada", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551676, "uuid": "63abff5a-cee0-4c18-9322-7f3a4673ab59", "comment": "Malware payload", "value": "8ffd3c7299740ab440536b572273fbb6a728adea8bb12540a57af37f3378d956", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551676, "uuid": "73377fef-aa18-42ae-98ce-2ee95306056e", "comment": "Malware payload", "value": "06de9b966feaf4ea32b8e5b0bc3b14a4e222ebb5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551676, "uuid": "4f6a571c-a693-41ae-b61a-2d447babc74f", "comment": "Malware payload", "value": "d5806e5330667c2be71d3ca57ed1660be807dfe4e6b95556b9390567f36f0bc16e1890f39cae11887f713ed8670c45fe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551676, "uuid": "4772b70b-deed-48b8-956c-08d49c91ae4e", "value": "T12E2375C0078DCFAAF21A34B844846C315DE469F8736F95A5CBD68D9BC41DEC522A0E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551676, "uuid": "8312380d-c777-44ac-bf51-c69123455bcd", "value": "d8ce9fc3542a0847823df385d3c8424f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551676, "uuid": "40fac8b7-8bd9-4e6c-bb29-0c832060f6b7", "value": "768:FROpdxSkb3Frx4BEhJ9tOzfn+vYiYhTvuJ7pqR5Yrm6z1DFwpN1Y8kFUgjvS9/dp:PUkkb9K5jnKwTvu0mrmCC76NXrS9/aC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691551676, "uuid": "6424571f-c058-4e16-bd36-1da241e87581", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691551676, "uuid": "bbb124ae-39ea-4fbc-a868-b80bc87e736e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551676, "uuid": "d459249c-3992-4ba0-a344-da91f859447d", "value": "SecuriteInfo.com.Win32.Evo-gen.17635.23758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13ce6f2-36c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691592971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592971, "uuid": "7153f360-bebc-4697-b7b9-d31686b82003", "comment": "Malware payload (Amadey)", "value": "1c42cf5a1d5d75397a6a072cf1eeb847", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592971, "uuid": "869e6508-9139-4f97-925d-8ef203a4d123", "comment": "Malware payload (Amadey)", "value": "901dfda12a83f178e68f9fb4c344e1746956a3414cadcc1629da7a1f8f61bdc9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592971, "uuid": "5fd11e3d-3391-466d-8793-9dfeb58c25fb", "comment": "Malware payload (Amadey)", "value": "163234d1597e8154c1385d9178cfe61995885e4c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592971, "uuid": "ced3552f-5cda-4176-a8c9-2c6aa7cbba99", "comment": "Malware payload (Amadey)", "value": "27ef6619969dd065c4fd8bb04a4d206f6544c3ac4a4d78eb7908b3fa21f94c95c5d2faefefefa59572ef0e830e071654", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592971, "uuid": "ca40ff9f-873c-4813-8ed8-218650bc3ac6", "value": "T15AE41297FFE9812AD5B96B701CFA12D30A367CA54975931B2242AD0F0CF3290A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592971, "uuid": "6cd93993-38eb-4531-83a7-2a1b59c63086", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592971, "uuid": "8497df11-147a-434f-8c1e-469088dc2539", "value": "12288:NMrqy90mhOO6uruVEx0vK03IO44X3Q0+CdxDWeNmlImOnK8:Dydl6uqKQIf+6CdxXme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691592971, "uuid": "de3104a2-8e59-4cf9-9563-bc64b5abba78", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691592971, "uuid": "89d63786-ee44-4000-a03a-293579852903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592971, "uuid": "fa1800c3-ac9d-4a3f-9dda-744ca6a28ad4", "value": "1c42cf5a1d5d75397a6a072cf1eeb847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a6e579-36b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1691585303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585303, "uuid": "f9852cc0-1306-4f30-837a-ea0d6c5704a0", "comment": "Malware payload (CobaltStrike)", "value": "2c3231b88b767d7d01eefbd05868b3a8", "object_relation": "md5", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585303, "uuid": "9abf3b00-c193-419c-858f-c99a94eff02a", "comment": "Malware payload (CobaltStrike)", "value": "90f54fa2d59842359840b4dff68127bfe0a1f34fe88c0079fe516c9119ffc90d", "object_relation": "sha256", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585303, "uuid": "a2543c47-2bb5-4c20-a8dd-1ac39004a591", "comment": "Malware payload (CobaltStrike)", "value": "9ffee579e27f7e658a2f8130d853d34e773a9c28", "object_relation": "sha1", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585303, "uuid": "8abf61be-efdf-4769-b896-458994539778", "comment": "Malware payload (CobaltStrike)", "value": "e6306fad3c2ad29f16ced556d9b99aa158becc55d60ac5c64a18a66bf7eb17744c2502cc8e327823f0c391f871370d80", "object_relation": "sha3-384", "Tag": [ { "name": "150-158-212-71", "colour": "#F52A8D", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585303, "uuid": "df95a31f-bf38-4100-9a2a-1f0b24d93e48", "value": "T13BD5D9711653FCBA2AADBC815004BD688CACAA5B17244399B7CC70F635AD9D4CD2CFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585303, "uuid": "583a468e-cb9e-4eaf-85ef-c6ac1d3db53c", "value": "24576:zNAAb8qgTiiPJQ7ATsutd+6ZTE814Az4wm8fzBXokSGikMaLch3RGW1a37D:BymqS7AW8TEzcFSlDhRJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585303, "uuid": "6cf38749-5b49-44b9-9453-c91c848b96a0", "value": 2779156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585303, "uuid": "677e763f-e144-4d43-8a1b-fd7b1e7053ed", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585303, "uuid": "0f0d79a4-1ea3-467e-be55-210530cb82f6", "value": "loader.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aed495e-3705-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691620582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620582, "uuid": "69c59608-3537-4c4b-a49e-d2dc100174f0", "comment": "Malware payload (Mirai)", "value": "8596b159b93a5dd6d904063425c554bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620582, "uuid": "a873ed62-c902-4b03-b3c2-819be56b4687", "comment": "Malware payload (Mirai)", "value": "91299819fad0491760f199263dfaa1453d5111368573522ffbe59383181b00ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620582, "uuid": "9e38c3d6-f402-47d6-a450-7a99d63086b4", "comment": "Malware payload (Mirai)", "value": "038a9ecb194a1230f3085d3082bbc23d12774884", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620582, "uuid": "f40e8d85-b58d-415f-9a61-6e35b2d8b03a", "comment": "Malware payload (Mirai)", "value": "dbdfa3533847e5b043fe776b46f8d4b336e42a34f118b42e2bcc690261c395f4466ae07c1fa06ff948430cf774cf289d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620582, "uuid": "c4b6dd59-a1a5-49e5-8823-8b5c72535ef6", "value": "T1FB633AC19D43D8BAEC2119713077EB33AA36F03A212AFA97E79C56269C46E41D5073CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620582, "uuid": "a5544056-def8-4d56-99d9-1872a0b9f000", "value": "1536:v2141NG8mBkRDv6VLrcLdhNgkfAVTFuSpF4Aqki++GsYbogEJ6Yy:v214bnmBkRDvqcLnWWUPp6Azi0x8gEJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691620582, "uuid": "ae69fc42-56fa-4612-9891-fba01f04e4c9", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691620582, "uuid": "11911b6f-9ed9-44c0-8548-180d26c83edc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620582, "uuid": "54846c74-e4b4-4ec7-8508-9a993ee9b96d", "value": "8596b159b93a5dd6d904063425c554bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20098265-369e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691576326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576326, "uuid": "5251df65-fdbf-46f5-a3b1-1f931d0858f2", "comment": "Malware payload (RemcosRAT)", "value": "b69e85ad67286d92958d4849b2865682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576326, "uuid": "5875f591-a3e1-4286-8c93-ef80e0efa4ae", "comment": "Malware payload (RemcosRAT)", "value": "912dcabc2feb02fa2ba9794b2b6f3274281e2821aa9cfed73c94e99a30f7d1ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576326, "uuid": "a779fbac-32bb-4654-b573-bd6c28b48bbc", "comment": "Malware payload (RemcosRAT)", "value": "c1059a86d9f8e1750a860330834d7b1090494289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576326, "uuid": "36e64d32-336b-4ab7-b151-7bba33c6267b", "comment": "Malware payload (RemcosRAT)", "value": "8e78496d197d255fc24d51e3022d836dbb689b484ca1d46e3193c45f20acb469aedbd847736d3df505233749a96b6bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576326, "uuid": "3baf616d-834d-4201-aa48-c08ac5e71554", "value": "T12A15B037A2B18877E1621CB84C0E53E45C6C7D176B34A8497FF87E899F7A24178391A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576326, "uuid": "470206c0-3d27-488f-9ff9-01b6b39facbd", "value": "8744464f2d808f7b51fec10c17042328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576326, "uuid": "4eae1fff-09be-4687-9dfb-28f6c54877a8", "value": "24576:xgLzNa28Rcr2O86+6MDUlnEXYfWGZvD7QKM:xgL4HA2/KmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576326, "uuid": "cc6b7daf-fee9-409f-9602-f0a9396b2d6d", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576326, "uuid": "ccffaea2-1a1b-469d-96da-7ba471fa5534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576326, "uuid": "19f43581-0586-47f3-89c3-92deb2ebd836", "value": "912dcabc2feb02fa2ba9794b2b6f3274281e2821aa9cfed73c94e99a30f7d1ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b97c71e-3694-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691572238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572238, "uuid": "1272abfb-411b-4867-a898-4c2507b0eb11", "comment": "Malware payload (Amadey)", "value": "36f9ea3a21df342c387b33fdd8138079", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572238, "uuid": "f956555e-e0b0-46d1-85e0-9c07142d064f", "comment": "Malware payload (Amadey)", "value": "91a5fe25b62300bb4e6ef6ca6ad9a914e054f2d8848252a79f0d31013fb27d8c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572238, "uuid": "97772f8c-a5c7-4488-aadc-20a8afa7f147", "comment": "Malware payload (Amadey)", "value": "e9fec90540c74db990ca6cbaa4de0b123f83741c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572238, "uuid": "35be7d29-fd7a-48c9-88ab-adf03113a9be", "comment": "Malware payload (Amadey)", "value": "437f8a35e494b0d37a5a7d8dfd25b47b27f481ef3fe5e4994febefe7d33dda0e3b5d834fb0fb7a5fc22c425f8974ae9f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572238, "uuid": "52943eb9-f1c6-4d7d-b16c-495e66510b60", "value": "T15CE41263F7E87171E8B51BF458FA03931B36BE915D68862F3246995E0EB23C0853631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572238, "uuid": "c95030cc-5f85-413a-8911-23b489c2b27d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572238, "uuid": "0cab9c3b-7f46-4089-bd43-e4271c1c86ea", "value": "12288:bMrKy901VTWVSWiUodQCGh1LCGORy1rHxzf710Hht1D+d2:9ycVT3dCZCY9qhtN+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572238, "uuid": "a8db5276-7315-415e-8e16-cd8b6e1adf41", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572238, "uuid": "b81fa8d2-8204-4f19-be86-d4a3a8f21724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572238, "uuid": "a174c6b4-c893-4056-a844-78e47bbf80fb", "value": "36f9ea3a21df342c387b33fdd8138079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33acaf88-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571635, "uuid": "76197e06-191b-4ef3-8b9c-94c1f83347bb", "comment": "Malware payload (RedLineStealer)", "value": "6ee666a4016651fc03f9dd718d825b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571635, "uuid": "025acccc-d58f-404c-b5d1-42b682f032ea", "comment": "Malware payload (RedLineStealer)", "value": "9293ebbd80a312d9d2f998dfd2b81b05e465e6092c9f98e97317214af35757f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571635, "uuid": "e5cf3103-82b3-4632-85b5-6ab6d5a5d1cc", "comment": "Malware payload (RedLineStealer)", "value": "2cbd241904a72e472f2c2c8df9b2a94526c2563e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571635, "uuid": "f482103f-3817-4322-aaf4-0b99c6d8ef23", "comment": "Malware payload (RedLineStealer)", "value": "0792593dc6c4895b4965a0bdb9f7f5ba9ec74506a4ffc737d048461f37f703b7d4e12217c072c4309c4ce9c00df9a964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571635, "uuid": "fec14e14-ec27-4ebf-9f67-648c09e21e6d", "value": "T117E41286ABEC9576D8F507B058F206831A363C91AD758B2B27965D6B0DB33C4A03173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571635, "uuid": "ba0c8da3-fff2-40fd-9a45-462fd57d7dc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571635, "uuid": "1bfc9e04-21d4-4046-8f64-fac468f48128", "value": "12288:YMrMy90qbWRF4AjKn1Jyf/v+3g4lyNpxnP0EnN+CH9ubhUFljprzxuQ8kR:0ywC5Jyf8g4lcpxZnNJChUnjpHs/kR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571635, "uuid": "122d34c9-cff0-474c-b3e4-9ec8a0ce46ea", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571635, "uuid": "8d9a9c8b-8116-4d07-837e-a24fb0e1a17a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571635, "uuid": "20fbc812-cae5-426f-a865-92a7e8459f95", "value": "6ee666a4016651fc03f9dd718d825b76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711ae347-36df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691604379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604379, "uuid": "c08eaf39-2b49-4236-b427-ba99899b9f31", "comment": "Malware payload (Loki)", "value": "b2e6b0f96fdffca2b88ef57e8f5a4c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604379, "uuid": "63020f52-af97-44c9-afed-03d841e68f25", "comment": "Malware payload (Loki)", "value": "93529d9a4557671f8c6a7649e177af2cf02627edf7d7beb693c0f76c55b39713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604379, "uuid": "ca271b8b-d9f0-46b3-8410-a1c7c6f4369d", "comment": "Malware payload (Loki)", "value": "abb6ae986899dc92b6c39c82c37c2b8d8e4834da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604379, "uuid": "6a6385ca-a379-4763-891e-876052e9e4f9", "comment": "Malware payload (Loki)", "value": "e66d6b702c62faaa4f8b47f500ce7917fb0e5b6b2e7a9ca4c65da147272c1c46835cb635e7c6f323d4aa8dfb96959fef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604379, "uuid": "baace23b-69cb-4c53-adca-e592e23bec12", "value": "T17F546DD366D07861E2264A327E2AC6F82F2EFCA18F5577DB1254BE1F09711E1C632712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604379, "uuid": "0dbc0c76-d6ae-472d-b334-bb7943aa46ff", "value": "8b04667bf7005dc7bdd7ac468a9f7241", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604379, "uuid": "2f110a8f-e631-4718-abcc-7302db5fdabd", "value": "3072:FteyfZx8/pFDumzMLF7WQBvau9lOg9Bx1K6+m0KOELogtjiIm1wc:nj2FDumz+Fa2aYR9BxD/ZLYIYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604379, "uuid": "2bd2e5a1-a7d2-4bae-a49f-198e3c43dca8", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604379, "uuid": "2ec0919a-c21a-471c-b47a-8972ea9327bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604379, "uuid": "895a39a1-0d0c-4b69-a3e7-6ca1ff4e2058", "value": "b2e6b0f96fdffca2b88ef57e8f5a4c24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c447789d-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691599794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599794, "uuid": "7112fab8-f262-4537-9cbe-d21fb7c7b194", "comment": "Malware payload (RemcosRAT)", "value": "c39c61ddaa665c4de18b419c3ca106bc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599794, "uuid": "f5bb4106-fdc8-4951-b7b9-980375cc97f4", "comment": "Malware payload (RemcosRAT)", "value": "935e0eab17f7949a0b1b7af4f68cbde5361e82330a201f5ccded2fb2b45c50fc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599794, "uuid": "6ccebf7a-86ea-41b4-92bc-58c9a6353e75", "comment": "Malware payload (RemcosRAT)", "value": "dbab5b714433ae259da4a3e17d6de6d3d8765364", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599794, "uuid": "e2a6c2ea-bec3-4c78-a52b-299e82bbeabe", "comment": "Malware payload (RemcosRAT)", "value": "dda2cb941766ea2fa558d3615fa0fabc3ec5a6d2be556f926446a2a597545fcd5a3827fae5187110735a6ec74633f2d0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599794, "uuid": "fe8c80f5-e0a3-4785-86af-a6829abef0d1", "value": "T16C53256DD34F01A9CF6263379B671A4451FDBB7EF24052A1306C436933EE82CA1256BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599794, "uuid": "0f60a2d7-f52c-4110-b0b2-cfed2934aaa9", "value": "384:ML0AbZSikcMX93wRWjEy6V3ZH7icO2V9cOh/50IYr6a+9VjMPtAStTGEX:MwAbZSibMX9gRWjglii2nrcsPDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599794, "uuid": "9f7a07f8-dac4-4b4e-bd3b-e8a975528ef8", "value": 61537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599794, "uuid": "35c32531-71d2-4291-9b90-09d6a3bf1595", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599794, "uuid": "4695cc59-0541-4c71-9194-6559a4687830", "value": "COPIA DE PAGO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f19512-3664-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691551534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551534, "uuid": "b52e153b-c8f6-448e-9e9c-a753fb961fbd", "comment": "Malware payload (RedLineStealer)", "value": "40a1169825016613d992778907662507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551534, "uuid": "79a5209e-eb50-40d4-83b2-f9654b53b30a", "comment": "Malware payload (RedLineStealer)", "value": "938e41bdbf9d9e471cbe3ee7db0124a29cf93ed36b1e4785114053cb3008ed47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551534, "uuid": "3f2709f9-4b76-4ae9-a198-2d2642f20f03", "comment": "Malware payload (RedLineStealer)", "value": "cd53a9196937d9379d62de289aa31e0f815b9b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691551534, "uuid": "7025f193-7489-45c0-9cce-1b9a3e208c6e", "comment": "Malware payload (RedLineStealer)", "value": "667703c64602cbcdd6d3c08b6bd073acb5dea92a42b044cb1bee9faf1e8e5bff3f2c879670dea35ab28bde2d1eec0606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551534, "uuid": "cf583e9e-3729-4d35-985b-aa349a730ad6", "value": "T15AC41252B7E88077E57107B068F522870F3ABCA2AC34D35B37455D1E1CA3A84A972B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551534, "uuid": "2d4843e8-eb6b-4d7e-a285-24304829577c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551534, "uuid": "9147717c-0432-4ea3-b435-643f00808178", "value": "12288:0MrGy90+RCrFhYxdCjXH0Ez3Q0oCU9RIybVLnN:ay7CrLvXxzApCU4yZLnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691551534, "uuid": "cf457487-324c-4dfe-a3c0-1c26bc8280ad", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691551534, "uuid": "5ce2802a-6b50-4873-927b-97a3218efac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691551534, "uuid": "38b0a128-92e0-4431-8ed0-27cdd9bffe78", "value": "938e41bdbf9d9e471cbe3ee7db0124a29cf93ed36b1e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7433b935-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623282, "uuid": "2d0d257d-83c4-4860-b4e7-6d5827e90d1e", "comment": "Malware payload (RedLineStealer)", "value": "4a762638bbb81a4870edb84c0c36670a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623282, "uuid": "6d54ee3e-c576-45a7-985c-b0120f75d2c0", "comment": "Malware payload (RedLineStealer)", "value": "93c9da0c6e2cf18882bb21275d080b6d37ca230f9cde6531aa21c34adb10fae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623282, "uuid": "42f7ef2d-8911-4e80-8782-b6ddc12b3250", "comment": "Malware payload (RedLineStealer)", "value": "7ebb1166038eb9318d27f82770964c3ced7b80be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623282, "uuid": "b0bd61c3-5e04-4c24-9692-c0897423a1b1", "comment": "Malware payload (RedLineStealer)", "value": "5f077ba16d265900753736012834c6d93059bf2fe3a7f2b5e484909e87813d842a1eecc9a2bca4a3fb53d378cafeb038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623282, "uuid": "7670042c-bed7-460d-9db1-deeb2c04961e", "value": "T124C41253B9E84073D9B41BB418F753930A357DE18C76822B2B86695B4C73BC47072BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623282, "uuid": "6a193a0a-944a-431c-a233-368f6b00121a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623282, "uuid": "fba58978-9bd0-488f-b789-235bc4dab3de", "value": "12288:tMrqy90hasHSC7lw3Oh1jCma3JyTLTisW+qDB:Lyma+1iaC73Jy3TgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623282, "uuid": "393006a9-18d2-4447-acef-735ad2ce09b3", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623282, "uuid": "ba946075-41c4-41cb-b20b-08b47ad34e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623282, "uuid": "7b3dbd3f-76eb-4c95-a90d-d63493ae6454", "value": "4a762638bbb81a4870edb84c0c36670a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76edd41-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606242, "uuid": "b37e5358-4b9d-4c8f-858b-b43894e00ac6", "comment": "Malware payload (Mirai)", "value": "3b7c58875e09d4e81ff842811da269ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606242, "uuid": "dab38130-512b-467b-9090-78f71977e7eb", "comment": "Malware payload (Mirai)", "value": "93dbeda2f41b5f943b4599b42c307181184b42c70aabddaf881b4fa315062441", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606242, "uuid": "5b8dd96e-9c8b-492b-acf1-293f8263fd3b", "comment": "Malware payload (Mirai)", "value": "fd9e0a2e4b7c948847484d87134ddeefb7056a53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606242, "uuid": "aeffd229-4fc7-407e-9e6a-2007f7745362", "comment": "Malware payload (Mirai)", "value": "28acf0d9e7e3954e3bbd29526c80637014089d9e8f895d41eb2721b339ce2674bdf37b645ae69972b46df7a7692054aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606242, "uuid": "36ce1aea-10bd-4fd2-b271-b09cb7da4d35", "value": "T1F2B2E1A04B929717C3B0B439E37C8F926A3715E4C6F63926272092BCC94645633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606242, "uuid": "d8f18e7e-9f94-441d-8417-76a7540684e4", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BwFTid9IhymdGUop5hu7Y:4GaKQFH0rs3zWoDDRsjt7LB9U+BwJidj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606242, "uuid": "0f2ab9ea-42cf-4464-a999-83e69115f812", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606242, "uuid": "20a215c9-4663-4492-9a83-553fad77df49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606242, "uuid": "a43e7572-e1fe-4bc2-92ef-2a92e05bd64b", "value": "3b7c58875e09d4e81ff842811da269ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f495ee8-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691559172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559172, "uuid": "8f0dc8be-1eaa-4a6a-8929-9b09917c5344", "comment": "Malware payload (AgentTesla)", "value": "241d1b780e7cccfc799f2807dcfa6a27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559172, "uuid": "77645e26-2496-4549-bc44-954529ed1043", "comment": "Malware payload (AgentTesla)", "value": "946697229fabf9901bfa8ed8800acbbf514c952baa747741bf6d2529497295b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559172, "uuid": "9542885b-bd56-438d-ad94-82ddb63ca049", "comment": "Malware payload (AgentTesla)", "value": "fa6d2ded4d05e716f66edb32ab816920f0547c24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559172, "uuid": "ba4027c7-be7a-448e-ad75-2544bd0c9f8a", "comment": "Malware payload (AgentTesla)", "value": "af76652f050c3d4c6cb5cdcb92444001c1187d94d959232355dc7fb7530f614e0d48dad9d6f8cb44a73bc6636cc6fd73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559172, "uuid": "e9206d28-0255-4030-b71a-f148f89cc060", "value": "T1AC15483C15696A4CF7A486FCB6748CFF17A56C2F80BBF9F3885CA4D306A97D05502262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559172, "uuid": "ae4521a0-929e-451f-bf90-391a6e80ddd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559172, "uuid": "e37340b5-63dc-44c0-9c99-ecac3dc9a957", "value": "12288:AEg6ImpEOSLYTdLzcrTpYpswKiM2jbQb5jvgi5iQv581pLu:AZ5mpEO6YTdkZYCi7obNvz9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559172, "uuid": "20156418-0737-420b-bdab-0d45b65d0f21", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559172, "uuid": "5d03c2bc-0670-423f-ae72-9b302f72f38d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559172, "uuid": "a9d3d2ab-24cf-4329-a566-dff41dc7f066", "value": "FedEx Express Shipping documentations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f8c045-36f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691613679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613679, "uuid": "5c16bbfc-9772-4a75-a362-55152c95dcb8", "comment": "Malware payload (Amadey)", "value": "17923529657b883b2aca4c871ba3f0e1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613679, "uuid": "da062f51-7aaa-49aa-ba7e-c7bb2cf1bf5f", "comment": "Malware payload (Amadey)", "value": "94a404312945e8859fb3b1b0d5de59f229e405e818499daa0150f6cdb7c63f64", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613679, "uuid": "827bf745-0d47-4ae5-b215-735ebc964069", "comment": "Malware payload (Amadey)", "value": "fffee7e5f3ba54f371a18879bb392d98df25639a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613679, "uuid": "7350ff0b-2cf1-477b-a60d-f9bd979e57ee", "comment": "Malware payload (Amadey)", "value": "b26c6e7a89be285bda128e98d309e404fff146666d1c98348d340e46ac517af00d1bf29165350c4727b722e4bbc7588a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613679, "uuid": "be2c857b-ab56-4566-9022-64fa76bf79f3", "value": "T1C613F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613679, "uuid": "0f52c1c7-092b-44b0-b256-7ad7dd9f0d2c", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691613679, "uuid": "e5498468-e8e1-4caf-855e-2a3e30318f1a", "value": 42520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691613679, "uuid": "1385eb5a-3c45-4383-b598-551226722794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613679, "uuid": "ca9755a0-565b-4c8a-ba44-f80e4931c3a2", "value": "17923529657b883b2aca4c871ba3f0e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b612ab-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691583751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583751, "uuid": "b06792fe-5086-4df8-a3bc-7975d30d4e34", "comment": "Malware payload (Mirai)", "value": "a6c55b55b3b195d9d752f2b7f73a25e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583751, "uuid": "dba023e7-c6e3-4248-aa69-a86b9208eddb", "comment": "Malware payload (Mirai)", "value": "9542d1148290066351ce0c4d72c9234ca49fc10bc7203fbf7cfa436b2969378f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583751, "uuid": "09a849d0-5258-49ac-9d07-a9f7c27d2832", "comment": "Malware payload (Mirai)", "value": "ff2dbc11f914ed8cfad6e8561721638d867ed547", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583751, "uuid": "25e46a86-d325-4e55-9230-b3c6ac5582c6", "comment": "Malware payload (Mirai)", "value": "65748e1d99f0b0737bbd6bd831fc132093e15c4c3feb8d46f4a4e60af40d5438a2d048a22dfba8d368c347b2c12b6ef6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583751, "uuid": "eeaa0d1d-1762-4548-ad89-749ed7ecd1a4", "value": "T124735C34A97A2E26C1D0B13F22FB8761B2E5260E25B4865D7CB60F4FFF2065494172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583751, "uuid": "f3cfc316-69a7-4c6c-9563-a171e597730d", "value": "1536:Azvh+FNkgj5cXlkqFfjzYWcShGhQxV6vVgFpqxfsFFm:LtIYWcY8vVfxfsm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583751, "uuid": "456015bb-96e1-4828-a374-5153284b9258", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583751, "uuid": "62e5bc12-8258-4717-bf01-ae21895be74c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583751, "uuid": "b49457c1-a1d4-4c6d-8048-49827829a12b", "value": "a6c55b55b3b195d9d752f2b7f73a25e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b6599d-36a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691577215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577215, "uuid": "d84c0eec-77f4-4ba8-9f6b-0fd0a3b5db53", "comment": "Malware payload (AgentTesla)", "value": "2a1e7a3bec4f07d267d60c35e6c269cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577215, "uuid": "72738d9f-20dc-4be9-ad17-2d73c010e66b", "comment": "Malware payload (AgentTesla)", "value": "95dede01a7a7b3f131f9c452a454917edc72c9a7cfb8b22a2561acf8441128cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577215, "uuid": "3d1ac4f5-0861-4264-8a4b-d8ac0aaa8d54", "comment": "Malware payload (AgentTesla)", "value": "2a131ce9dd21579ce83991dec8ab16e6fd3ab393", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577215, "uuid": "8a64dde5-825e-4111-bf72-49a451f8b6c5", "comment": "Malware payload (AgentTesla)", "value": "9b59480dcabe4b523a29c26e42b32156751899a8feadfa1731216ee74e6c1c19b133726b5c46bdfd91fdd715270a4aec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577215, "uuid": "a985fa01-4bfc-460d-9dd6-35ea2413ab3a", "value": "T15104CB74A1F26AC9F896CEB29E61E609FFE70C819A41421FD17439F61233B84C6451FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577215, "uuid": "88469c9f-0b2d-403b-a7d2-f0b685b1010b", "value": "768:mIks9+uZj3ViIisLk35bQzQ95snIIIIIIIIIZnIII2nIIIZnIIINsHIIILHIIIw3:m5i1ZjhGIBOrPaOYdSkjiRNqOP3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577215, "uuid": "53175ec5-0e8f-4eb3-b14c-5a22cfcce1ae", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577215, "uuid": "5f323f70-0449-45c6-93d5-7d12a0dc1fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577215, "uuid": "88c93e1d-d7c1-4a71-a35d-21dd5af0eafa", "value": "SecuriteInfo.com.Win64.PWSX-gen.11505.24038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea5ad3d-36a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691577505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577505, "uuid": "27ce5f06-9eb1-438b-9de8-9aa2d99cde0d", "comment": "Malware payload (DarkCloud)", "value": "f77f207809302a15917c05e4aea6aada", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577505, "uuid": "0b3f0211-7866-40e9-a122-752b6f6468cd", "comment": "Malware payload (DarkCloud)", "value": "96a6e17bda2189f3e122d90d887984bf5eaedd28e2880b15c7fb74d0472f335b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577505, "uuid": "47b5fe36-147b-4015-9c44-96127e132aea", "comment": "Malware payload (DarkCloud)", "value": "84dbc5abd53d7a93be3465f7bb90e3c4b5c945d4", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577505, "uuid": "9dbcf556-b6ac-40d2-87e7-6b4ecdab1b1b", "comment": "Malware payload (DarkCloud)", "value": "a12e90dee6c4eee204b72143b10c0723fdc7dc671c970fe9a680885cdf1f0ca6de4928f5f02fc061967885c967535882", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577505, "uuid": "eb3d153d-a2a8-47ee-a72e-94e024be97d9", "value": "T1F9A46C16EB61602EF053C8F1E6E5921768996D7A12A8EC27F7819F0935351D3E8F032F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577505, "uuid": "96a1cd17-f249-4dda-b380-53c18c0c063f", "value": "2f4cc3406c48d1d30d3166cb5741eff5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577505, "uuid": "d79d1120-46bd-49b9-a842-95361bf79327", "value": "12288:1EUH1n27bHqiAtweKISY2GFerjYKkJj6GmZU:1p1vfKISY2GEXYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577505, "uuid": "c2ca2246-1387-4eaa-adf2-a8e1c161bbeb", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577505, "uuid": "720abb9e-67cd-4bdb-866e-0c4686cb6c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577505, "uuid": "04752514-1f29-406b-a299-4f2997861fa6", "value": "96a6e17bda2189f3e122d90d887984bf5eaedd28e2880b15c7fb74d0472f335b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16a018f-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549136, "uuid": "d489298f-ff57-48a4-85e4-2b46d07a40a3", "comment": "Malware payload (Mirai)", "value": "c029baa748c7ade8c213b2399c7327bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549136, "uuid": "560e1c99-3800-4a09-bf9b-bb9231ad5b9d", "comment": "Malware payload (Mirai)", "value": "96b24b3fdb1abd364b2db491a9fd363439ccf3ce8f6ef3d4dee2f55d4137964f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549136, "uuid": "40887c28-dbd9-4c3f-a673-6298b0ca5378", "comment": "Malware payload (Mirai)", "value": "5d9320c68cf5680eb41d8c7f94b4124379c966b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549136, "uuid": "fbe00e22-b5d2-4887-ac38-299f3434e54b", "comment": "Malware payload (Mirai)", "value": "45a5f3805ee1865ab337c1a3dfba084d182fe66d1fd078f4a1caa2b974822e2e2662e1302c22ef36416be66ca8fb34fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549136, "uuid": "1528eb73-555c-433d-a664-e1de87890a44", "value": "T1F43301237664BD62DE752C3962F98C8B3148425ED4EC9C2239C4A9A1A2D2147FBE14E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549136, "uuid": "aa9779bf-9f6e-4ee4-9cf9-a7e1ed650005", "value": "768:JfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbMPH9q3UEL2qEK5J6OAsNTGjf2tl8XOJ:KPtQjiZVcykHRDMOL15J6RN2tAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549136, "uuid": "0bab6e85-10da-47c8-bd9c-f89d6f52273e", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549136, "uuid": "8405e40c-1baf-46e3-8b7f-aa3ce3fbfd97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549136, "uuid": "24a4c155-0413-4609-8f37-059311fbfc0c", "value": "c029baa748c7ade8c213b2399c7327bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f305b8d-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691583760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583760, "uuid": "eb690f28-eae6-4251-a149-0fde36e94913", "comment": "Malware payload (Mirai)", "value": "3b71500f1646cfc633d6e88cf43a558d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583760, "uuid": "561d1590-ee11-437f-a74b-4b3bd30739e9", "comment": "Malware payload (Mirai)", "value": "97681bf6224841a594151f787beed22da18094098e9a4dbc27b0e82146ab27cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583760, "uuid": "4b7950f4-f7e5-4973-97a9-5f3b45f1d371", "comment": "Malware payload (Mirai)", "value": "33f12844ef0fe22d7257019283233d0eafebc147", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583760, "uuid": "d20c3c09-61d9-486d-bd7d-d7a501656703", "comment": "Malware payload (Mirai)", "value": "d8dd695e8ef24feb8e673a765c0f7b80f90f1db34ed27c7fc0c3879915d92fe6c885ddacffbbf34384f815898316e0f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583760, "uuid": "cc2174ec-2efa-4f02-9317-d66d30c2f4a4", "value": "T16C33198964121E6CEAD25CFD90624F0ADE505221B4A3171FA3BFFDC33933368EE61949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583760, "uuid": "7e911722-e438-4553-99cf-ce7e95c0591c", "value": "768:QuXcHmaxLK7sasYaMKBuemw1aqkLm6IWqhX7wWex76jUQb+f1prOSaK8UCQeEF:ZcHJL4sjYaMKIgFw76jU6g1pL8Uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583760, "uuid": "a116401b-f6c8-4a67-a589-d3c122a4f126", "value": 52956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583760, "uuid": "3afeac39-d911-42f4-9bc2-e69551e8c7bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583760, "uuid": "a15e1cc8-e8c2-46c9-9b8b-480fa459652e", "value": "3b71500f1646cfc633d6e88cf43a558d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a536363b-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691583851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583851, "uuid": "79cc4526-fab1-4989-8943-916973a5bd3c", "comment": "Malware payload (AgentTesla)", "value": "c12feb775419866916cad4b2dcc1328b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583851, "uuid": "71459a33-20c2-49d7-8336-431d6e30894f", "comment": "Malware payload (AgentTesla)", "value": "987eb254efd0f44e974cf17a3815abff007795bd5b2a34f31450364e3f49d9a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583851, "uuid": "c40bfb9f-93c5-4e4f-ab89-0868c284cd02", "comment": "Malware payload (AgentTesla)", "value": "f9cf4ac01f46fbdbe6fee6c2f5c93ad95ec09ee4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583851, "uuid": "f91efe78-8f15-4497-851b-5bf3da2a6316", "comment": "Malware payload (AgentTesla)", "value": "9a720687289f60daebd8c6f277a2c80f9bbc3908715fbc2761f9bd0674d08aa8d039a42b72ca9c2fb33851c87f2cda6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583851, "uuid": "0f980a65-a0ff-439b-8336-e04a5e8234dc", "value": "T195F4231E464185B6CBC9CE2548D9D11FB3A2EA0B81CB43178A73D97DFFFA82590588C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583851, "uuid": "e3d048f2-cb89-4096-8f40-8bb498fbaaf4", "value": "12288:yxLu3c5s4R/j7rYOHL68bQ49UCMYODJCT0YcxozS5EbQlwQv8w8ZFDYAopaopSFM:0Lh5FrYOr6S9UvTD40YcxKBElwriAoYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583851, "uuid": "da7c2517-babc-4812-b037-7fbf0b693767", "value": 737636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583851, "uuid": "21de102d-7c6d-44e5-a04b-c3d03348c685", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583851, "uuid": "3097f07f-4dd6-4d59-aaab-59a818734800", "value": "Payment instruction - transfer P-310226.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e35d49-367f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691563229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563229, "uuid": "825cc44e-902c-4672-ad42-bd7c83ce3247", "comment": "Malware payload (Amadey)", "value": "aa807ec7b471beabb0116da47d14e2ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563229, "uuid": "71038ad5-246b-4fab-a50a-403f16461787", "comment": "Malware payload (Amadey)", "value": "98f023316168ad3daa0023044cafd33118be19a753238d59a3cf62bd9e7b512c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563229, "uuid": "0b78be3b-a441-4f72-bf6d-0b7a990f1fa2", "comment": "Malware payload (Amadey)", "value": "8cb0ccab496d1e306ac691d1695f330ad3da7fa3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563229, "uuid": "8e75aba5-79ec-4812-a2e9-b43b99c9cbac", "comment": "Malware payload (Amadey)", "value": "326cd30415368f6dc6c22545c5abbf4d9b4625d2e86a56948fb12cc167cfd1589d314817d094898b9457d0fc6624fb61", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563229, "uuid": "d06baa67-3dff-4daa-97f6-0504c23ec8af", "value": "T134C40252FAE950B3C8B61BB418F603931A31BCA19974676B3785A91E0C733C4B93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563229, "uuid": "3d5d8238-8e6b-4d88-91e5-bd2e5b40a533", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563229, "uuid": "5fe41632-6a6f-454e-bf69-e667f94a994b", "value": "12288:cMr4y90YJuSkFlv8fOZw0hVKyym3NiLCWmKxzn0Ci:8yZnQ+OiyysNlPK5ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691563229, "uuid": "f8440dec-d547-4783-8b4a-55b690d6b5d5", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691563229, "uuid": "61d9944a-47ac-40c1-9130-7db1ce0ef338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563229, "uuid": "a9111bb3-818c-4690-aa00-bcb34a8e0225", "value": "aa807ec7b471beabb0116da47d14e2ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725321be-36a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691580330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580330, "uuid": "27f54879-f0e9-47ab-b8bb-d8730f4b410e", "comment": "Malware payload", "value": "166b7b9ac8170542bc334ddd81494e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580330, "uuid": "028c65dc-6fd4-4697-a7b2-2d1d4f5c5c27", "comment": "Malware payload", "value": "9a4a9fbc5b0aac6f09f50e3a09e9b1ba8f4a6e6c49811e2110b2ee491e55d55b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580330, "uuid": "cff0023d-114a-48c7-bf4c-01f37600c39a", "comment": "Malware payload", "value": "52b7f0fd1911196b35086ee136e829ace3f8a897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580330, "uuid": "ba6ab69b-7f18-4756-9094-3b19f78a95a8", "comment": "Malware payload", "value": "5e0786206567fbdbfea2599248b54ee61d6c3dfe67e52f1d19280ff8ff38e6618d371f1e029b65a9c88f51795d72c0ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580330, "uuid": "6d11a5b5-3f6a-4f59-996a-246e5958c51e", "value": "T1C192191513E082B1D2B947B66CB396025BF3EA438837D65D3D8C615E5FB36818363B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580330, "uuid": "30c359d7-dfb9-43ce-95ed-a5fcf107f1fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580330, "uuid": "c842d502-b83b-4441-9023-d6aae8a11131", "value": "384:JMuAghc1q83yhhxMu+LTKjVY2BG+uCD+RmPGa6f1iQptYcFOKc03K:Ri1v3gl6WGjCD+RmPGaqvtYcFOKc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580330, "uuid": "59de2fe9-fb1b-4d0a-a635-b3515b62b1e0", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580330, "uuid": "b8a43415-dda8-495d-810e-37b8d1026ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580330, "uuid": "2954c145-d769-4b83-adc1-d361795c745c", "value": "9a4a9fbc5b0aac6f09f50e3a09e9b1ba8f4a6e6c49811e2110b2ee491e55d55b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bb4182-3694-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691572128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572128, "uuid": "b6106a9b-4a7a-4f0d-a4c4-05561d0f79ce", "comment": "Malware payload", "value": "4e40f90026d9f828fe91ca4f853dd79c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572128, "uuid": "46e139a6-a91f-425e-880b-bc517e70f466", "comment": "Malware payload", "value": "9c516f66862b5e5f746944abf5e6ccc08dedcf0e2a449f82b86aa559bf9be812", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572128, "uuid": "5db40c2a-07fb-4bf1-8814-20377c21b362", "comment": "Malware payload", "value": "34bd132f7764c2a2f8cb79f6eaa700c8323fc2d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572128, "uuid": "3e301c01-49c6-4e34-add0-2118280af08c", "comment": "Malware payload", "value": "5aa61fd986c24c556ff80705f51b48b86ec9ea9309ef0b9a5a1073a5ff3d77baa4fca971da84115e8e6f98e16c69ede5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572128, "uuid": "b537580d-f491-443e-bada-b843ee35dea1", "value": "T195E57C63B3C5643FC06B163A5837A6549E3B7A61369ADCAB5FF0484C8F351813E3A607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572128, "uuid": "3d4061da-09a0-471e-ac99-a73d1b89ea9e", "value": "052eb25fcc05f94215fee6932b8edd53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572128, "uuid": "0a76ed19-0774-4152-9c43-48bf32ec5bd8", "value": "49152:VrTpP5Mrk9N9D6/kvyTsBTS6Q8bS1fRYQF4SuNbmUJH:VIqbDigyH16Qen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572128, "uuid": "92ed086b-7d06-4561-bba2-236181b2df83", "value": 3073024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572128, "uuid": "e2488335-eec4-4a1b-b1d4-f8bb1739d1bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572128, "uuid": "54ff9cec-1ad2-4028-b1a8-9ff58e911e78", "value": "pdf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be822e32-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691599785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599785, "uuid": "56e9ba54-b4bd-48d7-95f0-68a487a8466a", "comment": "Malware payload", "value": "57ad72f6d421f40dd6c53ef4f43c228d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599785, "uuid": "27363863-e374-43ae-8014-d6107cf5b016", "comment": "Malware payload", "value": "9d176ad14e9f84e1926e8c43969d9b08036dbd237afe7a9f5339b89dbb9fd23a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599785, "uuid": "263af1f4-570c-48c3-871f-3e8281d74c9d", "comment": "Malware payload", "value": "ee53ea56b98f8e810681d456079c78ac75d21a3c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599785, "uuid": "2dfec4ae-5f5b-4f7a-abe7-6c688f51c62f", "comment": "Malware payload", "value": "eedce0a8355318b2091dba857728f4cf73c5165cdc79e228ef7e2867850b527e6f8822d876ff7523f06189b7a7cf0e6c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599785, "uuid": "f03774bd-d2f2-4ba5-8804-54d4fc1a7835", "value": "T14415E0079D598B43D02897F8BD434EAD1F092E1DA8867AEF10623FDB3D706254D9E0AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599785, "uuid": "f641958b-2a4b-454b-ba0e-0ee1fe6f7447", "value": "24576:+eixE+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXX7GFbarlOpa4NkS7Vs:u675Mlsa4Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599785, "uuid": "012075c3-3269-41dc-a66c-da30e2a24f2c", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599785, "uuid": "324fea3e-a019-4196-9888-e85b0aa3f472", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599785, "uuid": "5afec592-c943-4332-b35f-34379a4969e1", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b308e77c-36f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691613080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613080, "uuid": "7033e6a0-052c-4fa4-a51f-00bb04268e31", "comment": "Malware payload (RedLineStealer)", "value": "3ad2c53ac31d81513949ce062e33dea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613080, "uuid": "5ca02076-0a04-4497-86ea-783813981eb3", "comment": "Malware payload (RedLineStealer)", "value": "9e50dd42e96278ab98545d41a8ae9a6afe7377c76355ecf28f3c9415651feb31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613080, "uuid": "ca938ba8-7058-400e-97fb-e563bfcaadd1", "comment": "Malware payload (RedLineStealer)", "value": "9c2fa035dcd5eedeecabf095739ca87479bcaa16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691613080, "uuid": "38e1f8d0-539d-49bb-b482-a8feab2a7227", "comment": "Malware payload (RedLineStealer)", "value": "6ce322d7539259845c04ba4608d35fe26a446661286375c885b9e2f2c71ef8f2dee343235e2a9d8a4be74d1ed821d65a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613080, "uuid": "ae38fb77-22fa-4373-b08f-1e2a9f0a0e16", "value": "T16A13F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613080, "uuid": "e5e1e19a-72ac-4205-b203-9baf80a23a58", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691613080, "uuid": "b711feb1-c4eb-4fbe-86be-cf7f71c67366", "value": 42127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691613080, "uuid": "e22911b6-71b1-4c6b-852a-672f24140031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691613080, "uuid": "1937f9a1-9408-4c6a-91e8-9ea8ca9c9f04", "value": "3ad2c53ac31d81513949ce062e33dea7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78af11df-36d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691598379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598379, "uuid": "2f8aaa74-9233-4bf2-9718-dde756780a64", "comment": "Malware payload (RedLineStealer)", "value": "c4ee51bfa225a4efc23aa43c3e18074d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598379, "uuid": "7244fd0e-bc4a-47a3-b9f5-43e1c3f04e03", "comment": "Malware payload (RedLineStealer)", "value": "9ea76129a77166fbc6b478f245e3263761b6c74b064ac092d5d6f585d1b6da89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598379, "uuid": "afcb7d49-e7e2-4087-839f-5355eff38f15", "comment": "Malware payload (RedLineStealer)", "value": "25e9d24d9cca4cea2ef9447bd0dbd8ef8a117f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598379, "uuid": "0f57ef95-7244-4fce-93bf-21ad32780f3e", "comment": "Malware payload (RedLineStealer)", "value": "0d4992b9aa4d51ae4157a25caae5d6da3b83e1462b8ecca90ee084a1154f3bfbe6c5f0b3ca61a60cc176e7b6d2949bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598379, "uuid": "7a600301-21dc-4035-a41f-b1e7911fa44e", "value": "T1B0C41217A3E98062D9B123715CFA03C31B3ABD615875436A3749F81E5CB2AC9783277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598379, "uuid": "a53a898e-e850-4424-99bd-f5449ae22bc3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598379, "uuid": "1124312f-442a-4a0c-a3bb-7a8fbbf38d98", "value": "12288:yMrMy908r1r71/GrHxi3NjpuqoX3haPgBYCAFfNSfXIGKeVDteq:ayBhOVi3BpuZHsozXvI/M0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691598379, "uuid": "cbe00a0e-9000-429f-b86d-154bfc6aa7d2", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691598379, "uuid": "239cebff-c498-4fe9-804f-21c3b81bd09e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598379, "uuid": "accbafab-28e9-490e-93d8-4e3230391608", "value": "9ea76129a77166fbc6b478f245e3263761b6c74b064ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc19d2d4-36a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691579648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579648, "uuid": "33396bf5-e942-4e8d-85f5-a9feb984c791", "comment": "Malware payload", "value": "3b7f013e917b7c71b415bc18961e4e5f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579648, "uuid": "49ada64f-1e0d-4071-912b-d1f6731ddc73", "comment": "Malware payload", "value": "9eff0b8246f642e79ab3dfedf75b30e1ed84f9c235e1dead086c736b7db164b6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579648, "uuid": "6fa4a342-17e1-4ba1-9d43-980553e311b8", "comment": "Malware payload", "value": "a8507a42ca00c01fda09fde255eb8ecc075e194e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579648, "uuid": "1e5e2e63-f6e5-4076-8319-01d037adcffc", "comment": "Malware payload", "value": "f1d399509bdfc91b5e73ad23c6247dbf214287e6b05e8ff37435e549cfa1e68cafa5b0318bd5e70feea8be38e830cbc8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579648, "uuid": "cccd7ae9-7838-46b7-a761-6d4cd824fc62", "value": "T18B327E2EBDB485BDC30F52F56060B095D7A875EBA618820FD974AB40C4BE38F9711716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579648, "uuid": "841c5834-be7a-460a-b473-80694d2c4b66", "value": "192:Pya0NsjXh7W74N5eNA2A+EnVs+mg1SoBNJY5O36PvaK0hgY9mcWeztH9B:PyXsjXh7W7u5+A2bkBdBNJY5OqPGhd9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691579648, "uuid": "dacd5e45-3040-4632-85be-003b66c6dd13", "value": 11116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691579648, "uuid": "0a3e5143-392e-4e35-9898-be685135d52d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579648, "uuid": "699dd1ec-fb7b-4894-9591-a98f2a20fcb5", "value": "759759DE59.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c92b15-36aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691581805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581805, "uuid": "c60506bc-e87b-4eee-a6d5-ddd41fcdc39f", "comment": "Malware payload (Mirai)", "value": "862f6d32d5027e400df104e979ccd675", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581805, "uuid": "44f73094-6576-42c2-8897-1998d4fd4a8a", "comment": "Malware payload (Mirai)", "value": "9f3bafefa88f2f641dcd2c96ec87d3c4bb3eab5fc1ae6e8f0441542203febb75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581805, "uuid": "649df078-b8dd-4ce1-998e-a0c9f2c0a270", "comment": "Malware payload (Mirai)", "value": "56b94f93012cc478e391b5550237d0d9a87c307e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581805, "uuid": "bd043e4d-8d48-455c-915f-ffabd25bdc83", "comment": "Malware payload (Mirai)", "value": "51cd87d4625449622b70c2e531e9311195d6594e14b8c3c191775e22fcd72f7cad332fb51b0ea9b3b262ae0dad0d652e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581805, "uuid": "d81a6ffb-f75d-4c55-b62a-c82b12a1a36d", "value": "T1E8532AC8A0D3E8F5EC14097D307ABB629E73F13FB176E99BC7E86573A801602910665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581805, "uuid": "038f0548-83a2-4bb5-adb3-670cd561f538", "value": "1536:OBxpWlXJcf4slZQLkAlitWSWY/Pfd+700ngkM1e:OgXJcf4slZQLkAlitWSWY/Pfd00+dM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691581805, "uuid": "e3021621-9ba4-4b70-834e-d5086e77f2d4", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691581805, "uuid": "5bb543f2-3a5d-48d0-95fc-8f11b6e9f348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581805, "uuid": "286d2d7c-22f6-4724-8aae-248dc175f0da", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3fa6aa-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691571681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571681, "uuid": "247f8365-b99f-4fc3-9001-9b222be8a122", "comment": "Malware payload", "value": "295ad2ceda4dec3c03083ead5565a79f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571681, "uuid": "f14d3ed9-71f1-4fd5-a7b8-ba39f04602f9", "comment": "Malware payload", "value": "9fd0e5c79931152a159063cb32edf88bf8933ce109a0fb7dc14ea9940983ed64", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571681, "uuid": "e84bc013-0111-476c-9ddd-e82729cd39a6", "comment": "Malware payload", "value": "c96a4b63ad7e25041ded053cb719b37341272447", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571681, "uuid": "65d6497a-4779-4b42-bba7-2ce21c9a04c5", "comment": "Malware payload", "value": "4cc97cd1088c84fdb3bd8c85c38db52562795994d2558dad93202c0741d574745bff159ca949dc56c7d69b1940aea504", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571681, "uuid": "f5aea0d4-a2df-4cca-b2cd-eeefd6863dc2", "value": "T17166330571C98F36D9EE4372A72BD36B8A276D105123462FA26959083EF3C31F5A33E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571681, "uuid": "9f0dceb4-e0f6-4077-a82f-3e541d12875f", "value": "196608:xhD4w9vS2MOTKAwOJMWZNnqMsdOK5HeCtf09RKucCbKf/u:XDF9wZA/5+fAK5HR693Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571681, "uuid": "922538fc-2cb4-4693-98ea-9ed480a2eb86", "value": 6697472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571681, "uuid": "781122cc-b7c8-4196-8bfd-e3efe1a48176", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571681, "uuid": "e1990e15-415a-422e-b611-48dc75efc61c", "value": "arq1A3bD5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324362c5-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691571632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571632, "uuid": "0e86ca64-ffb7-4825-9c75-b3716a0c11c7", "comment": "Malware payload", "value": "8c7c683fec001691e195b81efe3e320f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571632, "uuid": "d13e8bd0-3406-4024-8aa4-2cd3827a1bcf", "comment": "Malware payload", "value": "a08ae0d51526a0c2de92efe84d0cad9d9234311ed9d36d04d4c16973bfce0d1d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571632, "uuid": "6b76d316-7b1c-4474-b967-dc86a0701de0", "comment": "Malware payload", "value": "26a4478ff1fc03943bda69d0c2ba85d804006587", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571632, "uuid": "28056fcb-e0b7-4dd4-8579-e0c139a19542", "comment": "Malware payload", "value": "da31e33261db7996b27c3c7e991ad8b11d4125dd079f5b35cbf6426df3fdcbeb2cb2105c2f77af3331bef9d1a20f2ef2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571632, "uuid": "d91a64b6-f90a-41bc-8515-8282c18b0cfb", "value": "T14923F1904A46F329CAA22937CD9C490A55F33339D497535203F822B9EFE6A82617C337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571632, "uuid": "9c1c7d63-3bcd-4eb6-b973-151c178fca74", "value": "768:4jcX4UFv25+1ZzjQA0l64wxiitT6NBg5sbIa/KxtD/NkrH73Ur:BXbvDYl64wUGLmmb/Nkr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571632, "uuid": "18822cf9-d671-4b90-9873-728c86066557", "value": 47912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571632, "uuid": "6e19dcb1-6748-4b54-96bb-bad9e48daab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571632, "uuid": "ba526332-bf8e-43d1-bdd0-8ffa88394924", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5945af27-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602621, "uuid": "27cf4dfb-0172-49c9-99e6-9080ffa7bb36", "comment": "Malware payload (AgentTesla)", "value": "dac1f2dea021a78814e506c6208e77fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602621, "uuid": "4aaf6bcb-e0d3-49ff-9454-41102ef52880", "comment": "Malware payload (AgentTesla)", "value": "a0ab45b0099b4bd92da2c5af6207914438fe27768ba3e69168dabe6f1a57b7c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602621, "uuid": "8aeec081-4b80-4d46-8ae1-c7f4a9f06200", "comment": "Malware payload (AgentTesla)", "value": "4eb7a7e06cfdcb268367486edd66dfc76b503dbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602621, "uuid": "e564e183-7633-4816-b847-4d9add2bdac5", "comment": "Malware payload (AgentTesla)", "value": "0ae6da539df0f531eb053d5552daf289eafe316d793db8e43480075704e14330ed59f8b1e03c0688c75846728df9f3be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602621, "uuid": "71c646be-fef1-4635-8c4f-c3d4da5ea629", "value": "T165D59E19A39509E4D016CA30C92A9733E3B1F9561730F39B0966D7962F736B28F7B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602621, "uuid": "ee666da5-841a-4a0b-984c-961f4a9a5eae", "value": "4be9cf61fbea6eb1f9072ab06ecee6cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602621, "uuid": "b3053950-0176-4b6c-97c7-f12b7920f874", "value": "24576:pgJvZOjeZ7m6eEG9Nev1IkCuW+ORhTKCs0typzPmZNFGbLXSyP44jM:pg6a7BRGL0IkCX+OjvIpzPmZNFaXSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602621, "uuid": "104a5750-fba8-4d7d-83a0-00b028e7756a", "value": 2936320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602621, "uuid": "8322e2ce-9ffc-43a0-9b76-98e965e0662d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602621, "uuid": "6331ebff-adf7-4d01-b842-20e63825bc1c", "value": "TRANSFER-COPY-TT.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975ef004-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691599719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599719, "uuid": "df2003de-5761-4dd3-aa80-a5713cf25b9d", "comment": "Malware payload (AgentTesla)", "value": "2bb757fb2385ea6c368c341439f78f23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599719, "uuid": "9382cf20-6a39-4465-a23b-e92fabdd5c0c", "comment": "Malware payload (AgentTesla)", "value": "a1b31f162a1ea21f60915c5120b38ab471dca83bc98cb481d4a043ac0c3ee9e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599719, "uuid": "7ec9ca18-a6b6-43ac-8fa5-1a65dc26d264", "comment": "Malware payload (AgentTesla)", "value": "be54e78584db5a497ed839c2953c2919ab909043", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599719, "uuid": "fd62159a-846e-4001-a0dc-b75c304342f8", "comment": "Malware payload (AgentTesla)", "value": "dc945af54a000e6acb84f28a695bbbed50442b40a801effbf596a57f86a4157869c0221ea4fd74edf187da2af31e47ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599719, "uuid": "b2a4228b-e1fc-4666-b898-e796536c36b4", "value": "T11244124A63E9C0E2D4B60B733F3567113BF5E60A1078E60BA391BF9D7817A42C61E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599719, "uuid": "f1bc5115-5fff-4a5a-b9e8-209e95b7ec2e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599719, "uuid": "ccb8e7a9-10fd-4dce-ab2b-272af3083129", "value": "6144:JYa68X/fr+ZreQy3Od0ZW3Qx/ZF4JJSSGO8aVPZLTl4jef:JYO/+reQyed0I3ef4JlGO8qZLTuef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599719, "uuid": "0c81b910-be04-4956-81d8-7b930386e3a6", "value": 273770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599719, "uuid": "dbde772b-29b6-44b9-a3e0-ef3f99c67583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599719, "uuid": "1b99c19c-14e5-4813-ba82-34440110bd54", "value": "SH0945678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7306f32c-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623280, "uuid": "c4b19634-bb71-4bc4-8a87-8a7bdc33f251", "comment": "Malware payload (RedLineStealer)", "value": "cd31c0971eefe7fdb2ebbc0d4393dd38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623280, "uuid": "8feb614e-0ed0-4b6b-9bb6-9f56b3e2c7d1", "comment": "Malware payload (RedLineStealer)", "value": "a1bba247dd07d12b06db9273abbbfa652dc11a0a036d8ee61bdbc3014a18b3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623280, "uuid": "cdcdfc5e-b9e8-4942-8002-b6bb9305e3b3", "comment": "Malware payload (RedLineStealer)", "value": "95f901b9255ebf4fc93df7e00a3c79fe758f809c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623280, "uuid": "7b653205-e652-4d3b-89d3-d3eedb9c3b6b", "comment": "Malware payload (RedLineStealer)", "value": "9ae0ad79fb115f1de96f12dfeb48a104708b54a350d0dc9ab5844eedb39c3de3b99810bff7a9f3a197572389f2edb00a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623280, "uuid": "5aa4e42b-58dd-4d91-b7b6-dd44ba159c6d", "value": "T1E4C41253A6D98032E8F627F069FA06930E357C635D74922B37459D0E1CB36C8AA3573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623280, "uuid": "e24017f5-eadd-4d6c-9aa0-85b8740c9b48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623280, "uuid": "52dcccc0-308b-4907-8763-27e2038ff3d3", "value": "12288:rMrqy90BRtfmdZSP6se2xINELKrYKPE7gBYCEm+G4nwARaiEG:hyytHk2xiUKPEUzN+twARaiEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623280, "uuid": "fa45c456-d1d9-4043-ae85-685d044c6dce", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623280, "uuid": "d29fadde-6293-4bf0-a3d0-9c1fd79fbb25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623280, "uuid": "84835fa5-281c-431c-bdf3-6ad5542ae618", "value": "a1bba247dd07d12b06db9273abbbfa652dc11a0a036d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6db0c47-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549145, "uuid": "5488d972-83cf-4e35-9ff8-c74bf181fdee", "comment": "Malware payload (Mirai)", "value": "70e6e66686d81c35db922eedba2c4e9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549145, "uuid": "b6bfe63e-b65c-43d8-acc3-8c726719ab90", "comment": "Malware payload (Mirai)", "value": "a1d1d4d582af1b86aae880834eb67311cdff16c99959a6a9648bd8a37bd62909", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549145, "uuid": "2f7b1e5b-672a-47fe-a7b9-157b5083f01e", "comment": "Malware payload (Mirai)", "value": "3ffda8985faea5a32df948b58bbcf0c236f6e7b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549145, "uuid": "8740b4d9-8e2a-4f35-b19a-29b4ab5ba17f", "comment": "Malware payload (Mirai)", "value": "8771d001b3de9dd72d797f2f858fb7fa0caea44626fe72a261b2875f88f373faff63228aacc4ffa283f333aeb29570a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549145, "uuid": "6fa75b0d-2215-4c01-965a-94003646cee9", "value": "T1F3538D75D11DAEA8C0414AB4A9198E705F13E4C046733EF7EA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549145, "uuid": "a62e2dc5-43c6-4fe3-9f70-6c30358c370c", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549145, "uuid": "7552d069-9fe1-4b41-90db-e1d5bf869b7d", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549145, "uuid": "a221b68b-2c5c-4b40-a871-812e724c7004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549145, "uuid": "7f760050-a8ab-4f85-a20a-4b531f9db545", "value": "70e6e66686d81c35db922eedba2c4e9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ac5489-36aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691581807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581807, "uuid": "c3406002-de02-44d9-88ff-58dda959a4d9", "comment": "Malware payload (Mirai)", "value": "a6ac6ff63421934d272ce856296d380e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581807, "uuid": "90fb4267-3b68-45a1-8197-bd978a20c4cf", "comment": "Malware payload (Mirai)", "value": "a1d7d9fffe510a2c07fbe0c1b7e68c145e216f3fe195c98f551cc35ee97c795b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581807, "uuid": "fb7a370b-46bf-4c7e-9bc2-4b03d5101eab", "comment": "Malware payload (Mirai)", "value": "ad42ce70d56c9924a7277c1d30c51d944901e023", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581807, "uuid": "6dcd7b60-f575-464f-adfb-5cc434b96fb0", "comment": "Malware payload (Mirai)", "value": "f62b559c60fa807a6464b3fb2aad6b87d7c6d33fe84aab0bf72a3336d4d24129fb26bef6304582e155931a583e3bac9b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581807, "uuid": "95e1fe11-5291-470e-9073-8db1268f04e5", "value": "T18F6319827C80AA26C7D0177BFA5F108E3315A7D8E1DA73438C142F9576CA81F0D6B78A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581807, "uuid": "e064c4a5-fd2d-4a6e-9661-6ba77f338811", "value": "1536:6h/LYbUxYVUUO03k704oVLMNKHwnCnJeZWoX22vM:6h/LY0nCJwpXbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691581807, "uuid": "32972051-b0d3-458a-8545-7aaaf343cb58", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691581807, "uuid": "608cea8b-3aff-4704-abe6-eb19b64fdf16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581807, "uuid": "af3bb7e9-bfd7-4764-8594-be51e5858dc3", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82662f99-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691599684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599684, "uuid": "94256cea-1c84-400f-af47-965090e0145a", "comment": "Malware payload (SnakeKeylogger)", "value": "326dbf5295844e15516feb8520ab33c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599684, "uuid": "e63ff0d9-8c9f-4e5a-891e-373b6bc21620", "comment": "Malware payload (SnakeKeylogger)", "value": "a2a9ad6892d2d72d881f5a145d4489bb4b789e25d45449929063422590102875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599684, "uuid": "d150a753-04dc-4944-9a19-a3ef43e3d946", "comment": "Malware payload (SnakeKeylogger)", "value": "bc83bbb84d23e5be357a2f16612587881e52dfdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599684, "uuid": "610c8680-3ea6-4d0f-911d-4cff2ba93982", "comment": "Malware payload (SnakeKeylogger)", "value": "a514a911052278b8d75d383ff9fe05d0ba9aa2eb21cdd988a1f4b1be8d058ca0e71212075c64c3aa558aa17d4cfc89e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599684, "uuid": "0bfe4261-9b31-4225-94ad-819e068253cd", "value": "T15C44F21869E5D51AD4E07AF059B0569369A2EDA60434818B9BF03F2CF632113DDCF3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599684, "uuid": "d1b3cc64-d960-46e6-898e-405dd89c6a91", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599684, "uuid": "8abd6570-0597-4ffe-b34e-630d50c40da1", "value": "6144:wYa69EVD7JiPjFehhxp2J3b76oLXV0LLYU6:wYfyJR/x8X+LM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599684, "uuid": "ac7bc5e0-0825-4cea-98a1-706c5f5869aa", "value": 270551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599684, "uuid": "ffbcb10c-11b5-4fb3-bdff-2379dba73472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599684, "uuid": "118eed08-0b56-4ef2-9acb-6beecff58590", "value": "07654345789997654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1e02c0-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691583975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583975, "uuid": "3a5461a9-31d1-4aa9-8ff8-5d3e7d604414", "comment": "Malware payload (AgentTesla)", "value": "65f0061e67f326e70fae0ca85d8e6310", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583975, "uuid": "9d750590-968a-4efa-b48f-88a570dc1040", "comment": "Malware payload (AgentTesla)", "value": "a334c6122bad0425124968bc3a443bf3a4ef2aabb1e865f03fee17122f0c6885", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583975, "uuid": "61f895ab-bd3c-40c9-bfd6-c5b2d0cd4c3f", "comment": "Malware payload (AgentTesla)", "value": "003ce46829be24d179735502002a06d9389e67a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583975, "uuid": "6fb54674-1e5d-4f98-a4a4-c40509e264e5", "comment": "Malware payload (AgentTesla)", "value": "cafcc91f7a0f9794ff28ff39107a72b08017aa9460179ca68d566eb5385e1b27ff3b5a4b5945955e2070248e3fbc8fc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583975, "uuid": "4aa29f68-1797-4849-976d-0e5fec4f4135", "value": "T1F4C43D8A36EED0C0F2D2AD4183D458B4DBCF75D29834D925A80C7D1E23DF926CE51BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583975, "uuid": "9e67eed6-da7d-423a-b275-43b05bcacc09", "value": "6144:e/IC+zK1wPKe/Aj7isnlbUHAvz162fsq/NR3nPACuvkSF:eQC+zK1wP1/Axn9nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583975, "uuid": "bee3d222-1024-463d-ae19-47588c174e21", "value": 584980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583975, "uuid": "b2abb03e-72eb-42cb-8a56-09cece859295", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583975, "uuid": "4035bb3e-eba3-4b1b-96f2-76f049452ad1", "value": "kwen.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad335374-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691602762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602762, "uuid": "49d47ecf-465a-43d1-887b-a94a3d186329", "comment": "Malware payload (Formbook)", "value": "db8abd69d800445013f2e4a7e5e28a73", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602762, "uuid": "5786d51b-7880-4e14-8354-99e5b9dfc840", "comment": "Malware payload (Formbook)", "value": "a36813a35722d441ec430098be1f72cde0fb40c561ea21b858ba7c10516d62e4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602762, "uuid": "d94b485b-c9b9-4a3a-b11a-5af998916635", "comment": "Malware payload (Formbook)", "value": "3cb5795befcee06ff8cf7d620258b2ccbbd87526", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602762, "uuid": "bc39591e-46da-4a01-a0a4-d00e8e66c9ee", "comment": "Malware payload (Formbook)", "value": "ce9baba6140ff507aa2b017ead31671546619b4bf1b13504460417bb25b1942195e0e0398490c22c5c5b763756361d77", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602762, "uuid": "b9052f7a-2271-476a-8cb2-0449f497081b", "value": "T16E15E0096114C589C1BA25B6E944E5FC0FB3AE24E932C60F5AEE3D6F3B336564D00F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602762, "uuid": "a038171b-649f-42a5-a4e0-7ab75c54d00e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602762, "uuid": "877808e2-7ed3-4651-8a79-e7084950b82c", "value": "12288:yWl6liF982iNGQrd6B8rKuFqkztT7dcthnO8MmXka0AnO7sA3hX3QesKRSw11RzI:16lik1YB0FwkZ408MmX09wh5K8OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602762, "uuid": "47c3f2c6-37f5-4822-8162-4d937d590549", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602762, "uuid": "086c0647-2594-4dc1-bb67-37aaac3f3ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602762, "uuid": "54cd3c0c-0304-448f-95e0-870edec35eb1", "value": "DHL AWB 378008600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c7ea77-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606246, "uuid": "b4ef731d-43d4-4c3d-bdb3-04bf7fa8ee5d", "comment": "Malware payload (Mirai)", "value": "c193ce08f554e2a62c3bdb43816c46c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606246, "uuid": "1fed1c6f-1ad7-441d-960c-38c955553f35", "comment": "Malware payload (Mirai)", "value": "a3cdbf0c1f03a92c12c263cd3859ddf3fa87dd48b12356fbd5bf2418755f28f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606246, "uuid": "bf3c898c-f5ee-4cfa-88ce-a50c6f30fb69", "comment": "Malware payload (Mirai)", "value": "e0f6a644563a228c5b4129dfc39c18c23fbe06a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606246, "uuid": "226cc42f-bb4e-4b03-aab3-fdbf7b7ea6a1", "comment": "Malware payload (Mirai)", "value": "18c0f34d5b220bc40d1da0a54ec13d87a76d4959c990c6220404cd6184f4d11f54a0bfda03daff1e096a75903701e8a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606246, "uuid": "d195e852-4823-4e35-9ef5-dc9fa0dfafc7", "value": "T1A9E2F197E372A452DD7C2BF1F86D81CB2B7D8FBCC57670A30A0557182A5A0535E2C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606246, "uuid": "6a063690-b506-409e-8acc-f4bbb6ebbf08", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9Xn9q3UEL5IE:korm1vpALgUJ2L7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606246, "uuid": "d97ebd90-3cc7-4441-a0fc-f05dff82cfae", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606246, "uuid": "2f722a0e-7c0e-4046-b8c1-59edc48cf57a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606246, "uuid": "b61dbdff-79f9-4c30-a959-d6d5ba956f9c", "value": "c193ce08f554e2a62c3bdb43816c46c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a461d048-3694-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1691572253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572253, "uuid": "6cff8537-5f62-4149-8bf7-5889f4d87db3", "comment": "Malware payload (Arechclient2)", "value": "99204d4087c88e999982a0810af7c998", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572253, "uuid": "2207e4f0-e579-4bee-87a4-2e4e27487f0f", "comment": "Malware payload (Arechclient2)", "value": "a3ceda3ef0a7b72145124def334dd3fa337614a1170960826016996151188fc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572253, "uuid": "754ccc49-543c-487a-91c7-99644f785ee2", "comment": "Malware payload (Arechclient2)", "value": "190f52f65de59151a016d7e815dd9be842af17e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572253, "uuid": "36a6be7e-2298-4cce-9e50-7bec9bab583d", "comment": "Malware payload (Arechclient2)", "value": "d3287b0584d4ee93ac7327995c637c81257317b01b946fa0fb4d2835ab12b6804e4eea52e1ee084a60c30c023be84e7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572253, "uuid": "d58ca6ef-21c2-41ad-8f16-a7af7939cdec", "value": "T1C9C533B92D499AC9C5D99B3C15F1E2B5E438BD18D885AD117F0AFDFC8B38192FDA4200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572253, "uuid": "d4a9d8d0-2de6-4848-a8b4-306962db739a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572253, "uuid": "0794b63c-ba53-40f6-9a1e-c2c165275fbb", "value": "49152:Oa0r7Pt9F3+djNVLfxS7152y4ynj9RSEPcddo40LHxx+61iY8:Oa67PVOdrohb4ynjfPmqHf+DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572253, "uuid": "e6b1dbf0-3f18-4c28-86ff-29f60ad7bd9b", "value": 2708992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572253, "uuid": "08588894-f5f5-414f-b56a-22b9c0ee6e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572253, "uuid": "9b17c7bc-2076-4e65-8bcb-07068ea15fcc", "value": "99204d4087c88e999982a0810af7c998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa3ce1c-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691602624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602624, "uuid": "780e2f87-ce6c-4d99-8d5f-bc41d9c1f5c1", "comment": "Malware payload (RemcosRAT)", "value": "d81c91c2c8c9817ea7b84b281cbefbef", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602624, "uuid": "4c46523d-2f9d-4baa-a933-922c67f5a637", "comment": "Malware payload (RemcosRAT)", "value": "a4eff0bd701aee3050fbd628bd89ed77c6ff12661e0a146082fad375cc99f2ee", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602624, "uuid": "9332093c-f03a-47ff-bda7-9051b55b8f1f", "comment": "Malware payload (RemcosRAT)", "value": "74e36c24d750b7276804e6b689c034c51ecf1623", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602624, "uuid": "9f380096-6abf-4e19-aa6a-7777d1aad148", "comment": "Malware payload (RemcosRAT)", "value": "925f08b4233956b70a6547b9150fc4f2456adbd7f33591a8807ca1fc1b9b851b40e60f304ec5efc70770d66ea68b69cb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602624, "uuid": "6243da8d-6417-493e-aa7d-129429ea1f84", "value": "T10B517D142BE90721F3B79D7356B752218877B805E9756B0E008C42C82B3BA11A865F6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602624, "uuid": "68de048d-2d5f-4d57-b92c-c00ba0b4937c", "value": "24:8AGJtnyUlVef+iFnqhG+NQdd79ds5/f3s:8/mFnqpCdJ9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602624, "uuid": "b3a4177d-ebaf-4c1b-8584-5dd2296c1c90", "value": 2818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602624, "uuid": "e458f2a9-f4f1-42de-9426-43f15399d58e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602624, "uuid": "10023eb1-1730-4665-aa9c-ccec8068c0d9", "value": "Absa.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e32db8-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691574947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574947, "uuid": "ecc2e61a-78da-455d-b19b-ab26e7a3181e", "comment": "Malware payload (AgentTesla)", "value": "a1d1b746da75f6f887ef0f05b04c8d1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574947, "uuid": "d11b6ade-adfc-459b-a25f-153152dd0b96", "comment": "Malware payload (AgentTesla)", "value": "a53b6e198a7acfa16c86f39d607493cece30246a4c4195663a52eb80e3fd1820", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574947, "uuid": "b800978a-b7a6-4d90-9191-ee12259af5a2", "comment": "Malware payload (AgentTesla)", "value": "9dc476294e6a92a49a7da5c3225210e2621e0ea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574947, "uuid": "fbffddf0-9b09-4b9d-b6de-bc9854960cfe", "comment": "Malware payload (AgentTesla)", "value": "a913b118dc95de9e637b8afa649e75f196ebdcea6990a6c120db33db02aeeed064da089902d9c051a00f5b30b7d60b38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574947, "uuid": "a9b67808-269c-4076-8436-1792c34d7322", "value": "T15BC4122556FD8F96E0F65BF8943520680FF7720514F3EA5C1EE029EE5D12B429A02FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574947, "uuid": "dcc2f024-532a-4fc3-8226-9283099c520b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574947, "uuid": "ab54fba5-356f-460a-b651-2abe896a5dd8", "value": "12288:tniF9aHEzJ2GZD1vqzXA5DRzLQMXN2Trax9RtSNJ0lYoPAYLVP:tniSAJTv6XA95QMd2OgNJ0lYoPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574947, "uuid": "e3322c8d-e65e-401b-aa8e-b28b7e72e274", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574947, "uuid": "5c063822-69ac-4454-abb9-a38e799b0df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574947, "uuid": "d7f2e4d7-32c9-449e-a1aa-42a3c0a71d71", "value": "a1d1b746da75f6f887ef0f05b04c8d1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1618d68-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691606259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606259, "uuid": "96f5e509-7da9-474f-9b14-d8c47a4d36fd", "comment": "Malware payload", "value": "e8ea1b6581dc17674bac8ab3202fa6f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606259, "uuid": "5d5b4bf7-3e0b-4d4a-a613-73da91268863", "comment": "Malware payload", "value": "a60c704c2880e95ec250fda4314421adb44b29fdb8ac3bc6c98c1166e051f507", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606259, "uuid": "7d0ed9f6-4ef0-43e2-a130-e4a5b8f28a1c", "comment": "Malware payload", "value": "0d025615676dc89360262edce2ac11e9367ebc6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606259, "uuid": "cc26fe9c-3b00-4523-9b82-1e59b2ee3885", "comment": "Malware payload", "value": "2a8d355c1fe3c33399a99deefe3d1171de2db109cee10bf91c4bd4398e53bb9195761ecdaebcea66faae177bae37b486", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606259, "uuid": "effa06fe-354f-40af-bde3-788271ea348f", "value": "T1E98412C11071D02BC6721AB15DFB14447EFBAAD0A8A5366F33916F1EAC113C2E91F69A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606259, "uuid": "efbe7378-a035-4f44-95a7-6033c4221121", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606259, "uuid": "64068b5e-869d-43e8-8993-7e4665f8b785", "value": "6144:RM23f4A9+Jhh+UxFiBisayoz9kY3j1MAqpOjzwW7FAqA+ZrEH5iAelU33j8uC:jPFgHFxFixuuY3j1MnpOjz7BZrHhlU3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606259, "uuid": "d5e55eff-2748-45f3-aeae-89ee91e28635", "value": 375888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606259, "uuid": "f5b77d89-b328-4d44-a236-e78f836c57d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606259, "uuid": "84b54a5f-6fdf-41e6-aee8-9cc4a2560abd", "value": "e8ea1b6581dc17674bac8ab3202fa6f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72815b07-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549406, "uuid": "4e85e14c-8f1a-417f-a168-b9985e915aef", "comment": "Malware payload (Mirai)", "value": "15419c0e92af3ea8b2ee610bf6187be1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549406, "uuid": "15f398ba-1fff-4f20-a8c9-718a46a55542", "comment": "Malware payload (Mirai)", "value": "a61fca200f2d0936240b3636cb876fbd338893e17a8a83275e1f3b24663b1f3c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549406, "uuid": "26a0cf66-42d9-4e7a-841e-86f3d2fcec9a", "comment": "Malware payload (Mirai)", "value": "1f6ea3b9346212a9e8f6ab93a8b371115a28b1c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549406, "uuid": "8bf253fd-8978-46eb-b80f-46626d4256f3", "comment": "Malware payload (Mirai)", "value": "f3c9d0b232d56db1e6f65a3c1391f07e023ef95936eb18b64be9b961d25c5d774606e277bb6d27134fafaaa868e43807", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549406, "uuid": "f5a6585e-fbc1-4f15-a12a-3f1f4aee8866", "value": "T17E031B48B600E0BBC10741B225968BA76235E739B080E89AE7556D3AF77A501C773B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549406, "uuid": "3bd63d82-a944-4479-983a-4b781d731284", "value": "768:Sh+JEB5A1heCG8b6p5heccX6G1Ir8iXQtrt8VDSu:Sh+BYCfb6Ve7qG1Ir8iXOrtcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549406, "uuid": "d5908b4c-0365-45fa-8188-d04a5d020272", "value": 39892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549406, "uuid": "cdd53e1a-2f7f-455d-ba79-3c2937024276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549406, "uuid": "406ac94d-334f-4ab6-8ac1-3b6f2fdea253", "value": "r6vaw1.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2b7449-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606250, "uuid": "df3d2b87-0fae-4e4b-9e2a-87477d7e0b3e", "comment": "Malware payload (Mirai)", "value": "b6fa773dee831da7b47efeeb854fe41d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606250, "uuid": "5e4295f8-4dd0-4dc9-bfaf-aa6230f70454", "comment": "Malware payload (Mirai)", "value": "a7ed9c33db36c0c1f159b982a99c8019b2b23418584d9ae6521174be48254cdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606250, "uuid": "42d4fb11-79f1-4146-92d0-9ea1e4972ae8", "comment": "Malware payload (Mirai)", "value": "5997523313a820d10b056c5200b2194c8645c50a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606250, "uuid": "fb35af27-badb-4096-9f83-f806f6ab6327", "comment": "Malware payload (Mirai)", "value": "54690fb31111d751f8f4b19cc487494f02cfff55f6e1f490a50d61540488d61d5f9e0e5ddef914411836c2c66c9734bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606250, "uuid": "2b05f262-32de-4898-b333-7d52a0230c54", "value": "T1DBB2D030B1A960F0CD316038F87DC987ABDA41FDD1FD3722266650F85A9688D15EC9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606250, "uuid": "456441ed-f48a-458c-ad87-8f351b6490b3", "value": "384:joBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1ZYhymdGUop5+:7aNSq5sOHpTqncvsdDePiAUgefoeDeXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606250, "uuid": "17ad56be-b1f1-42ec-9abe-ac17dce6ae59", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606250, "uuid": "e1a4a447-8aed-4ce7-b975-f62387321c36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606250, "uuid": "21629f04-a15c-419c-8a72-c3a83422d3cb", "value": "b6fa773dee831da7b47efeeb854fe41d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe73c79-36d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691600485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600485, "uuid": "488b5554-85c1-4872-9275-d8fbac273b6c", "comment": "Malware payload (RedLineStealer)", "value": "15374fb3a9b72c19acc15510f20b39a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600485, "uuid": "2d55314a-b252-47b6-9a26-769b0a9c32b2", "comment": "Malware payload (RedLineStealer)", "value": "a7ee9e7460c5df99ef14e524364a233d7816881a104c9f0a735d0a01a8ff3146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600485, "uuid": "3332295d-b13d-46c9-9081-4cec3f431d6b", "comment": "Malware payload (RedLineStealer)", "value": "0c45c22c1d37b3f11464bc25b1cdfa168b8d36d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600485, "uuid": "e7d5d4f7-cee2-489c-bab7-cfa7b2cd58c6", "comment": "Malware payload (RedLineStealer)", "value": "05a688e18d7f727d7d830888bfa603797dcfe30eb0e4736e390ec3d09646af27bc08ac619890f1bd2af7de98d4a559d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600485, "uuid": "8e4803d8-b69d-427d-a316-8ab28945b23b", "value": "T11013F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600485, "uuid": "b22bbb20-0fc1-4fe2-956e-0a828c19b8e2", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691600485, "uuid": "4ee96c6d-ca9d-4487-ba6c-ef4851b2c179", "value": 42372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691600485, "uuid": "5fde6602-8c14-4af1-b3aa-ee061fe7ba8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600485, "uuid": "dfd4bebe-b678-40e3-909f-558d4c879097", "value": "15374fb3a9b72c19acc15510f20b39a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8a04fa-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691623889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623889, "uuid": "d697867e-7384-4057-a7a8-74e25c0b2cd1", "comment": "Malware payload (Amadey)", "value": "df9e2ce1b415039496a2a1bae24410e0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623889, "uuid": "ac72c9b6-5037-4b41-89ea-e28eecba52a9", "comment": "Malware payload (Amadey)", "value": "a8dd33d1373903c9f8fa1d0772696d52acb10537498fd40856ba2ce15453ef0a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623889, "uuid": "67f2fd99-a141-426e-9463-0034c32b4f0a", "comment": "Malware payload (Amadey)", "value": "b9f27b8e8f816eeaafdc8a7d8d6eb4cfb2927202", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623889, "uuid": "b5d709fb-76d8-4ae5-863e-5e81cd180b81", "comment": "Malware payload (Amadey)", "value": "2b76f51dcf331ded6e4163dad66ebaa82c29f64d7fdf8af7b29c865661d500b0077896b94a39d4085705cfddc0ffbd04", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623889, "uuid": "ad4410bf-cd1b-4147-994b-ba3c04a54572", "value": "T127C412036AE98177D8B52BB048F707D30E367DA19C34936B3345AD5B4DB26C0A6B2727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623889, "uuid": "049a9478-330f-4651-8401-51f818da8984", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623889, "uuid": "facc9530-6b9a-4fc2-b96a-b13213e57931", "value": "12288:yMrey90zXs1nvaB4kr8zHbx39Wz7D19tU1uS:Yy+XsRva2DHpkz7D19tax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623889, "uuid": "3aea9864-2812-4f65-aa68-4833d7287530", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623889, "uuid": "d47faefe-b63c-47bd-96db-5d0d4f31ec6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623889, "uuid": "941a8f95-4136-4f7e-92b4-8702c172c7ca", "value": "a8dd33d1373903c9f8fa1d0772696d52acb10537498fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50eabfc0-3695-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572543, "uuid": "54908126-3303-457d-804a-d9b58fd02110", "comment": "Malware payload (RedLineStealer)", "value": "dc1fa07d508dd43279e2797083e4716d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572543, "uuid": "3105992a-cf24-4d89-9d5c-26701d13fc70", "comment": "Malware payload (RedLineStealer)", "value": "a97e91ed2476478b7fc554612ac69ab37b26d2354b965f267271c9474454aa6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572543, "uuid": "774f7c13-60cd-482d-8069-d0943ff96265", "comment": "Malware payload (RedLineStealer)", "value": "850bd86076f333f4d8ac41ed7f5693b0b3e545d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572543, "uuid": "ed6c8c47-1e8b-4971-97a5-c39a2354b199", "comment": "Malware payload (RedLineStealer)", "value": "723d75454a5b021233555f47a614b76e5b45d6f40746398d6b470e7b005fa389d1e0fa74ebe53b1a89ae9b2634855e74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572543, "uuid": "3e988678-07c6-49a1-9912-b342c77ef718", "value": "T12AC41203A3D84072D9F527716CF706931B36BD625974833F3B41EA4A1CB26C4A87276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572543, "uuid": "25580c82-f327-405c-a232-fd4d7c1f90d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572543, "uuid": "d4dda700-2efe-4432-83f5-b39685c520e4", "value": "12288:7MrNy90ph0Wv80+M6L7b5Cf6sGGhJCgBYCYPecoJmYKNwr:+yyJ+M6XW7PxzoecotKNwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572543, "uuid": "a4c8b3cc-6241-432b-aa36-6df3842fa8b7", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572543, "uuid": "981300fc-a618-4ffc-aeff-6ac95904090b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572543, "uuid": "b2c58207-94c1-4258-8eed-9b418c6c510c", "value": "a97e91ed2476478b7fc554612ac69ab37b26d2354b965.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdc3e5c-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691599787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599787, "uuid": "e2557ae6-648b-4a80-97ab-d1e505de5cfe", "comment": "Malware payload (GuLoader)", "value": "8a03937e944b20ecc288a9361eeaf8d6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599787, "uuid": "302283fd-0dde-4e03-a319-e7c376e32658", "comment": "Malware payload (GuLoader)", "value": "aac88dbc105d5dcc83b431181c093c752ab9189dcc47576f8e0d961eb3c0c044", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599787, "uuid": "7d99167a-65ab-4fc6-90ea-13f6d8b12e66", "comment": "Malware payload (GuLoader)", "value": "bd17e8167bd7e27f74abf42f1286eecba8e82c1d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599787, "uuid": "9767cb1e-3e27-48b6-a919-1de8768740df", "comment": "Malware payload (GuLoader)", "value": "91d333a8c60e26596702919ee2443e067c18383c496376676d6bcd4b7340a51414b57cd770cd305d2515fc52138a1c99", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599787, "uuid": "ee0be3d0-f314-42ad-a9dc-242459b38663", "value": "T13A35E003E800DBC3D41D83F87E530ED91F0AAF19E99569DB05627F9B3A70A72099E52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599787, "uuid": "35d96343-d2a7-493f-b7b1-db2c02a704ea", "value": "24576:uRZyQw6VfZyrw6V4jKaWlEzp7aX9dlzZbtQA3Qp5EfIwsx:ubQ6VRT6V4jKjOzidHt/3XfIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599787, "uuid": "4ca62014-a46e-48e2-957a-22f96894a343", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599787, "uuid": "61d3b017-dbd2-4168-833c-24882abdcaf4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599787, "uuid": "190cfbfb-332e-4b84-ba4d-ecfbe33b02cb", "value": "RFQ 090823364.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5075b0b-36e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606614, "uuid": "b9beaa06-5925-4fe7-8e1c-fc2f82fc6520", "comment": "Malware payload (Mirai)", "value": "01b77f3a40e06505aa17ee12a618ceb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606614, "uuid": "2a5c1a8d-4805-4ea3-82d6-e42dd14aacf3", "comment": "Malware payload (Mirai)", "value": "ab1a41983957b866869cbca43f40015fd5b39d0c9c8d73035034ee7a1194d283", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606614, "uuid": "806d8860-854e-4760-b1f4-c2282b80421c", "comment": "Malware payload (Mirai)", "value": "982738d30b0d6cc6753b1f4d544fbfc62bb0d15c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606614, "uuid": "e47d1d49-3aaa-4860-8b41-8a2813cc15ba", "comment": "Malware payload (Mirai)", "value": "034039f0988a37db6de60a73714569635acc721b216ad2521b188810434c050c28315c4b9bf61d4fd65d13b6d051710a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606614, "uuid": "3c144aed-c3e7-44ee-95a8-b5758f645127", "value": "T1D7D2F18C76D363FA8DC9C6BE721E503630AE74E9B2B1A313B305C4534776184EA95E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606614, "uuid": "3a2dd28d-60e1-44a7-98db-eb79f46b939d", "value": "768:WlxKd294CxEnsU96IHE4RlY99V+7XEwAt:Ld29tnUFHEw0sEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606614, "uuid": "cbe94ac3-7bb3-49a3-9806-a0535e60057f", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606614, "uuid": "f2a1365e-3f1a-4d04-ad35-7b4a2f0438ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606614, "uuid": "663cf404-f651-4c29-bcf3-a9267030e9e6", "value": "01b77f3a40e06505aa17ee12a618ceb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec7f73b-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1691599705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599705, "uuid": "b7f2cca7-4e42-416d-ba02-be24a609e471", "comment": "Malware payload (SnakeKeylogger)", "value": "426740820527d82d14731ebb4542e361", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599705, "uuid": "681d6c06-a315-499a-957f-fef73570193e", "comment": "Malware payload (SnakeKeylogger)", "value": "abb26f21e1f2b4e6ff0ac8354b9f8079d8d291cd6e59e52dec89b8ae0c86e2eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599705, "uuid": "ca9d6c1b-af4e-4541-8b26-db4a708a5d13", "comment": "Malware payload (SnakeKeylogger)", "value": "e0208f6d5a74ff56b0c6dacee98e83848e546f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599705, "uuid": "8228bdd3-6bd8-47ab-b5ef-3e64454ccf56", "comment": "Malware payload (SnakeKeylogger)", "value": "e37fef9c55ebf7bbb6ba2e2e06b95d67d4cb4471a49ea31ef5f61be3617e9f6b56acdc0384b24597348034310da2a454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599705, "uuid": "e80da25e-df7d-4a1c-8023-f06795355aa0", "value": "T150456B22E77B654AEF25A6E89A2F847179C6DC80F1B1C58CB7E7280385C13114E35BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599705, "uuid": "e2df936a-b509-43fb-9ac6-c455a58e9c16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599705, "uuid": "decef16a-8f9a-4c3b-862b-35f3cf84e4c1", "value": "24576:5MyYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOROguO0MtXQyJfnRqcCs:CfRs6CE3jLbO9Rs6CE3jLbOvuOZFd0Xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599705, "uuid": "eaf4fb8c-993b-4aa2-9052-e5bad7587415", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599705, "uuid": "1021e584-a39a-495f-80cd-0e018763e127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599705, "uuid": "b2fca907-a77c-4bc9-9bac-f93a4e668823", "value": "Sales Contract 090823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c823720b-3691-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571025, "uuid": "be642884-5281-45a5-9ead-7c20605af8ed", "comment": "Malware payload (RedLineStealer)", "value": "9bdcc27cd289181f160367a059cbf7f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571025, "uuid": "e44b36df-2311-41b0-9fcf-158ea777d5a8", "comment": "Malware payload (RedLineStealer)", "value": "ac32630c239478425ee210e460a17dc48f33573ae08c365f0d006c509ce41355", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571025, "uuid": "07de1fe6-fd86-4a77-9a04-8241bc121fa8", "comment": "Malware payload (RedLineStealer)", "value": "51692a49a8132eff41e3ce95d8cda406e1e865a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571025, "uuid": "dbac011b-519b-4380-84e9-4aac7227868e", "comment": "Malware payload (RedLineStealer)", "value": "c94e1e2791107eedc24d97f9faecd7e81460a1dc3f650935b0a21ea31c6869c962b08d4a7d8e30ed3bbbacd844b9d5d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571025, "uuid": "92f44bd3-c42d-4343-9503-e5509c458cc3", "value": "T136C41252A3F89573DDB5137158F642C30F36BDA19C78535A33829AAB0DB369064B132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571025, "uuid": "31aef860-1986-40e0-97e5-747579add2b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571025, "uuid": "ba7e50d4-b0d2-4827-ba72-995c4aff1c60", "value": "12288:qMr8y902TAZr36eUXqU2BFS6IJP24M5lqX71R3Z+v:SyVAZJk2K5JPLXpVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571025, "uuid": "0b3f970c-f1ef-48f5-9769-73add87dfdaa", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571025, "uuid": "7629ddd0-99e5-4ae1-8055-e31f238084cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571025, "uuid": "932d4ce8-63ba-4853-b167-1d11052db130", "value": "9bdcc27cd289181f160367a059cbf7f3.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55def49-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691602776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602776, "uuid": "352e4e2e-1354-41f1-a2f6-ad73d44a80a1", "comment": "Malware payload (GuLoader)", "value": "1791e3ec35ba41edbda33b4e4b66adb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602776, "uuid": "473b3261-399f-462c-9ee2-8c3e38ecff89", "comment": "Malware payload (GuLoader)", "value": "b02e22e81e9aab607955e05eb5f0e9ba40ef3b9718a0f4c1edbc5281063db4d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602776, "uuid": "1dc5a1e8-14f3-495a-8b00-6e64243fec37", "comment": "Malware payload (GuLoader)", "value": "e68b21b92d5a51142ef72d027f49a13450e3f681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602776, "uuid": "e177869d-7e0f-4ca9-83a4-84ff3edac226", "comment": "Malware payload (GuLoader)", "value": "c525f86ba1032f42565814075b4e60c112a7a8874e8220a0acd8d42876a2dd6ac2d2bca34fdf285c515f0bcdf8c62895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602776, "uuid": "01e598e4-11a8-423b-bdfb-24bf3d43ec39", "value": "T1D394BF53F766C5E7DF3C63F3B49396EF2DE865660E85409E77A2A7D91000E224B0D828", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602776, "uuid": "15133283-2a1a-492f-9fe1-2ab21368311a", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602776, "uuid": "8fdde12c-686d-4be4-8b6f-99e4181d5932", "value": "6144:/PX0UPlrkcqMGIJjB9rVLdhKtdukaHFnoRrRAQEgWpt0RPMHuzE4:xlRGIBjhKtkkaHad6QEPt056u44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602776, "uuid": "70ea5e4a-0b15-43ae-9017-60a3b53b81a7", "value": 413712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602776, "uuid": "2d118329-34ef-4dd5-817c-77d8ce0a862d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602776, "uuid": "2c7a5524-7761-4399-872a-1cad083dbafa", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6a7a4f-3692-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571332, "uuid": "11a0de38-7582-4c75-baa3-3cae38fd4a38", "comment": "Malware payload (RedLineStealer)", "value": "b7b5510b6d6ea2eb8130cc6acaa77db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571332, "uuid": "4086905a-2d38-47c6-911f-856fdc7a5b06", "comment": "Malware payload (RedLineStealer)", "value": "b0d9760ccd42e1a51ebe2abe59ca6d6cbc692e56d7ed6f2bd8329ab70015c182", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571332, "uuid": "bf31fff5-ad51-4dd7-a6be-546a4a2ba39c", "comment": "Malware payload (RedLineStealer)", "value": "26f80efe1845c0b2fa791be97a1d2e64d19d29cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571332, "uuid": "62ab9908-99e7-45db-985b-285c19542435", "comment": "Malware payload (RedLineStealer)", "value": "0568b631529ee16c2beacd1f33914ea8a3d7fd00e192c08246ba602532852d82bc3eb823c848053b9443531fb8131196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571332, "uuid": "b84139b2-7361-4d6e-87bd-aa608518d372", "value": "T162C41243EBD89032D9B61BB014F612D31B36BDA25D78422F2385999E1CB36D4A87172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571332, "uuid": "7e669634-8546-4323-85cb-dbcb844f5cdb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571332, "uuid": "1622c2fc-76d5-46e7-b401-3ea94b8a162b", "value": "12288:9MrYy90pJFgZUUqkDO/xdP05g2uOgBYC2xmnYOUge7C0Nw:NykXqkxdP04Nz8mn5UgeW0Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571332, "uuid": "6ae9a9d9-0291-4d54-95f2-d794dccdeebb", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571332, "uuid": "fb5ee531-2188-4d03-8706-cc387957711a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571332, "uuid": "84815d11-27cb-4ac3-98ab-74ccbf05a503", "value": "b7b5510b6d6ea2eb8130cc6acaa77db9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3906b560-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602997, "uuid": "8140efac-787a-4944-86c8-51dfc9d54621", "comment": "Malware payload (AgentTesla)", "value": "b75c6b4d276f66dec4b604cf861b7009", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602997, "uuid": "a755ea05-3aae-40a4-a6d5-ccf53ee4a223", "comment": "Malware payload (AgentTesla)", "value": "b14b4179a3ba7ec52b1c8b1eacc7ebb341b62424a3fff50c3c491da3c2b631cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602997, "uuid": "7e7ac04e-3660-4db8-a6e4-56eb62c01a60", "comment": "Malware payload (AgentTesla)", "value": "55ef06ff93383f9e6d3d6201de129aeb0783383a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602997, "uuid": "0ec7710e-61f6-4f85-8b41-c2395e8fbbd7", "comment": "Malware payload (AgentTesla)", "value": "30382851e61b01f9930cd3e2fbec52a0c8edabc6bfb241a97cc146b103a8e2e520a88335e5c7bceb16a00030b9c8c6de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602997, "uuid": "94d8541f-4940-4345-94cc-453409e24cb2", "value": "T13105273C156D6A8DF7A485FCB6708CFF17A4692F80BBF9F3884CA4D306A97D04502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602997, "uuid": "b3817d9d-d4e2-4d15-b878-9c62ffb24a13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602997, "uuid": "14ae8474-9e85-43dc-bfaf-fe1d4d788dd1", "value": "12288:+EzK/pEOSLYTtMSub+TRw6CT7fwDfCieSRzMyDpo0trgoqm:+eK/pEO6YTtMSub+nCT7YDGewye+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602997, "uuid": "dc66050b-1e59-4e9c-8ffa-a43c2b0e6e54", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602997, "uuid": "21ea2b38-2239-4eb4-aec6-aba484379693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602997, "uuid": "ae186645-256e-4b91-90f4-e7999a2eb21b", "value": "Selected Sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05620e47-36a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1691577570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577570, "uuid": "081ed62c-6959-4cbd-a659-fc3f0477b99b", "comment": "Malware payload (DarkCloud)", "value": "e9d3c057b0cfc59c9b353cee86329ac2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577570, "uuid": "b2ebd7dc-3c85-4288-bc4f-74aa36892aee", "comment": "Malware payload (DarkCloud)", "value": "b1939d6e95225c8c014d21e3d3ec6867cefc6fd9f72c3568be32193eca8982e1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577570, "uuid": "8e7baaa3-db1a-4c45-bd20-690e8b3671a7", "comment": "Malware payload (DarkCloud)", "value": "d167153d537defcd25e039752edef1a8d07a8ab7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577570, "uuid": "eca405bc-cacc-49dd-b66c-b1a4fcc5e5ec", "comment": "Malware payload (DarkCloud)", "value": "22fda907b1839853a6464b20856be313d63d6d629f03d1fad428eced15469abb4cfef0f8bfe06bede93e7dbf8f97ee59", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577570, "uuid": "791a69e9-421a-4de9-8f68-dd8d37a7fb05", "value": "T1E1A42926EA51602EF153D8B1E9E4625B68196E7A169CEC2BF7855F0831312D3F8F031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577570, "uuid": "df27e048-001f-4f04-8c4a-d7e2131016ba", "value": "46dde7a8d2b198890050830beaf551ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577570, "uuid": "43a8c229-9ad1-469f-b10d-814f09c9ea99", "value": "12288:5hrJddndm3AsXQJDKEKBBhtQHlfy9yECnjYKkJj6GmZU:NnwLNBBhtQH9/Yb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577570, "uuid": "6a16a92c-e024-40e2-955a-fa3260282142", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577570, "uuid": "7ca71a81-2bc5-456f-848d-13ec7d9935d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577570, "uuid": "7b1bbe35-ba84-4e0e-a05d-e71d5bff4587", "value": "b1939d6e95225c8c014d21e3d3ec6867cefc6fd9f72c3568be32193eca8982e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d729e5-367d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691562330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691562330, "uuid": "97982b0c-4a8e-4e4d-b119-83e4c1f36b93", "comment": "Malware payload (RedLineStealer)", "value": "0c1c8270958889e2ad2ce4e70551084a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691562330, "uuid": "5286d617-562e-40bd-ae3f-ad7fed37bfdb", "comment": "Malware payload (RedLineStealer)", "value": "b1e89b9a27ef164d53a6ced0afe504249e391be4e1f207949ebdc53502725499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691562330, "uuid": "9a787c65-0605-4314-8f37-e485aeb393d6", "comment": "Malware payload (RedLineStealer)", "value": "66068bac319a443f533ed0ef4bd9c0d19041a278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691562330, "uuid": "01d55df5-aaff-48a5-a7e9-4e34409adef5", "comment": "Malware payload (RedLineStealer)", "value": "31eeb8c29b0eff362b9bb69ab4147da501ffca20fae2a7eb5e136d18bd8256413457b18cd57c1c255f0defbecb8c9f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691562330, "uuid": "293ce551-b7b0-46b0-8ca6-fb1724268661", "value": "T17413F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691562330, "uuid": "e8002b4a-6807-4efb-989c-2cf3b754fbae", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691562330, "uuid": "7011c795-d2c9-43d1-b059-21c307a82bdd", "value": 41814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691562330, "uuid": "d4e6ee3e-0ba0-409c-b907-ca8f040843a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691562330, "uuid": "81d2bf5d-83e6-4102-8969-289c8d18f632", "value": "0c1c8270958889e2ad2ce4e70551084a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d867d32d-36d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691600687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600687, "uuid": "5d5c46b4-dcd0-4bf1-833d-b1664638e1a2", "comment": "Malware payload (AgentTesla)", "value": "fc0b349cceb4042ecb9759e9a519ca95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600687, "uuid": "3436e378-91d8-42b1-a8ab-5f1a8ba75884", "comment": "Malware payload (AgentTesla)", "value": "b20ff3d16c6b4dd805900ca612d4ad54ad1d9cfe8163805353538764ba38c9ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600687, "uuid": "dd79e7e1-61a2-4258-8583-ea12ff53e40d", "comment": "Malware payload (AgentTesla)", "value": "82eb8799afa49b447d51509f3d5bf6bca2c7b8a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600687, "uuid": "45c21c76-8c8c-4938-9aa2-f3e8c7c59a51", "comment": "Malware payload (AgentTesla)", "value": "79852bde371053c7723f8edc07bb068e115d2e98f3606ea2d8008235744e43b2edb0fbea503902435c458c6b67fe08a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600687, "uuid": "e176f616-5470-40dc-bb7c-9b1664827ae6", "value": "T1F815182E16295A4CF3A49DBEB5F04CFF13A0692F80A7F5B384DCACF706A97D15502225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600687, "uuid": "da8389f0-a186-418c-bc2c-25843abdefe0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600687, "uuid": "0c612ce0-25cc-490d-bbf5-b59f65f5fed8", "value": "12288:2E5dapEOSLYTZm1N9QlAdw3C7DIxC3d9agmk3PybKtVyZQ:2QdapEO6YTZqQO+SRt+ImKUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691600687, "uuid": "407522ef-9995-423d-b756-e2b9a535ad60", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691600687, "uuid": "ea852b01-00c7-4099-a9c4-4182371d30c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600687, "uuid": "f2c12bff-8889-48fc-8e3e-b7eb8d5911ba", "value": "fc0b349cceb4042ecb9759e9a519ca95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bd7c57-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691602780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602780, "uuid": "14d81695-4dd2-40e7-a358-70480ce263e9", "comment": "Malware payload (Formbook)", "value": "5f41a9b656d58e1490e0689dfcbac025", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602780, "uuid": "0110751e-b909-4616-abc9-e5ccd8b792fe", "comment": "Malware payload (Formbook)", "value": "b289fe67b0185e1ba0177f583675ce399772bf03fd813d47835c45427f71fbf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602780, "uuid": "02224448-6c03-4f75-afa7-bd501dba38bf", "comment": "Malware payload (Formbook)", "value": "4f604324498d3b23c410f50cb20f4c7d0077115d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602780, "uuid": "80784241-a4ca-4c97-9586-383f6b077117", "comment": "Malware payload (Formbook)", "value": "636682762f268eb2f2450bb548c51febe932b603ea540ba59ae9f385e926943dfc0499e666b561b04f56ee7165cc0d84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602780, "uuid": "9a4da0bc-32d1-4978-9584-213cb079d8ef", "value": "T1ED05F11E2004C9A5C3E815B6E90360F40FF47D6ADC82E24BE9EA3E6F74F11A68D45F95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602780, "uuid": "249c5a64-ee39-4da9-a8f6-76ef1d3c14db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602780, "uuid": "c91ed5e1-f491-4fc7-acae-f2183083d17a", "value": "24576:Kik1oB0qnJjJuNXMJSCLAN548K7r26mgTlZ3:KikaBj7JYN548e26mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602780, "uuid": "54306870-f208-4539-9a29-85254cfe1db4", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602780, "uuid": "d195fecf-a696-4a44-8ec1-f002d0d8cfde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602780, "uuid": "a41d17e8-a823-42fd-95f5-3d62d032489c", "value": "Ordem de compra confirmada OC 215 Nortaluga Lda 08082023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a5fd6f-3705-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691620550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620550, "uuid": "af79ba75-d8f3-43b1-8eb9-b352bb167be0", "comment": "Malware payload (Mirai)", "value": "ee4b7c2c6a745c2aff77951949090e71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620550, "uuid": "350a8fd8-1e1d-40dd-99c9-9f79b84824ea", "comment": "Malware payload (Mirai)", "value": "b2d11c2ec16fa8fd44463d09832b0b81bbb9d627698200e31341bfb3dce2bd21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620550, "uuid": "d2f227be-909d-4146-aa07-f29535c378dd", "comment": "Malware payload (Mirai)", "value": "9b03a97f561b56d8a3b1de6aa7c37fe676ccad9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620550, "uuid": "6d4faca3-2947-4d59-a0f6-d061c609a30a", "comment": "Malware payload (Mirai)", "value": "e549473bf3544714368fd39ec789c081f63890c744b6dc1a912f8a1d940bd03c985d3f6bd0b79c2f1c1a88ec01438695", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620550, "uuid": "0c5074fb-745f-4ceb-a22e-81ed973d6c32", "value": "T157338D36C47F6DA8C5448638B8214A342F63F504C6A7AEFA9B8187655047FFCF6183E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620550, "uuid": "fe6de981-a160-4476-a189-8a7bef6c715f", "value": "1536:0aIB1nkW5wt1l4ZhTZJNexd+3+4keEtCQId42+:0XXnkW5QEreO+4ke0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691620550, "uuid": "02d150c9-a950-4e3d-aa77-1a7754aa979e", "value": 55116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691620550, "uuid": "d099b8c8-edea-4b84-b9fa-8b06ae356f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620550, "uuid": "55c7228b-fcde-4529-8e00-bc5c25c9e4a4", "value": "ee4b7c2c6a745c2aff77951949090e71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e13005c-36df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkTortilla)", "timestamp": 1691604321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604321, "uuid": "f0947778-0812-40e4-b480-5d260811ac5b", "comment": "Malware payload (DarkTortilla)", "value": "b480ff7ec7c3045bf197980a84e65114", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604321, "uuid": "a37dbd20-3022-4cf4-ae70-94fa83126ed2", "comment": "Malware payload (DarkTortilla)", "value": "b3232cf26bd9de37e2886331f76a75c0cce821858b71afe574c11ec942def210", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604321, "uuid": "3563cb9f-63e6-4644-b353-5295dafaa444", "comment": "Malware payload (DarkTortilla)", "value": "43e30e354752ae989d6e3f69788abc6ef4048387", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604321, "uuid": "d33ba6f6-5005-41fa-b173-9af98d4ce907", "comment": "Malware payload (DarkTortilla)", "value": "cd324609fd57cecd4703646057ad0e01e023dd942268f24dedb31695c302f052dbed22e245ca734ca2e65bda5663faee", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604321, "uuid": "6ac2736a-a0a8-4c7b-880c-abbbe4d34755", "value": "T1EC65E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604321, "uuid": "d4614728-0e03-4e5f-a33b-59eee6dbfe43", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604321, "uuid": "a2151619-92a8-4312-9b31-b31b48fdf626", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604321, "uuid": "0e62a0f9-2077-455f-a0bd-3171441aeb50", "value": 1443901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604321, "uuid": "eb6796af-1939-4023-a551-6135e23a1bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604321, "uuid": "c3c669d1-549d-4440-809c-ccbe0a307df8", "value": "b480ff7ec7c3045bf197980a84e65114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2e4287-3694-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572243, "uuid": "8b634e16-1120-4d55-a322-acd22b0d78a9", "comment": "Malware payload (RedLineStealer)", "value": "5a810381147c2eabde24644b0f66ba50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572243, "uuid": "e72c979e-d317-4783-bc82-86fa298d1479", "comment": "Malware payload (RedLineStealer)", "value": "b47573fc8623bd18f689b5fb9e28c232f04cd958a76a2c708fab418aa56211fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572243, "uuid": "945d6e2f-6f82-44e6-b03d-ddba7a17af58", "comment": "Malware payload (RedLineStealer)", "value": "8e26427962cd9453419d0b129359970757f11986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572243, "uuid": "81a09b81-4259-4640-a4bd-ad4407519907", "comment": "Malware payload (RedLineStealer)", "value": "b01ede0a328be4a889a9b191cf0a6baf8c8621b15237098c6c85d58c028ccaecd3660ad39ba22f1053f2a8b4a9ae0914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572243, "uuid": "1900bf74-102b-4346-98d7-7a53cd2c6f67", "value": "T158C41257FAD58467CAB05BB028F713A30E31BDA14D30569B2B81695F0CB36C4B47276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572243, "uuid": "3625c2a7-685b-4f6a-b610-e3be964cb2a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572243, "uuid": "d45c5ba7-ebaf-4091-8876-d41f8583cb0a", "value": "12288:FMrMy90dfHt7FRuoXNv4OX1vlecAHKjeLi695dOx:1yyPYoXNv4OXpEKaLt95dOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572243, "uuid": "a28e31d2-5720-4b6f-81ad-cdd3676f00d7", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572243, "uuid": "a7bc4c63-cdc5-4707-8b3d-667c3a64583e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572243, "uuid": "38cdb5a9-c8de-4e3e-a036-169d1f97f390", "value": "5a810381147c2eabde24644b0f66ba50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee347c0-370a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691622978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691622978, "uuid": "c6b1d7d4-f730-4315-939e-e83ed36b512c", "comment": "Malware payload (Amadey)", "value": "1b86b51be41196fb77c33db6674c18af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691622978, "uuid": "7a9ec685-dacd-4934-8e48-903de4a4e8f8", "comment": "Malware payload (Amadey)", "value": "b4a12da5514fc66f104b5ecd3da0e9b6d4a37cead828d072c5ecdbb11cde0b30", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691622978, "uuid": "92c10ae9-9d73-4b53-bec7-7064dbd0bdbd", "comment": "Malware payload (Amadey)", "value": "aa6448e12067fce5be9fc09cb388c13a55841241", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691622978, "uuid": "5356969d-2437-4d48-be94-2c776f893ce7", "comment": "Malware payload (Amadey)", "value": "e444cf18fe0d6765ce83491fcc8dee32a1eeee1c39d3b7ba17a0a1d1728e14cb281aada3b559aa35fbf59271672e5da1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691622978, "uuid": "60dfa88b-67e9-4b4c-a716-d96a77faa548", "value": "T19BC4121267E84536EAF51BB05DF503D30B3AFD618D34426B3342599E0CB36D4E872B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691622978, "uuid": "9c8cce49-2cbd-4282-89d1-4aa7e322e1b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691622978, "uuid": "6f8543bd-e938-4f98-ad1d-291622fb194e", "value": "12288:bMrAy906YpBlIPsguLcSK9d/jLEYUvpbMLo9d:XyamduLOPjQ+6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691622978, "uuid": "c0a18b50-3234-4124-97e5-8e9ce74000f1", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691622978, "uuid": "1572f61a-a116-4e20-b198-1696fd1db1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691622978, "uuid": "477bace0-cc25-4293-bf18-c258a0a841cf", "value": "1b86b51be41196fb77c33db6674c18af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d331892-36e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691607003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607003, "uuid": "a8b904d5-a3a0-4dd6-9dc4-315983e1276d", "comment": "Malware payload (Mirai)", "value": "5c4dcdc4ff44d86c286cf854bf5d7dea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607003, "uuid": "d6412fe4-2e11-4cc4-9996-820f67566c64", "comment": "Malware payload (Mirai)", "value": "b556bc3be8a182129d7abfb4e11181a94d491189436e7dac4326f9b6b49005a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607003, "uuid": "36580563-5a04-4813-bd20-3fccbf5cd104", "comment": "Malware payload (Mirai)", "value": "448e7305f63235c21f8ec04e341b0f38283ee501", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607003, "uuid": "c9bb4c36-83b9-46f1-956a-bd55b19b667d", "comment": "Malware payload (Mirai)", "value": "8b9007a979e61fd5251e68b49f2c46b199ea958ffde2e6f8b6bfce9cd7e223461e61661b87bef1759d647436e457aa62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607003, "uuid": "25870ec3-e830-45da-a6a3-e1dbd85d6c2d", "value": "T1CE436CC59553E9FCDC1015393077FF7296B6E93E1028EBC7D7A8AD32A942A02D80729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607003, "uuid": "fc6312fa-de65-4e53-ab8f-4ec97b3c515b", "value": "1536:CojhW4b3uyzDvrCP8ywXydkWTF+Lt+Rc:bVWO3uyzPMAXyuWp+LQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607003, "uuid": "aa8ced40-2ec0-4343-a37b-63364f32941b", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607003, "uuid": "d98447f3-73e1-4552-be51-7f6738b6ae70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607003, "uuid": "b89b1d40-fd37-44ea-b2ad-5464b525326b", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c78ff5-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691602782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602782, "uuid": "a8eb2a5f-1b19-4f28-97ed-eed46e604c40", "comment": "Malware payload (Formbook)", "value": "d796077b61c368cf76f5f49d17160cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602782, "uuid": "89cba206-4556-40f5-9aa6-532c3a11a67b", "comment": "Malware payload (Formbook)", "value": "b6209f2e0f32d7b0b3bc43b87bd3b44349ea80587db13d6d02ca6398d4459f6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602782, "uuid": "f3ef0315-438b-4fad-be6e-8a6260e8bfb7", "comment": "Malware payload (Formbook)", "value": "675e228c481e8596dc6534e357f034f407c3e5b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602782, "uuid": "7cf737a9-8785-4c74-95b0-f0ecac0d565d", "comment": "Malware payload (Formbook)", "value": "221a33f4bff1bc28aefa92d183c67aa035393cae32ca60b9285651e5ca5fc12c233eae00a1545368c31366c529db6472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602782, "uuid": "ca0d15c0-255b-4dd0-8aa0-6037388521bc", "value": "T13205F16D2554C9A5C2DC08B2E80360F91FF43D75EC41D24BADEA3D6FB0B026A6D05FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602782, "uuid": "3bf656bf-6089-4d9c-94c2-0887ec844581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602782, "uuid": "7c9aa25e-f13c-4192-9a69-e8b29c90af6b", "value": "24576:Qik1oB0eqxzY6+4OnxzYa5G24VQ9y2P3:QikaBoM6+4OnlrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602782, "uuid": "48a9fd51-1a85-46b1-b34e-3946cf595edb", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602782, "uuid": "248a1c30-8af7-463a-b351-7432ff81e6de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602782, "uuid": "dadf7772-8c44-4a2d-a870-2c27a58028bc", "value": "Ordem de compra confirmada OC 215 Nortaluga Lda_08082023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15f05ab-36ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691583442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583442, "uuid": "1e2800fd-7ae7-4af3-9161-b20292c711cb", "comment": "Malware payload (Mirai)", "value": "ee03d7c5401bad8da62fda377cd4d6db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583442, "uuid": "2e27444a-2932-445d-9ec7-474a819770c8", "comment": "Malware payload (Mirai)", "value": "b67c1fe66b326431db313504373e66041b6c908ab6a79de222caa16450515a4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583442, "uuid": "819c1971-722f-4f43-9dff-bfedadb061db", "comment": "Malware payload (Mirai)", "value": "def7a7b977fd6265cf5033c8c1bd2563eda5c0a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583442, "uuid": "a6a74337-1feb-4b84-a377-cad87b999441", "comment": "Malware payload (Mirai)", "value": "af24c5e49288b104208fdde66ae2ed4797c226a31c1c0745b2200b179cad72ac18b0c64322bb2e642e9b9291b6170a58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583442, "uuid": "e41acdc8-76c0-437b-9da5-847b9f0b0901", "value": "T154539FB7C4A89D98CE255578F2149C399723E008A5A33EF6DA46C656D05BAECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583442, "uuid": "3cfe35cc-8016-4297-9d78-0615709e855f", "value": "1536:o/xNWaOJ+asRjkjvcUT2sOeFW3r9fs3qwgSDWXmbZzCYKci:oJNUQXkjvcUUeFW35f+famNzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583442, "uuid": "04e6b628-c29b-46bc-b464-29f44d309b13", "value": 64340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583442, "uuid": "5b798e44-a659-430f-8265-a3fec4e7a171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583442, "uuid": "5a2044da-4e35-46f7-bbc7-20a5580e7cc3", "value": "ee03d7c5401bad8da62fda377cd4d6db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71383a6-36c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691592068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592068, "uuid": "80215074-6244-4362-bf67-afdeba264f6a", "comment": "Malware payload (RedLineStealer)", "value": "233793b17c4ef90a60cb4a1d8d6f1950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592068, "uuid": "59c30ecf-0c43-42f3-8c16-186a2d1049d7", "comment": "Malware payload (RedLineStealer)", "value": "b744f3951d792a01d2dbbab5fc6ddc2d06bea7f39bd4204297341506d3e2ff7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592068, "uuid": "cf3394df-42a4-4719-adc9-893e7a59f0c1", "comment": "Malware payload (RedLineStealer)", "value": "2f103cc657ec7ce9f2e09c109f7ba98a56892d38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691592068, "uuid": "91922e78-f204-47ab-a0ea-1b71169c31b5", "comment": "Malware payload (RedLineStealer)", "value": "6396037069dc2d4488367256cd337d684be980a5c1ac27edf8523c485dba86000d68605662122c8d7f8142aa31e1e201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592068, "uuid": "98c57323-045c-4893-a4a4-e6fe5a00d76c", "value": "T195C41257E7E98073D9BA177018F703A31B36BDB04930875B23969D9E0C72A81A47673E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592068, "uuid": "1fc6467f-40a3-457b-a739-c9ca83f5479b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592068, "uuid": "4a804484-a7e5-4308-baf7-6a3df1f4d71a", "value": "12288:9MrMy909IPV2nR6itQAdJtwHW2byJC+it8QqNup:dyro6ncgZbyw+pep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691592068, "uuid": "a306055c-62bb-4b71-838f-9e50215cb5df", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691592068, "uuid": "e8fe8531-9c3c-4b54-9a27-1f91e430257a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691592068, "uuid": "a4aaf3c5-70d2-4613-bf44-9c9e6ffe67d9", "value": "233793b17c4ef90a60cb4a1d8d6f1950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f408ff-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571932, "uuid": "ecd80a66-506e-43b2-b65c-52babf165f30", "comment": "Malware payload (Amadey)", "value": "c1a84215fdda58f8aea3d32cbc2bdd4a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571932, "uuid": "7123c3e6-3661-4f25-9e79-726a65036ec5", "comment": "Malware payload (Amadey)", "value": "b7c966489a2df57b0a1da66b2262c30c049dae94346e5f63808953903f6f330b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571932, "uuid": "4e12c116-e48c-4471-ad04-14f7f863a6e4", "comment": "Malware payload (Amadey)", "value": "3b460c56bd7d5410731d9fcf27b55aaa56866f62", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571932, "uuid": "4bdac131-6747-4cce-a8cc-15af1d54f1be", "comment": "Malware payload (Amadey)", "value": "19a025874c51270d6021c1f28f23ab15993b67cfd54a7d17070a1f5048fa11ccbb8fee8eb07a57446c0eaa0e7968c748", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571932, "uuid": "d669353f-bdd7-43b3-a558-08abe48ceadc", "value": "T161C41217E6D99172C8B807B018F617D30A377CE29D75836B3381AD9A0CB31D4A975B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571932, "uuid": "cdf2551c-138f-42af-a38b-d847836d8eb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571932, "uuid": "8b775236-3032-4ad6-9444-11811516ac1e", "value": "12288:ZMr0y90NQZuTPUTi7hmzbFHQNr3nIq1+D4vQ5gBYCcKpjGCiB1:dyRZu4ilmzbxQNr3Iqm4bzOCiB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571932, "uuid": "e3ee5c59-cf1f-4277-9b52-67e3c0a22592", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571932, "uuid": "3d2ceb6e-c312-4d65-be94-2236f8b72f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571932, "uuid": "60d9ddd3-78ff-4f66-b852-d4f561e32dba", "value": "b7c966489a2df57b0a1da66b2262c30c049dae94346e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e51127-36b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691585760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585760, "uuid": "c891091f-4690-40b1-afaa-5bf0082cd39f", "comment": "Malware payload (RedLineStealer)", "value": "bb7155c16c08244febc9e23dc9ca00d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585760, "uuid": "d52496a4-b5cb-4534-99e0-297dd93f6ce1", "comment": "Malware payload (RedLineStealer)", "value": "b88f415e11c14276459d2211fa89e8e44c7790a39c258fa5f8ba9db8b07b84ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585760, "uuid": "145680a7-0de2-4a0b-9330-5d2dfdd2a73e", "comment": "Malware payload (RedLineStealer)", "value": "baa3c31eb7e97024ed0780ad3397e7d52e0ccc23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585760, "uuid": "1b44a99f-40fa-44b9-8cd7-5f422c65eb86", "comment": "Malware payload (RedLineStealer)", "value": "c77ab8cd8fe047bebcd13c5cd9ac6553ed7bf67a37e22e7bac99f8a216b4e9c9ffb4f304040edfe6e234f49d2597ad29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585760, "uuid": "139dbabb-c668-400e-bbf7-43b7a600bdda", "value": "T1EF44D022BAA2C072C45F05708835DBA06FBFB4765735894F376506BE5E703D19BAA30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585760, "uuid": "715f00fa-d111-405a-a4e4-f4cc466a71f3", "value": "b96738e6b81e97e4ca196fc0e823374c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585760, "uuid": "4b4e0ddb-88ba-45a0-83dc-e61a6996c686", "value": "3072:QUaXEBApfSQnoboNL4nANPE8AKczE6GFMf/5pFbiiU6vBx5JOUw:QXEapfndLuIMDKCxGFc/5rf/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585760, "uuid": "d9d05baf-3c08-4879-9c97-7397e556850b", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585760, "uuid": "334f202e-1255-4e30-ab49-80d2328f47a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585760, "uuid": "926930a2-c587-4fc1-b918-d050fb20e934", "value": "bb7155c16c08244febc9e23dc9ca00d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e3d182-36cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691597624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597624, "uuid": "b09c5aef-472d-4a7f-b5b0-a854b0fa71cf", "comment": "Malware payload", "value": "fafd2fee2145a1c0cff13d372694aa11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597624, "uuid": "bd75a53e-4a4e-4728-af64-7c8b05a921e4", "comment": "Malware payload", "value": "b9602df895cfa8ceb21f3b08dc54ba282fc257d8446bdc3e8a8e5ae6c9e78ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597624, "uuid": "1659bbbe-e82d-4152-a689-c8361b628c23", "comment": "Malware payload", "value": "dd1e28ddfacc273e94fa34846db572e601248db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597624, "uuid": "08289fa0-ddcd-4ddb-8670-b040d07fb43c", "comment": "Malware payload", "value": "186c2987f2cdbc29727c26fa6a145b4baab1780e8e5dd31e1360469a695f3708b8bd0f0d9f6324e93d03bfdfcac0c66d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597624, "uuid": "efba3c43-9d07-444b-a08b-4d641ddbad86", "value": "T1FF045B5837D80A15F3BE5FB8F4B012118B75B477AA1AE75F08E920EE0D62351E911FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597624, "uuid": "16c066fd-210a-4770-baec-cdbe91b15dff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597624, "uuid": "5760c129-ff63-4d05-9148-2a21d6252bef", "value": "3072:Ee8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTJwARE+WpCc:g6ewwIwQJ6vKX0c5MlYZ0b2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691597624, "uuid": "1d1ce336-7081-494b-93e5-22732d7866bb", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691597624, "uuid": "47f53e60-4a8f-40e4-9bf5-a399cea80109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597624, "uuid": "92c72682-053f-4386-8baa-4218ffda68cf", "value": "worldwind.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d088e900-3698-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691574045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574045, "uuid": "7a65795a-2c54-4b6e-a438-6f2d5100fabe", "comment": "Malware payload (RedLineStealer)", "value": "b8ada60b3716c59e64801b53db24875f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574045, "uuid": "9811a0fd-eb4f-444c-b0ea-38ef690dfbd7", "comment": "Malware payload (RedLineStealer)", "value": "b984e8e73262eb6d1cc9ca69ae09edd04b0a4ca654e706c3eef17a8128be7abd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574045, "uuid": "5344769b-ae64-4557-868e-c7878aedc79f", "comment": "Malware payload (RedLineStealer)", "value": "df1c9da68453f4c7140606252401ef7bc795ed77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574045, "uuid": "ef8ee2d3-921e-4ee7-93b8-7c9714ce59bb", "comment": "Malware payload (RedLineStealer)", "value": "ff1849f850933b5b5140e4eb368407f9db7306f4a0f1b2d370f759dba71edc4cfa8fdc574e1fd7bf71552674d45e6a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574045, "uuid": "3018aac9-35e4-4def-85d5-2eb853fa2aef", "value": "T17AC41253ABDD44B3E9F5573058FA03D70A3A7CA59938936B33855C4A0CB2680B972B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574045, "uuid": "d66f8029-9585-4a2f-869e-8bd57c82ba09", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574045, "uuid": "1dd30b6f-5828-4f78-b39b-3f429d8df6ac", "value": "12288:JMr/y90hl0dRR7fYtMbcsi4D3sQ6VTFDK0fWjATD:+yMqPYtsDDcQ6KHmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574045, "uuid": "13bc6270-12ad-43eb-822c-bb58bc209dae", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574045, "uuid": "12038f81-eba9-41a7-a4ab-edffc5b3fce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574045, "uuid": "fc8384c2-de8c-4750-9094-81ebe72d06bd", "value": "b8ada60b3716c59e64801b53db24875f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a49aa0-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (a310Logger)", "timestamp": 1691602807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602807, "uuid": "d89287e9-d734-4f11-a5f2-2a74e69449a4", "comment": "Malware payload (a310Logger)", "value": "bcb9093850861749082e61b189227937", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602807, "uuid": "916c2e45-6ca3-4040-b2c1-3175d08b866e", "comment": "Malware payload (a310Logger)", "value": "ba6268a4198e952cbf7f0cd2af1151207dd0271331069176394539011db32354", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602807, "uuid": "abb7c20b-7b65-49b2-8940-f6ee44e2f490", "comment": "Malware payload (a310Logger)", "value": "0af77c3cd52b18828eb1a77867ce05e05d5bc31b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602807, "uuid": "be99fb49-a232-4666-bc5e-b54b4315ee92", "comment": "Malware payload (a310Logger)", "value": "a762835d6bc63812b6492f64f9f45c47ca83927d7539adac59c6e0e4e9043bfa54aabc9a67b16a540405fb14ffedac0c", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602807, "uuid": "a5aa0743-f671-41e7-8689-f053d4361daa", "value": "T1BA94AEF27583BAE02EF71E4032E57F2C2CD03B63E691960EB8906DD540A6D585FD26D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602807, "uuid": "66daf298-2109-4de1-aaf0-a884b9561cc7", "value": "6144:8Fo+/qDQ5e3ID89uFO1U0PZbXWDtZTuAMmoqME+NYloH:vh8uID8O0xbyZTxZOYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602807, "uuid": "efa08abf-cb90-4743-9b42-0113dc1f330c", "value": 420129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602807, "uuid": "dde79730-75ab-46ee-9070-9beeb7abf6d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602807, "uuid": "5fba06be-ab1c-4d7a-ab5c-dca463c3535f", "value": "hesaphareketi-01.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab2deec-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602838, "uuid": "70c034e8-d15a-4924-98eb-4cfb354fbeed", "comment": "Malware payload", "value": "cbcf38e1ccc4908b79becee26ae2bb85", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602838, "uuid": "4efc5e18-e54e-4f20-bcca-141ca8769d75", "comment": "Malware payload", "value": "ba655171035f778f27bba28326bbf8500e4551a5262efb68fadcbfadc429ba89", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602838, "uuid": "bbe277df-e971-4120-8f49-5ab70cab7738", "comment": "Malware payload", "value": "496e342090f85295b970b3d8c8d26a9bd2e50033", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602838, "uuid": "322fc98c-47d0-4b1f-b3f4-211f93e3db3b", "comment": "Malware payload", "value": "f9832c4eb249cc3438630b3c00bf98e731e03f6a81ba06adde090780c94b1eebd983496fbb2b8a4db54cd5c359bc6c8c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602838, "uuid": "6a730343-d77e-41cf-8c3e-3824c0fc31d6", "value": "T1B9F423DB5422401DDBDB3DF2A77891671772040D622C1B1A9E67B89A42BCF88087F77E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602838, "uuid": "161dd08d-0837-4355-8a8a-e72a2a781f2e", "value": "12288:nscXVtBUKdqOvpUZu92aoKQu8BbdpWtHmtJZETaNj0GZYTF+C5i5t9SFGUFkUkTN:n75UKauMdKQVBbofaN0xTFvi5vs1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602838, "uuid": "9bdbc739-90b5-4d49-80e0-4703a3c06225", "value": 738025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602838, "uuid": "2ad91618-f7c9-48aa-8d87-1e5d63353fc7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602838, "uuid": "476a689c-71e2-482a-8e3e-4a86b5ea5fea", "value": "NEW ORDER - CF0002.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397cf63e-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602998, "uuid": "2822c0b6-4a9f-409d-b042-83d8e1c9647c", "comment": "Malware payload (AgentTesla)", "value": "6b553b88b3f95b4f70d087d2341d2707", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602998, "uuid": "cf95ccc9-2de1-40f4-ab24-65a03c996300", "comment": "Malware payload (AgentTesla)", "value": "bae9a997d8e0c566b8f0a8dbe770baa1ec2360df8fbf8239305fed7dae1f28e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602998, "uuid": "9b28c6fd-6148-4b2d-9de2-3cbdbe4281f2", "comment": "Malware payload (AgentTesla)", "value": "049cc0a2b0233b159e0ec5ae14c76ead65d2217d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602998, "uuid": "7698c171-cc70-4dc7-afd6-a9d18595915c", "comment": "Malware payload (AgentTesla)", "value": "5b06c9c73e898f47ef11d6cad92ca21eb2f1c3745546e84f9d3135efe3c1521ee5a7c4b791c01bf992758ef08a9ff045", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602998, "uuid": "130599f9-dd81-4602-a69e-8f63fc6896d6", "value": "T19334ED177E44EB11D65C3937C3EF6CA813F2A0C70673960BAF48AEA529512436D6E36C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602998, "uuid": "9b18cf3b-e288-4a7c-b0ee-1f5283ca0701", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602998, "uuid": "d249784d-bc11-4836-bd7e-88616615f829", "value": "3072:eJFUrlziaqxrbkSDigZPdZNT88nEetXjNWH8:M0ziPxXkAigZP7NY8EetXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602998, "uuid": "9ab6038a-38d4-4407-bc58-7e5a6cec3540", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602998, "uuid": "c15585f5-9d37-457f-8620-9d5d5434643a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602998, "uuid": "b1d45b13-1a7a-4c49-af5a-9bd87a440ee6", "value": "1691602996d1f10dbcfd907a0e4a46310170143d377ddd575ec603d8e7b7b4535437b478ee158.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eb2055-36bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691589065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589065, "uuid": "4496e16d-35e4-4470-9c92-603e88ec11b5", "comment": "Malware payload (RedLineStealer)", "value": "794b663fd6cfdbe3dfaee5a81ecd8493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589065, "uuid": "617a823d-98a9-4fb8-a161-972370e35e0e", "comment": "Malware payload (RedLineStealer)", "value": "bb4971baad52a1ea299b91338b5370282c632460831556c347ef9bf22ae62573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589065, "uuid": "5cf1f7d7-9e27-447a-af54-e9c862d4e3c5", "comment": "Malware payload (RedLineStealer)", "value": "b1811d7f18b9bda14c58677124cbe7bb7ff42823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691589065, "uuid": "0b3c070f-28de-4cf1-a9e2-c8ca6a38460a", "comment": "Malware payload (RedLineStealer)", "value": "16064914c232169f09393386700d6217a7f681aebb9074d6c3d398cebeeccb97fc9036644d1a37140475ae7faf16bf29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589065, "uuid": "470b30b2-1f34-407d-ad5d-6d466cbcef13", "value": "T1C3C41202EAE989A6D8F417B558F603D30E37BC918D7543AB3346AD0A1CB3550E93277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589065, "uuid": "23a5c1c0-188a-4dab-ac07-2647c897b082", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589065, "uuid": "ee523f73-4e2d-4c4f-8f9e-87df496d6180", "value": "12288:CMrvy90LrU5oCccInGgIBbQ6KEspwzUOVBjF0KEIV6Yg1:JysCoCngIZ/sgUIlEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691589065, "uuid": "d2fb8409-aa49-426c-8fd1-18802fbef7d5", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691589065, "uuid": "6eda26e4-a177-4a6b-b4da-901973bcfa29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691589065, "uuid": "ab5d96d8-dd55-4df7-a92c-ab8900fefbd5", "value": "794b663fd6cfdbe3dfaee5a81ecd8493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8d68db-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623590, "uuid": "481c1b10-41b5-44a4-9d84-c4d87da589d1", "comment": "Malware payload (RedLineStealer)", "value": "a0b6eea1fff419c193a6324ffc025824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623590, "uuid": "7cc0f374-e8bc-411d-a713-4212c9062e1e", "comment": "Malware payload (RedLineStealer)", "value": "bb83617eef0d6b9ecdb603ab35b1b5ede42000bc7531ea8a5b32384f7e94d7ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623590, "uuid": "17d57b30-ddc6-47fe-bdf7-50e74412a6f3", "comment": "Malware payload (RedLineStealer)", "value": "90199e926f45311738bdf7eeb2b79147455534eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623590, "uuid": "2e8ff764-ea16-4440-94f3-818b9f07cde9", "comment": "Malware payload (RedLineStealer)", "value": "6d486de23acf5d1383c4935ac7c4c81f5be0f8ac8011fa273dc6eda9b4a9cf64e567573fe1a4fcafcc588505c6542f05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623590, "uuid": "caaf717e-e7b0-4568-9e35-5457791dd48e", "value": "T182C41212A7E95127DDB617B168FA13D30E353D72CD74936A2785980A0CB36D0E93273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623590, "uuid": "4c954c5a-7b18-44b6-86bf-691c2b82bfb3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623590, "uuid": "ad6e214d-8959-4a90-b864-f78160fc9ad9", "value": "12288:yMr+y90Xw4/C+/jxMtbCw1UjhTnUFrf6BP/:gyswkNjx5RU+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623590, "uuid": "14168c39-c664-46ca-8cb6-3c6e4db00e0f", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623590, "uuid": "b54af71f-c0f2-483e-a4fe-bf18798e7292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623590, "uuid": "25e07669-12a4-4887-952a-d530c7437daf", "value": "a0b6eea1fff419c193a6324ffc025824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cda1185-36e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691607379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607379, "uuid": "4e788f5d-4dd1-4f2b-bed6-18846510ff97", "comment": "Malware payload", "value": "6328b4c8ce2e68608d107be8d9c9338f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607379, "uuid": "c5dfe319-4d0a-403f-99c5-f4f31db7ccbb", "comment": "Malware payload", "value": "bccb2876e8645714b5b26056672d2c5a8576151d709a77422c0ab87e58cb464f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607379, "uuid": "c54cb145-72d5-4787-82a3-7aee587e7094", "comment": "Malware payload", "value": "1dd55c6258cd4548fe3a8bc372af14d1ea5d3eb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607379, "uuid": "9625c4f4-0d2d-4ee7-acd1-4796285d879b", "comment": "Malware payload", "value": "b1337c4944a7bd1a96d3d6bf85e769a0862bf29683b46be11322ab9734d41ce19a5f8048f1a22ab671fd0663dba2da10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607379, "uuid": "5a068e32-3687-4885-8fa7-26b1b8e8aae3", "value": "T185150822E77B6559EF29A2E88E2F447179D6DC80F1B1C58CB7E7280385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607379, "uuid": "eb044d20-93f8-4260-b341-ad6d7b3eda80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607379, "uuid": "1c237b8e-01d3-4ddd-a3e4-8378446e545e", "value": "24576:hHlYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOOOguOsMqJYYRdSb8qBI:hqRs6CE3jLbO9Rs6CE3jLbOeudMOBCbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607379, "uuid": "afc75308-d96c-4bc1-9ae3-286e8649e7bb", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607379, "uuid": "c967e9a2-0051-4c21-a966-8d2eda936f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607379, "uuid": "1731dda9-d902-40d7-b363-741945994e09", "value": "SecuriteInfo.com.Win32.PWSX-gen.19380.11108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf4f935-3694-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572241, "uuid": "379ba481-dafa-4d4b-b53b-07553416f134", "comment": "Malware payload (RedLineStealer)", "value": "986bdea47ec3dcced900afdcd336ae9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572241, "uuid": "925c17d0-5eb9-4e69-90f1-380fb4b122e1", "comment": "Malware payload (RedLineStealer)", "value": "bcf6cae1bda693ce71df94dee69483c65092020ac5faea5d59c9918ba3e2034f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572241, "uuid": "c72e0508-b565-4eb0-9968-1d0ef0a1d737", "comment": "Malware payload (RedLineStealer)", "value": "a11b958f06db6724651572b1bbfbbb7e36fd3827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572241, "uuid": "6fc2effc-1982-46f0-a88b-f127599722d2", "comment": "Malware payload (RedLineStealer)", "value": "cf53ecd3fd2788deae8b1fe56e70d1cdfb651002af1686653f03f64b973b0abbc8da00a87b8d61479e9efd49501690ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572241, "uuid": "671b806f-390e-4c02-86a0-bf1534c11d18", "value": "T1CEC40213BBDD80B3C9F11BB018FA06D31A35BDA1AD34439B6291A94D5CB36C4A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572241, "uuid": "d9281df0-57ee-467b-9d48-1ab146a5ea1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572241, "uuid": "5932f7e0-91de-4715-9047-6e04a3b4ca1a", "value": "12288:/MrUy90/v/I+/SzVrFM3zIRyidhgTFyKfUinnIruK:/yyvF/SrFM3zIkkWFysU8quK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572241, "uuid": "a75da877-1d91-4905-b549-afdd5a07faf1", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572241, "uuid": "21d762a8-bb81-410c-8480-44d0e244fce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572241, "uuid": "0f3643a4-8fa6-4168-b1ac-d7df468821e6", "value": "986bdea47ec3dcced900afdcd336ae9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280dff45-3705-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691620578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620578, "uuid": "cade7826-5653-4e72-a769-ba4c187ffed0", "comment": "Malware payload (Mirai)", "value": "51ef07160e7e929cfdaaa48a3f2c99a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620578, "uuid": "49f34fc5-1fa5-4b6c-8d3f-66f882626070", "comment": "Malware payload (Mirai)", "value": "bd1f22e2e7a429edf997255e56057fee86b9c2111ff774cf5fbaefa273c5a7c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620578, "uuid": "91f9184d-358a-4c68-9466-a694150254c9", "comment": "Malware payload (Mirai)", "value": "7f108b56c5da61d43e43878f28059fdf3f7d72ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691620578, "uuid": "78fbae19-e430-4e85-b304-9ae5eb18f8dc", "comment": "Malware payload (Mirai)", "value": "2f9d0a02ac05cf9e11a7f54158953f055d68b252e188daece2516b78887c1998d5e95b7b7978429573021c953bae9d8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620578, "uuid": "6e41c26f-1f19-48d2-8a25-8d18d45efa9a", "value": "T188434C0333280E07D9961EB0353F0AE093BFF95126F5B68A194F9B758639E761082F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620578, "uuid": "3e99864b-ed4e-443b-89b7-b913a4879528", "value": "1536:q01NDkjhWBPe1ZMaDy0wYrudk/Grod42+P:qEgoBf3YrucGcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691620578, "uuid": "f7293a22-c1aa-4df9-85d8-faeddf1fe127", "value": 59960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691620578, "uuid": "998c9174-efe2-4f5a-98fa-1564b30361fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691620578, "uuid": "58fc4ec4-a38e-49fa-b011-a94179b2d291", "value": "51ef07160e7e929cfdaaa48a3f2c99a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ee7ee8-3652-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691543877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691543877, "uuid": "5dd773f1-9f73-45d3-a583-0ea9cbd70992", "comment": "Malware payload", "value": "ba40dd01c203a5927de230308cb522a2", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691543877, "uuid": "d0f129ee-945f-47b8-a61c-5c8d8f467797", "comment": "Malware payload", "value": "bd20d770865a8c670038032ab08f37e492950edfa87b1998fc92ff3eb8ce7fcb", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691543877, "uuid": "7157511c-94ca-447f-962b-699a064e962e", "comment": "Malware payload", "value": "dd5101a044bec8a52eba7ae8a32eff661218aca1", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691543877, "uuid": "d10084d6-1800-4a9a-9974-9d0b680997b3", "comment": "Malware payload", "value": "41c9d3a74f9e33b671d70dd8ee62c27e5b6944319a3dfc5be86af56e670442e02adc8fe960b62cc40a6c9e03171f903d", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691543877, "uuid": "b720c2cb-6059-491b-8fac-6764eacb7632", "value": "T19B520909A7E84738DDBE6F739C7292018276FE85DD33DF5C599085290DB22488DA2F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691543877, "uuid": "8c1c73fb-222b-478d-a8c9-f2c7cd883aba", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691543877, "uuid": "790125f7-890c-4318-b3e1-f5d4398549d9", "value": "384:CAWznOP0zOLijgKJBe51FbGyfchtdsBA7f2:CAWznOPEykJBg1whkmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691543877, "uuid": "aec816e3-496a-4e28-8e4d-99595b3e6f6c", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691543877, "uuid": "dc5f9727-3f58-4677-a2e7-7283e8a96080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691543877, "uuid": "81096ffc-e4f9-4842-bdba-455a4d3c1d7f", "value": "1691543875af5bccc5ca5794a7e5cf59ed83786b35b64ed14c6393b6e6f7c212a3962b36cd601.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59ecdca-3673-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691558135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558135, "uuid": "13e0161b-0bda-48a7-af5b-f9c513aafdec", "comment": "Malware payload (RedLineStealer)", "value": "d5cd4db707020f3dc092116e28bcbf5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558135, "uuid": "234ebee0-c5cc-41ef-9bff-edb41821ff19", "comment": "Malware payload (RedLineStealer)", "value": "bd476be20e0bfddf6f79cc44588adeadfc7017a74953b83b8ecd83e9ac999bf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558135, "uuid": "8a0e2867-5995-44e3-adab-e834ad81d820", "comment": "Malware payload (RedLineStealer)", "value": "fd82e48930bffac8c1c9ec6256c71f42c7c239dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691558135, "uuid": "61cf12ce-11df-49bc-ae08-29365a4dec21", "comment": "Malware payload (RedLineStealer)", "value": "ee3864456833f76c65996331ed1a126380bdb036fa70b4d257426d5bb52a6375cb17871ae9bbdeea023e2c4b5651b637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558135, "uuid": "179ddb30-bc02-461d-935a-55b8481a7e76", "value": "T162E42252FAD84432E8361BB02CF707831B3ABDF15934879B36851A8E1DB3395A43176E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558135, "uuid": "75c8e2b9-59af-495f-8b30-d2a9a379107e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558135, "uuid": "03cb09f4-c84a-4439-bd1e-344f0b599f4a", "value": "12288:1MrGy90WBCdt0YJ6ehWYW2tolg6vSQFK+ftE2HmzEF9WA:PyjIiYIz9nIwtE2GK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691558135, "uuid": "8319fb57-63b6-468f-a0a9-a2ca0c29fb07", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691558135, "uuid": "8e12fb73-758f-44fe-8176-36c4f01e9c4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691558135, "uuid": "cdd51457-ce65-4028-86f9-cf556a4f3610", "value": "d5cd4db707020f3dc092116e28bcbf5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f5487b-36c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691593573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593573, "uuid": "383957e2-7190-477d-b6e0-1f4c43d54782", "comment": "Malware payload (Amadey)", "value": "233db62ac0afbd4f50638f980b0927eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593573, "uuid": "37a3ab70-3554-4caf-8c51-1d3276038113", "comment": "Malware payload (Amadey)", "value": "be1ba61a6062cf9c85ea0066e28281cfa3b6e45d6d24e0918f2f7ff0ad5e8c2c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593573, "uuid": "f0f38fdc-fb96-48e5-b3c7-dff62ce323b2", "comment": "Malware payload (Amadey)", "value": "38a971a5a68bbd06c5945ea2d666e3d81f5f9c1b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593573, "uuid": "78c7a753-a445-4ad6-83a1-60079d138e9f", "comment": "Malware payload (Amadey)", "value": "5207b8565c798468e72937fa9c11a0266a198b20d7e3584250f2401c22c4400bf654ff94b04e51edc5165fa5044f2f92", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593573, "uuid": "56a8441a-d1a2-4dec-b426-ef26e6db3a50", "value": "T1B1C41283B6D85537D9B923B048F612D30E31BCB45D78831B3785E95D0CF2A94AA31B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593573, "uuid": "6a12ae0c-8835-4426-b8b3-a2c3bc774ca2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593573, "uuid": "ba83d9ec-7dc0-4cdc-b7c2-40b520a389ac", "value": "12288:/Mriy90EvVM5qthVSIZ0d+EpM6rHvdHAgN3WmHQCGtc:xyvpp+MoHpAgN35HFGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691593573, "uuid": "eb0d9d49-1c86-4f78-b3d0-acbf617e8012", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691593573, "uuid": "b04d32bf-22a3-47d0-8620-c664d0b0208e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593573, "uuid": "b82a8e7c-5165-488e-9e7c-0ab649610d38", "value": "233db62ac0afbd4f50638f980b0927eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919c804a-36b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691586395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586395, "uuid": "2edd8e15-0ed6-4009-a850-8e995ce02880", "comment": "Malware payload (AgentTesla)", "value": "cd8d048fe7bddec7b26f26efa428f5ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586395, "uuid": "91be991d-3310-4628-9647-0ddaa37c398e", "comment": "Malware payload (AgentTesla)", "value": "be1de67e009a039d6075c654d7423d82b0ff7a26a851240664fe48c135a0f1b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586395, "uuid": "821ef54b-d409-4d1b-b667-b8e09e30f23d", "comment": "Malware payload (AgentTesla)", "value": "0eec92c4fc5860d0985e9b0e16b6b0111311a4f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586395, "uuid": "fafb8c72-4d55-469f-a8bc-b6f864d18565", "comment": "Malware payload (AgentTesla)", "value": "6070af73ecbcc5c76b6e358d501eccbd55c2bc5beeee578ab95b5ebd34070e494d3603105c953291b25cce5fa8035580", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586395, "uuid": "3beddeaf-01af-4bd5-a64c-9c4e9421be17", "value": "T15C357B3C11286A8CF3A586FCB6744CFF17A46D2F80BBF9F3985CA4D706A97D05502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586395, "uuid": "78c2a709-a7dc-497c-8cde-0c8052fded84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586395, "uuid": "2d3ec70b-119d-45c6-8d51-efd55d4daf45", "value": "24576:glDupEO6YTJHBnJsgk45MkvbiRornr41ZsXVa7LJI:gApEsVJsgJlvbja4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586395, "uuid": "76fd3a52-4649-4bca-9c0c-1cd251bdd3e4", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586395, "uuid": "3b0d2dba-3bfb-453d-af20-7d65ba2c4cf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586395, "uuid": "757b64a9-1d9f-4f95-b931-d0159d1b7e9a", "value": "SOA of AUG 2023_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fb0615-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691583773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583773, "uuid": "938ec7f3-6316-4f9d-bb35-ba23d7493cb4", "comment": "Malware payload (Mirai)", "value": "5c0b4cd743ba50be8f2b98f3baa63ece", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583773, "uuid": "4a4584fa-5579-4653-a40f-8ea2b291dcfc", "comment": "Malware payload (Mirai)", "value": "bf32e6582ebf51e92706f81d1f59aec8ea24b386061c7796f561894598314624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583773, "uuid": "0c3d9c89-510a-4995-ae36-deefc9a9319e", "comment": "Malware payload (Mirai)", "value": "a4ccebed97abf43ef9ca7d3dd6c39e00e625a915", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583773, "uuid": "3abc64f5-7f29-4109-8b0b-56569fbba110", "comment": "Malware payload (Mirai)", "value": "63392c807aeca634812f5d431521cdb3516ca0eaced12fd4db192667c98f3754c362b04521ded430ebd8877cbb07a1a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583773, "uuid": "b8a73b55-5d29-4427-a286-f7b1df252b2f", "value": "T1004319827C81AA29C7D057BBEA9F108E3354ABD9D0DB7347CC140B9176CA51F0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583773, "uuid": "ff985b0d-ba60-4ef7-9f9f-02492cc60acd", "value": "1536:H/Xjk8PDYR1oydX/BPLU8yYQwzYdBb0rZNJE2yYceZW8eXZM:H/T/PDh0VNJE2tcws2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583773, "uuid": "8ed35978-39e6-4dbd-9b3d-9ad8477be758", "value": 60176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583773, "uuid": "20267581-c079-4403-87ee-dc0c053453cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583773, "uuid": "a87e890e-b6eb-4931-abaf-64ed03a8b31d", "value": "5c0b4cd743ba50be8f2b98f3baa63ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755b17c8-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623284, "uuid": "08e3c0bd-6d31-4e9e-8fe9-5b203281558b", "comment": "Malware payload (RedLineStealer)", "value": "872fed998aa878dbf87af9a89f05f3bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623284, "uuid": "e78726ad-2395-4c24-908d-e63d114b2982", "comment": "Malware payload (RedLineStealer)", "value": "bf67f8fd6038a48aca47a6745148a2c9931d8a64ee3f1baaaaad64a117e8598d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623284, "uuid": "8b51e12a-4a6c-4bc9-8995-4c125531055e", "comment": "Malware payload (RedLineStealer)", "value": "4c22e5dd7f59cdb6557c6293896cec2dd70592a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623284, "uuid": "cc92626e-aca9-41c0-ac07-b4b5f3e2b599", "comment": "Malware payload (RedLineStealer)", "value": "dd3f1985744724cf7f40deecbcf68e340727ae3e82403b3803cf36b3e7d88c1f68b3c6ec49cd1a633e8ba88a92dae173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623284, "uuid": "326e5df0-ad73-4b92-9d48-890654976791", "value": "T129E42293AEDC5033E9791B7008FE03871B31BCB19E74838A2741A95A2D736D8E476776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623284, "uuid": "f3458227-b055-4465-8691-58b2b8329a5f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623284, "uuid": "5923405b-3785-46b1-9c02-7615a9fb5847", "value": "12288:+Mrgy90YF+lVAxAZS4wLvLdT29YFsvubNFlXWtIhnweV:iyPF+Q4AvxT2YFMub/lXWShwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623284, "uuid": "40b9930e-c5d5-4bea-b492-a97d6d4638c8", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623284, "uuid": "e5d5cbc8-0cc1-432b-9d53-42a721af7de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623284, "uuid": "c2ad956e-7b29-48cd-b325-f2c9267019be", "value": "872fed998aa878dbf87af9a89f05f3bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0cd60d-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691599782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599782, "uuid": "38fb38fe-36c5-4edd-b5dc-4e3d001296aa", "comment": "Malware payload (Loki)", "value": "24ffb483f02330575c8953048524a4fc", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599782, "uuid": "938df06b-41ff-43bc-8eff-6070cfb88193", "comment": "Malware payload (Loki)", "value": "c09829b85ef7a1f4dd4d77f90f432e17a15f4418554c170d3cb8bd277db46c68", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599782, "uuid": "63a3b24f-ae16-4111-bf25-750d26b0bca7", "comment": "Malware payload (Loki)", "value": "14a92eddeb996d23e4933b2edf2b0e479a8c94e6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599782, "uuid": "debd1941-8903-4448-8385-685fa6682a63", "comment": "Malware payload (Loki)", "value": "639266fe4ba365e8b4c797836363c36be0793bd0471dfc897b61407a46fe597d93438540ee90e53506ef6342b9dd36bb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599782, "uuid": "996a727a-adfd-4027-ad16-f14a69b1da50", "value": "T10035E0079844DBC3D41D87F87E534EE91F0A6F19E9816EEB05263F9B3A70A32489E11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599782, "uuid": "e6e371a9-898f-4758-8217-2b3592d5921a", "value": "24576:lRZyQw6VfZy3w6VYjKaWlEzp7adWtB70rl5:lbQ6VRX6VYjKjOzIKB70rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599782, "uuid": "6b5a9fe5-519c-4f5c-bdca-dd2f8fe219ac", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599782, "uuid": "c4dcacce-a210-4d02-ae54-0ff250c29ba3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599782, "uuid": "906cfe23-e3ab-4bfe-8fee-0aa9478131c2", "value": "PO#0256102562.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08219816-3696-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691572850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572850, "uuid": "527ed89a-7587-4247-88b1-c044549ba560", "comment": "Malware payload (Amadey)", "value": "21e20e1bc684097831f7bfbcdea56bc4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572850, "uuid": "d17f5ba6-9b4d-4fa3-a828-7b4d4abe9642", "comment": "Malware payload (Amadey)", "value": "c13d5778ecbd794b3240a68909e35234eada5e7b7f116b9f21e92ddb5b39fcb4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572850, "uuid": "de488f2c-5069-42c8-9212-aa6ebc0d8464", "comment": "Malware payload (Amadey)", "value": "3e5e83472371c69200ee3b05f9ccd411232b9c82", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572850, "uuid": "633f3ab8-f3f3-4cb9-9775-56444527e37c", "comment": "Malware payload (Amadey)", "value": "f36b23634fcf4cff4972946b6bf962c78733a7ec818fe28ee038ef30303364714e8db587fac948e52966101e6d41e7ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572850, "uuid": "8062b9c1-2f90-448c-ba59-6269ab05c2e3", "value": "T124C41253A7EC8133D9752B700CF603C30A36BD66D97883A73792995A1CB36D0A97436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572850, "uuid": "24c23537-ab00-4946-9835-0937df1a34be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572850, "uuid": "a9ba462b-0705-476a-920e-ae18e81f67f8", "value": "12288:lMr2y90n0Hd9tZ9xL4DRQtVX1YTF31DNTeqpXhW:ryXHdaDqtVXCTUmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572850, "uuid": "365da2ec-59cb-4476-acbf-1f667ada5f23", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572850, "uuid": "eb19a2c7-ce8c-4673-b61f-eaa0afbf37aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572850, "uuid": "175aa2c5-0670-4c9c-8f53-628c31b77175", "value": "c13d5778ecbd794b3240a68909e35234eada5e7b7f116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda97d29-36b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691587865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587865, "uuid": "a3190a37-3d15-4b9d-b210-caa21801fbd1", "comment": "Malware payload (RedLineStealer)", "value": "a51b658a39c1e2da5225ca79898de041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587865, "uuid": "c2a48ea3-8726-4b2e-9b0b-b068cba7b38e", "comment": "Malware payload (RedLineStealer)", "value": "c1970df32932bdbed6128e85c750962867d9a555f434515b348c2b92cadd7a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587865, "uuid": "d1255d02-6f32-4840-b5df-e41973ae1bc2", "comment": "Malware payload (RedLineStealer)", "value": "cf26477362e97f05cf19f24b58fe7b569066ab6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587865, "uuid": "b769555b-7623-48db-b505-e917eb7ed9fb", "comment": "Malware payload (RedLineStealer)", "value": "0473108c78193f2fa576ed428fc0032373ec586ae8d09958a5acd1f4a6768c27ea4deae02c41e4fbae56ffd7cfc2d97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587865, "uuid": "bca1d8c4-fcb3-4931-aa6b-cfc7c274523e", "value": "T1DAC41213B6D940A3DAF127701CF643830B31BCB2AD74422F2B55995A1DB2AD5A831B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587865, "uuid": "c8da8d46-7c6a-4e6b-a874-1b8b64c44372", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587865, "uuid": "bc7d5558-e99e-4abe-a54d-aac8be6b3b3c", "value": "12288:1Mr/y90ZHIE5E+gwl5OZSuy0BxiWAL5ktAyT8:eyM1yo0Suy0x3ANktJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691587865, "uuid": "0b178cee-8e61-4d5e-96ed-bf2e97d2438c", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691587865, "uuid": "0062ff0a-fc5b-478a-a884-5baa6d13c697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587865, "uuid": "1331b28e-612d-4a73-9337-96428c692940", "value": "a51b658a39c1e2da5225ca79898de041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5c2800-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691574953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574953, "uuid": "fd778b1f-7ca1-493e-9e96-f87f6d5d6327", "comment": "Malware payload (RedLineStealer)", "value": "3b82868003c77df38dc75e01414bc884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574953, "uuid": "ba3a6c86-5605-4ce4-a8f9-38df74e86313", "comment": "Malware payload (RedLineStealer)", "value": "c1b8bea7cdc7389e32a185d27aa674d389883a850b71a635efbd15db35fc1a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574953, "uuid": "41a504c4-cc94-49d6-9a8c-eb7881429034", "comment": "Malware payload (RedLineStealer)", "value": "915ab1681dc92510280c9148e817d3cd2285236f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574953, "uuid": "bcc35893-030a-47d5-b39f-073a846e9dae", "comment": "Malware payload (RedLineStealer)", "value": "09e86313fb239a3c928d2c5da33f1524a55d8f5f82a46b5b49862219fcca8ae28af5fe85ebf85ac662d471c1fe7b1529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574953, "uuid": "2699c01e-1356-4c2f-83b1-821e60de418e", "value": "T113E41243E7E85473E8372BB00CF227931B377CF25A68831A3696A85D0D732949976727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574953, "uuid": "2fa00ae7-8b87-44b3-9c2a-e7edf820db83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574953, "uuid": "fee96a17-9b9d-4de7-80df-684dc94e8843", "value": "12288:PMryy90xX2XavrQv7Z/LdbT1HYhamLCWBvHCL9F8zqZW/w9/ovkGL+:lyInkLYK2y9FOqZyAtw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574953, "uuid": "3b27d864-e99f-4d54-9774-eed27bd2ad0f", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574953, "uuid": "f0a2b45c-8178-454b-b088-2f88420446df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574953, "uuid": "8152f8ec-3268-4590-8e22-0e8bdf894972", "value": "3b82868003c77df38dc75e01414bc884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f865de-36d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691599091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599091, "uuid": "039a37b0-e520-4aee-a1ac-45fe2e40b513", "comment": "Malware payload (GuLoader)", "value": "9152cf3d749d6b6c2b0e529c27ceb06b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599091, "uuid": "e3155758-f302-44e0-ac92-d97ce9c13d33", "comment": "Malware payload (GuLoader)", "value": "c2c61bbde334a4752e5d84a402d05c919a00925fede34ef87c3decf66bb8169c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599091, "uuid": "5353a894-48fa-4d61-a301-f885b63b4587", "comment": "Malware payload (GuLoader)", "value": "0a7ce578403fd5269110f0ea363b61de67ba6217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599091, "uuid": "e3e1f889-52c0-4f7e-a62a-7209d6cfbb93", "comment": "Malware payload (GuLoader)", "value": "3066a8948e9b3a7646e804dc6e16d2e98eea0975ef3decb2e38e51a9e344fe9fa68a8f840b52c756ba34a1de1d7dc449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599091, "uuid": "ca5c677d-99c6-4201-aec0-67099ca1c1dd", "value": "T16184BF53FB67C5D7EE3C23F3B493A6EF2DF964660E84409A77A2E7D55000A224E0D528", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599091, "uuid": "9e6ad070-c08d-4106-8d16-9cea33e3e76f", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599091, "uuid": "b9f04e9f-9826-4f50-818c-d774a04e5b68", "value": "6144:aPX0UPlrkcqMGIJjB9rVLd8hnwWML5dFOifb613q3v4IdTV:MlRGIBj8hngnlL4IdTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599091, "uuid": "35433d70-62fb-46e7-925a-aff8db34e809", "value": 407296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599091, "uuid": "4e5090e4-9f0b-42ac-9a14-e0e2d0968ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599091, "uuid": "64ee39a0-adad-41a6-bfcb-1665f0676282", "value": "Invoice Quotation for Sept Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc347fe-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602874, "uuid": "2bbdfe53-8834-4e4e-ac3d-53b8376bbc0a", "comment": "Malware payload (AgentTesla)", "value": "cb1954b869559a2279110d1a56cfe5ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602874, "uuid": "1b1bd047-5f26-4d75-8e6a-c412d9c76063", "comment": "Malware payload (AgentTesla)", "value": "c39ad96c11ee253b9a3f70dddfaa8620adee27308432a5f0f4c4489bf4ba1eec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602874, "uuid": "53a94f4c-36b3-44c2-be7b-66ef7e8d0db1", "comment": "Malware payload (AgentTesla)", "value": "eccfa5377a30fb5fdb6c07ce25e1084f3f914868", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602874, "uuid": "01d01a5d-95dc-447a-b0f5-d70b069f43ad", "comment": "Malware payload (AgentTesla)", "value": "35e80ecd3bc2c3aea9779c066760ac618ddc213c5b5e9f64911d11d2b73517927551ad9e94b48200e3b9bd2bc1cbf74e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602874, "uuid": "05a9a568-028a-439c-9357-9bb158b3c600", "value": "T1FA15483C14696E8DF3A586FCB6708CFF17A5692F80B7F9F3884CA4D306A97D04502666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602874, "uuid": "dad58361-d6f2-482f-812f-307f6fd56eaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602874, "uuid": "9567cdc3-eb96-4b9a-a408-a9298f9f27a4", "value": "12288:eEwVbpEOSLYTh7J4lTs2djD9tSZQBn+PgPeb9G6hUNhBMwF:eRVbpEO6YThmyONPUv2hqwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602874, "uuid": "4b540c97-66b1-45c0-a734-8ad18ebf4862", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602874, "uuid": "9a468329-df6f-4ebb-ac87-4ba1f52162c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602874, "uuid": "bafa82b0-4422-4cdd-9ac8-154a7098fcbb", "value": "Sample & Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80817ff8-3692-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571334, "uuid": "9822bf36-5383-474a-bfcc-03318ae40d4e", "comment": "Malware payload (Amadey)", "value": "f67cdddd3499bd4719596492d04bc3bd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571334, "uuid": "ee5ec2d1-e525-4c47-9ae6-5c614598047a", "comment": "Malware payload (Amadey)", "value": "c3d869d78ae2f4d7813554b6d66b271be3baf8234e1bc9a36be2c1d5f42b1628", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571334, "uuid": "47c3d8cb-09ec-47d5-ba72-644071ed940d", "comment": "Malware payload (Amadey)", "value": "5570373e9a3788b05cdc8d0a743e94be1b835ea3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571334, "uuid": "8da107e2-ae50-4cf9-950d-a0c7ad8f3907", "comment": "Malware payload (Amadey)", "value": "eeda9477d542ebbbc6cda2af450473983e1b6cfe6e8b0126ce6ea86a2350a264b60b2e2074be395d0f7709bde4790140", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571334, "uuid": "65d521dd-7c05-46db-9d19-2777fa01efc5", "value": "T139C41217DBE84032E9B62BB458F603931E367C619D788797234A5D5B0CB36C4AD3273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571334, "uuid": "73f73ed7-e583-419d-94ac-eb945f899a24", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571334, "uuid": "8c09aff5-01fc-4269-8eed-9b52ef4372a8", "value": "12288:uMrMy90pLnuvuaBR0NcjOq2SMSd/BQ3F3zUuXySiEgOSJ:OyeiTR0SbaSI3zUcyS7lSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571334, "uuid": "a6261b88-54c0-4fc5-b99a-f4bc1e64f9e3", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571334, "uuid": "0d5846d4-23d8-42fd-87bf-cbd443d372e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571334, "uuid": "4a9fea1f-234b-4fa0-b816-aa1c5ded9788", "value": "f67cdddd3499bd4719596492d04bc3bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343ced86-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691571635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571635, "uuid": "cd994a25-5861-4040-bc2b-07ed0144fd84", "comment": "Malware payload", "value": "9cafd3d63ea86e21f16551ba000c534e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571635, "uuid": "3788320f-197a-4354-b039-85061ddbd647", "comment": "Malware payload", "value": "c459c19ee1895ce3a992f075803938e64c83c12c0d41c6169d98b0528e2b853b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571635, "uuid": "b4b7f0d3-431e-4a37-b0f7-a63dfe96ea0c", "comment": "Malware payload", "value": "8cb68754a1f4ff9745349f2d85798a9bd85a092b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571635, "uuid": "64d8c4ba-a76e-425a-ac2b-d871f5ddd93f", "comment": "Malware payload", "value": "4f204bc3e239b8e252db31115d6befca5ac06c04d749a8fd6fde62e69d777310f92ff81cfdcc3694987d973d0368bc75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571635, "uuid": "bc380106-c625-4644-9d91-6ce8c51eef88", "value": "T1D433F136024ABBBFCACF00F304F94BE4117E9E97D9199E058144B99AC30B1B5B1A36DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571635, "uuid": "fd0f75c8-9b60-4e7d-afb2-0da6ddeaea95", "value": "1536:hDOXeRq2blZzOw0JRXsTqB2QKYJ38qoDzYCh8x0VrYX:hDyeRq2blZv0R/P89nVrYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571635, "uuid": "e3a6577f-06a0-4f7b-9142-50d5128b2a23", "value": 51192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571635, "uuid": "03db5077-d77e-40f6-a717-9aa5a4e0d006", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571635, "uuid": "46c2a6d3-79be-4238-9383-d30b08e84c26", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a783de5-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623588, "uuid": "203dfd88-d23a-4f46-9de5-acce8d795d5b", "comment": "Malware payload (RedLineStealer)", "value": "f0b8edbf2dffb478df3bd0863b3bd44e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623588, "uuid": "9b2d89f7-4bc2-4060-a2b0-a6925faeac59", "comment": "Malware payload (RedLineStealer)", "value": "c4b115f709efb0b9ce3c714f4eb3eb76009e2a2a80d94ad7559a95a8f21822e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623588, "uuid": "78b98230-76da-4dd5-807d-134d0cb54d8d", "comment": "Malware payload (RedLineStealer)", "value": "afaeeac7f87cbd5d4ed897fc8674284003ada148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623588, "uuid": "1a75e159-77cf-4e09-bcde-c8529324c9d5", "comment": "Malware payload (RedLineStealer)", "value": "940e9293864998e3ccedea3226f4b5dce2187ca3bd97eea9f489328277d03cdaa02c8e480b11138b8e05606935dd0099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623588, "uuid": "7bd38eac-f2c7-4cd2-a229-f52d145bad0d", "value": "T15BC41253AAE89177D8F1077018FA07831B39BDA54C74431B2AE5A95E0873AD8B93173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623588, "uuid": "635106f2-f802-407b-8c1f-8f250eab94e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623588, "uuid": "146d429a-5585-40d2-9af3-80b744605049", "value": "12288:kMrWy90BrbLXWfx6DjdG3DPEGvsW7aH6QTxXbN:qyg2gvcTPxkWeHHTVbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623588, "uuid": "15ac1ced-5fd6-427f-a51c-a9c11b91c57c", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623588, "uuid": "03c220b0-0276-44ea-80fd-36785443f186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623588, "uuid": "a99b91e8-e06b-45c1-82a6-55d5efd51764", "value": "f0b8edbf2dffb478df3bd0863b3bd44e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5ab97a-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606282, "uuid": "12b208c9-8d66-4e55-98d8-47c8efabcd76", "comment": "Malware payload (Mirai)", "value": "dfe73a12db45ff4277e8c4df52908cc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606282, "uuid": "a867f653-a004-485b-b4a9-5f1a42ed64c7", "comment": "Malware payload (Mirai)", "value": "c4c2d0b0f74fb186b066e40198467b6aa2dc4bd0d2c3882aeec04ef5102f4956", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606282, "uuid": "a09ffd96-6771-41e0-bc42-47e99020dc34", "comment": "Malware payload (Mirai)", "value": "0aec9af4f3447771d4921b9287044f7e8b5dcf3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606282, "uuid": "abc80852-97ad-44fe-a464-80e6d5d50a49", "comment": "Malware payload (Mirai)", "value": "4f15e99c6cc569b4ce1361f4df4a70f3d337de5d2de4e187334d06bdd1f6ac7b9506679274887a60b96930ca802ea16e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606282, "uuid": "b74e0bb2-d111-423f-84fd-ad5777e06dfa", "value": "T183C2E130A3EE1CB1C6500532E7786AC9BF534FBDE5FE3C90124097BA794190529DA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606282, "uuid": "97821d3d-4e83-45ea-b193-33ca3f0c1908", "value": "384:Ejt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEZj54ADZhymdGUop5u:ERsoTAZ3alkXLvFh8nNEF64s3Uozu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606282, "uuid": "a93c2e8f-9448-43e0-ad56-4898903bdb15", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606282, "uuid": "1c1d3d2a-7dc0-4625-b420-c8885408a03d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606282, "uuid": "3c39527f-63b9-41d7-967f-312b276db6dc", "value": "dfe73a12db45ff4277e8c4df52908cc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b264b64f-3665-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691552090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691552090, "uuid": "a46c2337-a356-4161-8418-d2d7dd58e76b", "comment": "Malware payload (Mirai)", "value": "4e57349b6d1a0af2396133d739958aca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691552090, "uuid": "bb6b38b6-0f50-4cdc-bf20-72d8a75cb34f", "comment": "Malware payload (Mirai)", "value": "c5d48118bf703da04b2ec4a4d9e519f8b2e48fd6e48e939b68fdc1545de28977", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691552090, "uuid": "b63afb1f-7e1b-4c54-ab77-869c0f5441a1", "comment": "Malware payload (Mirai)", "value": "f0f42fe1bd66c76d53c0865312d0b716e76671bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691552090, "uuid": "84d2ff8a-c057-4d72-bae4-26ca8243b786", "comment": "Malware payload (Mirai)", "value": "bba4bcd3257f634ac2f9b6b93fb80d2823ac3dfed0fb2b9cc663909983b65bf851df250584df5b2655076a87e9937707", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691552090, "uuid": "06b86a53-3c73-493b-b70d-0a0897be93c5", "value": "T157732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691552090, "uuid": "708eac74-09cc-4804-ab99-8280031e3b92", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9Wq:927jqCt8v3GI/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691552090, "uuid": "2a0fd900-af52-402d-9819-4c919cc181c8", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691552090, "uuid": "b9fbb781-4ac5-4cd5-92d5-cd2889002d9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691552090, "uuid": "e313290a-b274-402d-9610-e545a92e2b26", "value": "4e57349b6d1a0af2396133d739958aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7734b9b8-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549414, "uuid": "8397d513-ef5c-4622-8852-3bba3a719dbd", "comment": "Malware payload (Mirai)", "value": "2cd15bb87aa94a1f812ef0e0c7330f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549414, "uuid": "06b0e40a-e0eb-43ca-8e60-df75c0481821", "comment": "Malware payload (Mirai)", "value": "c5defb4d8f5432011262aa79c146fff52f61bbd359fb90f2812b02e062d2f030", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549414, "uuid": "974ac0ae-935b-41bb-881c-467c830fd67b", "comment": "Malware payload (Mirai)", "value": "e9febc579130d4ecde8e924528d528fb17ffddd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549414, "uuid": "0e8efe32-ea1e-4e42-b2a0-9ca6414bb08b", "comment": "Malware payload (Mirai)", "value": "29a7db38287d73bc77af115900daccf8f376d1d0a4ddff3f9062dd0576b50df99405169e47892ebc635a24d9ae0f6de3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549414, "uuid": "b4c1ff33-f228-4b5d-b2f2-82fce9fc81e6", "value": "T1B4D2E16EE4B581C5ED8E5C7D848C3BA10E49E581231BDB966321CC8D5B32C5BF17A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549414, "uuid": "4b70c54e-b823-4ce4-82b0-53beaaeeb5c0", "value": "384:e8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjlLP6+RWGVCz0Nvc:jMYHb62x4ahQ3CfdwLjkWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549414, "uuid": "64a20570-323e-4d68-a30b-12123cfa4861", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549414, "uuid": "2ba6a55b-8b73-4d55-9be5-1d55d580746c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549414, "uuid": "3543dcd3-0e6c-4160-ae62-8c5b5ea2ec31", "value": "2cd15bb87aa94a1f812ef0e0c7330f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b031addb-36ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691610069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691610069, "uuid": "da3f78f0-09c0-4aa7-8cf0-e82545b1ed42", "comment": "Malware payload (AgentTesla)", "value": "aefddcdc823f16072869862f35db8dae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691610069, "uuid": "62b8a812-d2f3-4598-a6c2-05e2e4a8ec65", "comment": "Malware payload (AgentTesla)", "value": "c64d5d0de4f44877c82a0481a6a71e9b2ab91acb1f960c50d366ac532eee7458", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691610069, "uuid": "291b1a83-c57d-4100-96d4-8ef3e19c6a9c", "comment": "Malware payload (AgentTesla)", "value": "a3f9ba9bf6715a8f49d236c3cd08119b01484c01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691610069, "uuid": "9f5901e1-eb85-4b89-8204-67cbb39509ed", "comment": "Malware payload (AgentTesla)", "value": "cd8a0683c2d7602df1482eb2458e41c5420e74373547839f3dc6e192179af4c49830d1223bbd9b4ff51fee365b6a30e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691610069, "uuid": "65c54823-980d-4c4f-88a1-2afc47a8c744", "value": "T1FAE402BDB3EB9D34D7642132DAA624000331A64FA063E71F356861E5D62BFD24356BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691610069, "uuid": "9821b0a0-05cc-46f8-bccb-47ea9bab00a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691610069, "uuid": "dffa2182-df90-48d0-bef9-df81baad9c8e", "value": "12288:1RGGTIYlV2UO/K/uglrxrMFeJMIPYw3z/mEuT+1oQ+4blaBTGLtP/w2:DxIYlVNO/KdltrMFNmYw3SI1iglYGLJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691610069, "uuid": "fdf731ee-960a-47ac-9d06-4c60541ae606", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691610069, "uuid": "f44df058-de63-4bce-8bbe-ad44290c26cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691610069, "uuid": "13864f04-ef59-407b-9472-55f5f9377f67", "value": "SecuriteInfo.com.Win32.PWSX-gen.30538.22913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66c6b67-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606267, "uuid": "3f5e45fb-873c-4f40-9743-19d28619a733", "comment": "Malware payload (Mirai)", "value": "ff413152009e09d13e0816fb032030c3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606267, "uuid": "539a32f2-d1f8-4e66-a231-853a664fba08", "comment": "Malware payload (Mirai)", "value": "c668990cf0cfa67cf4d833749114d04a933892a1baaaeab44f48145a4a401176", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606267, "uuid": "1794beb2-40c1-476f-94ea-9fc29d1bcc97", "comment": "Malware payload (Mirai)", "value": "21ad04380c73a8bf9ca0bcaa391e09669042f870", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606267, "uuid": "89b5f325-4152-4373-90bf-6198681a22d0", "comment": "Malware payload (Mirai)", "value": "baa813ffb9950524990d8ea9702e3591b79a6d242fee86f04c37e1324a99918f7ac58b70943e2a0d4cee1f3305616214", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606267, "uuid": "1bbc5806-8afd-41ea-8183-550e6ed3d3ce", "value": "T196D2D0EBF2D7D4F4E5F69478115C20C0E478239AA62087FF049B52BE88B27CA1639F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606267, "uuid": "c38c82ff-f538-4376-9fc8-3e63987bb068", "value": "768:lYSoXdJZtUjkFfNJlVrQeHvPx2csGHE3OSx0sL:lYJdJZGjkFV35/Mcr2tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606267, "uuid": "61d952c1-5050-4af4-aa61-d36e04c39435", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606267, "uuid": "13ee80a3-4dcd-4770-95a4-37f736ae4234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606267, "uuid": "73778e25-4499-4fe0-b3b1-caa9c37274f5", "value": "ff413152009e09d13e0816fb032030c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029e6197-3680-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1691563392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563392, "uuid": "db447520-a29b-4a28-a0fe-ca50d7fd9150", "comment": "Malware payload (GuLoader)", "value": "68ec6d9ad622393e139f45519501da24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563392, "uuid": "61a9c799-c40a-4284-b333-bf7c87bce288", "comment": "Malware payload (GuLoader)", "value": "c8a5314583d9b0295f1f8cefc549c74db160ad2cf497819861b4afb0d1dd2193", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563392, "uuid": "cd4045ed-aaf7-4c5f-9d6b-ecf8e1533bf3", "comment": "Malware payload (GuLoader)", "value": "32f3b68effdbce1a087a8eb60cb309b81baafa8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691563392, "uuid": "9884c05f-c91b-43ac-b9ad-f700bb10899f", "comment": "Malware payload (GuLoader)", "value": "7067a373eb131955f27c3d64f89cbbc48e8e1c62d87acf8f4851eec230da576c4ebe2b8349e4243ea0fe191038bcaca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563392, "uuid": "d3e70ed2-f553-4a27-aac2-75a3d2e63fd1", "value": "T1DCB4F1D5E5C0DCC2DC790470E837F9A16A5E2C6DA874E519FAAF7239A532623201F42F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563392, "uuid": "3a3b45e9-fa33-41e5-b6e8-6a9f5205553e", "value": "dd68e663380c71f66b512f005f1be7ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563392, "uuid": "a8eabec7-6c3a-4a24-9bd0-582f78f9c01b", "value": "12288:A4PK/rsNIKJAF3fI+Ek/kK68psWZayLm8ZQ68yo3uF9PZ5:A4P8KJAF3fNEk/kK68psWZPQRNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691563392, "uuid": "616d9a3c-f1f0-4934-819d-44b4d7dfa64a", "value": 535700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691563392, "uuid": "e6b9713a-c11a-4eba-9944-80339a166e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691563392, "uuid": "463724d5-b560-45a1-90b5-68f886dfe979", "value": "RFQ 00199199000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6249a52e-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602636, "uuid": "04304a0e-e533-4039-84fb-950e5b2b2ac8", "comment": "Malware payload (AgentTesla)", "value": "eb90402caa4467436034bf7cdaa4b6b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602636, "uuid": "99eab5a6-c274-49ed-9178-0d0336dcdd01", "comment": "Malware payload (AgentTesla)", "value": "c8c89017b5cfa1eeaf32503fd0abd7231e8fe0c51c516216de5b20af5ac61b89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602636, "uuid": "fab3ae84-7317-4295-8524-1ae3bac64a12", "comment": "Malware payload (AgentTesla)", "value": "a20bb6916479f902c8ddb1c78fdbb82a410a08a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602636, "uuid": "06c2742d-707d-41dc-8b25-89b1c6965261", "comment": "Malware payload (AgentTesla)", "value": "cf25690afef6ebec087c484befbbcba02caf491de352c19da4bb79b2a6b40a2c5b460ff2dba8730a5b0b980d6df39fcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602636, "uuid": "b45e2f9b-6f17-4453-99fd-02a0386ba8e4", "value": "T1E5D423975948EF85A68F613446B321A7C30D8AFEF8F15C7944F2A0F0A5BDA703582E34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602636, "uuid": "e38ec964-5936-4334-9771-1caa5e59d506", "value": "12288:+t/I251CvLyS2c7lfn9niDNaN+Mn9qmXztZokbt:+t/IuWLyS2c7GaN1n9qmMkbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602636, "uuid": "38153b12-42ac-4528-9d40-de0266c9a430", "value": 650351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602636, "uuid": "d6ebf741-d817-4361-a8e4-6d1b72919b35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602636, "uuid": "b5b329f1-5e3c-4248-b011-41e973b18222", "value": "2023_08_09_Swift_Copy_Pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3460c527-36a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691580655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580655, "uuid": "858fd5aa-2012-472f-bdcf-1d918c8af085", "comment": "Malware payload (RedLineStealer)", "value": "add1eb3887f37f3c5a79032dd7c70736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580655, "uuid": "eb98928e-13f7-4bfd-a2a3-dc2d7091ec9d", "comment": "Malware payload (RedLineStealer)", "value": "c9d2035d4a95bbd07d4e1d193250733867903947784c2aabf33b5dddb2b3a337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580655, "uuid": "846651de-a970-41b0-a5ea-63034f4a6f78", "comment": "Malware payload (RedLineStealer)", "value": "9000ddd42fd39f9ba540a29cc21d813ad5c6de75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580655, "uuid": "405e6555-e604-42b6-b290-2aaf9e8bc170", "comment": "Malware payload (RedLineStealer)", "value": "de2c85baedba8fa50bb036832e37d8c8483f24cf2069c7b747692a49a306edce2d06ba3d515502de1ed299ea9670d861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580655, "uuid": "cba09671-80fa-48bd-beeb-b9209948a68b", "value": "T12413F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580655, "uuid": "9804bb11-c32b-407e-b6ca-d4ff204187ec", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580655, "uuid": "b6abdeaa-cc96-4741-900d-8517c6169eab", "value": 41590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580655, "uuid": "e60e6ddb-319a-413b-a867-3572d4a53a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580655, "uuid": "4a31fa8b-c7f4-4ba1-b1e6-6cb534cdc110", "value": "add1eb3887f37f3c5a79032dd7c70736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950c42c2-36dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691603581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603581, "uuid": "6441f377-adce-4dd7-b5bf-707469adda83", "comment": "Malware payload (AgentTesla)", "value": "762df4801061068efc7a2dfbeb555701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603581, "uuid": "e12e79a5-2715-437c-8666-87b4f4b35121", "comment": "Malware payload (AgentTesla)", "value": "ca500d1aa989e4ded1f4b5eaa42ca152b377a948b34ff49199dbad96346db1a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603581, "uuid": "3c479e42-4dc8-4d04-b191-9a3c0594ec98", "comment": "Malware payload (AgentTesla)", "value": "3c6776fe94d7f15d70872e4e0d2366508a78b1c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603581, "uuid": "2fc7f1c9-9bda-45b3-8e4d-1279a0b942e9", "comment": "Malware payload (AgentTesla)", "value": "f3868f724b2c8511b0ee5155d9352f795e65f3ad83576caf571d47eaafa36c4806953bd4c5f62cfce4c59b2e6073d637", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603581, "uuid": "21c5f044-94cf-4e53-861a-108e390dd1fb", "value": "T16FF4063C11296A8CF3A586FCB6748CFF17A56D2F80B7F9F3885CA4D706A97D05502262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603581, "uuid": "9c3e0a4b-7ea3-43af-8209-b959af6669cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603581, "uuid": "8253e37f-5a74-4e2d-9433-acaca8caeea3", "value": "12288:BE/UBRpEOSLYTmotoNqAQPhF94tgGcvOupvbSeufVbk56oPnTHI:BqyRpEO6YTmoSqlRGc2unoVbkFPnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691603581, "uuid": "435a4464-2933-43ef-8886-6231dce401f2", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691603581, "uuid": "bf5d23f6-0e32-4aff-b6bb-a5413c8db9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603581, "uuid": "555602d0-60a7-40cd-af42-bc5d44c57c1e", "value": "762df4801061068efc7a2dfbeb555701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e609842-36e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691607650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607650, "uuid": "7176c834-5c13-43b7-a17d-c5619e4fd005", "comment": "Malware payload", "value": "4f82965009a0cf89a4ba7b99ed9dcabb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607650, "uuid": "d7b5b152-b91e-4add-b59a-be31612a3d32", "comment": "Malware payload", "value": "ca56dfb91ce399348d8a654e1d092577bcc664f07186f1aeca6dae16433828d3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607650, "uuid": "71473c36-78aa-4ed3-b4d4-02998aea9b50", "comment": "Malware payload", "value": "d9664219e00e951fd01e3b4520b070271eb88487", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607650, "uuid": "6371e5cc-437c-489d-9df4-10fd6e5b9336", "comment": "Malware payload", "value": "d95b32ca686a027a17d42fbf0f9d00fbac098eaf4028e832bf9572921a70a429d43ac03ebe2ac505605025b0230eb5e4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607650, "uuid": "7ea56eaf-9641-4b82-b81a-49f48028b580", "value": "T1BE01C0356D5C4001EA0B2EB0B38DC1DC08D11460AB7D7D65DB50E5188EFECC87A267E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607650, "uuid": "d842dc34-62ca-43b2-a83a-d035dfa7a6be", "value": "12:5j/AQC1kUTY2e708rcTNlIJjHBAQC1rbORJ5WVRD49xyOzAQC1kU1xyNvBAQC1r7:9/A9k2801TNmtHBA9uRnWCpzA97ivBAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607650, "uuid": "2dd520a7-2417-4cd1-a2d7-b330347dd467", "value": 735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607650, "uuid": "3ab7271d-3f1b-4290-8f00-03f3a3b71a36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607650, "uuid": "ff65d945-0ea8-42ea-9bd3-e335728b4796", "value": "SAT_Complemento_Seguridad.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ec62af-36de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691604007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604007, "uuid": "14b9b8e4-020d-4906-a149-3e11bacc1a90", "comment": "Malware payload (Mirai)", "value": "1634fd4c0b13800e66e361638239cb57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604007, "uuid": "8988a66d-79e6-463c-9ad3-75693d0b5a2c", "comment": "Malware payload (Mirai)", "value": "ca763b5092b6a3a8e06db879b07b787a0872c0fd248613a452b8e26860ea3d51", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604007, "uuid": "48912b5f-9f53-4ea5-bb63-6d2dcb49429d", "comment": "Malware payload (Mirai)", "value": "d210e744b1782ba5e5cfe22131c28e6ec6bd3f11", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604007, "uuid": "c3d43687-997f-4718-90d8-b6c04d3145bf", "comment": "Malware payload (Mirai)", "value": "88059f470b6d5f9b2013c317b4230548ff2882fb04f5ac1e9aea9c1fc967a01dbab82bfb1c2bf9574c86bdcbfe42cb27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604007, "uuid": "b7b25ea8-08eb-449e-8f49-59ef2b989e55", "value": "T195C2D1322BEF39B0C2A464B9FD788ACB514F4AB965F16521364017A1DEE200352B58F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604007, "uuid": "860ee042-01a7-475d-9c73-8acb723949a5", "value": "384:kXNSIfjdxuZ1DUofVOyPqMvt6GqAAdq1K0jzNH7EUz6z6RNo9ch88PaUhymdGUoc:AjKX9vt6GqA3Q0jzV7EUyUq9EFs3Uoz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604007, "uuid": "7e8662bf-461d-4eb2-8df7-432981cce39e", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604007, "uuid": "6d25e846-2ac4-4ae2-8f82-d65cd498096d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604007, "uuid": "1dc7583b-1271-438b-8b6c-3d14cf3d3e07", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e616ea7f-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571934, "uuid": "501b33df-afd5-4ed0-850e-693392c86027", "comment": "Malware payload (RedLineStealer)", "value": "be1fdbd5f876c5f3510ef151198d7eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571934, "uuid": "190392a6-42cd-4324-bb2e-d6dc5b0c0579", "comment": "Malware payload (RedLineStealer)", "value": "cbc02210f9ddc7319bb3f498ce54f39d6968688d521d1ffd7e5c65ba15b1a9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571934, "uuid": "90d7fa40-d5fc-4b0f-be6b-c62d74b725d7", "comment": "Malware payload (RedLineStealer)", "value": "a1fdb8cb2ef0e59775320aea1ce67f5605644ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571934, "uuid": "b878acee-e94f-4fea-bb76-3b57f0b68954", "comment": "Malware payload (RedLineStealer)", "value": "6f43d854a6a31a4c8e8401ea5d825c046686f9bd7c72787c4ccf037f763053bc00fff9c228453038362c4fa497b28c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571934, "uuid": "484b8b00-4133-46c7-86fe-7597eed2d5b3", "value": "T17FE41343ABE85122E5F113B059F702831B76FC9068B89237379A9C4D4E736E4993673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571934, "uuid": "6b043d07-2514-41d3-9fdb-ba4fbae92efb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571934, "uuid": "d9de8548-9aad-4ba9-9e7c-6f804773d85a", "value": "12288:tMrgy90uXCPu2cIDRCNK8Hg+T7/MnNtcctMlhTH0RplH/w0hx02vzncghrFNAO:dylXCPu9INtwnT7/iNt5SOBZh1cghp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571934, "uuid": "884b2663-9c1f-484b-aa84-c2bd62d37674", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571934, "uuid": "d02ac7f5-44b0-4c9c-acdb-695719d858d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571934, "uuid": "9472832d-7aa6-47f9-bb9d-b88b2f4a7007", "value": "be1fdbd5f876c5f3510ef151198d7eca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b826522c-369d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691576152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576152, "uuid": "44a6707b-e255-45ba-9424-a7d0f8ec926a", "comment": "Malware payload (RedLineStealer)", "value": "535acc5d1e19dd50fa0a3d586feb420b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576152, "uuid": "20fe9f72-595e-4620-9fc0-cbab5067b267", "comment": "Malware payload (RedLineStealer)", "value": "cc4518893088ea884319c98cf751cb5c86e039c3109639e3fbfbe45b26c812a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576152, "uuid": "6c49cfd5-6b83-43e4-ab55-7ced1f49e8c5", "comment": "Malware payload (RedLineStealer)", "value": "498472f08551120288f02c9c67714147d41ed2c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576152, "uuid": "7e657735-243f-4b35-8974-80e70a3067a8", "comment": "Malware payload (RedLineStealer)", "value": "db15f6c7e953fe8c911ac17f31826f0ff6051aea065872d68471f5b77caac714b98ea20a0d4ef859511e0ca35f360c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576152, "uuid": "f9ea1bd0-d6b2-4f41-a522-a3993031479f", "value": "T153C41202E3E90133D5BA17B4A8F303831F367E614875936B7742995F2CB2694B67272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576152, "uuid": "8df2739d-b91a-45dc-a8b4-77076c583203", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576152, "uuid": "fe1504c1-5b1d-423e-9483-5ea4934535da", "value": "12288:WMrEy906CVcef5nMYQCEMu3Hq3NuBKxDkZx:Oyinf1MYJEz6du4Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576152, "uuid": "1a924d9e-9858-4ece-8d21-7a67f615d314", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576152, "uuid": "163249a9-18da-4527-bd7b-de41e3674c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576152, "uuid": "d149d6e0-58ff-40ac-87ca-10a3e47bfce6", "value": "cc4518893088ea884319c98cf751cb5c86e039c310963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2296b3-3690-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691570411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691570411, "uuid": "e823593e-5a57-402a-b136-99da8488dcfd", "comment": "Malware payload", "value": "afaadef3efcf57e38d6c60e2ea645d01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691570411, "uuid": "b798cd42-1d38-4276-a75c-fa8778dcf9cf", "comment": "Malware payload", "value": "cc48b9520d64fd7e850c36fddec6e8d15d316a3da608dfdff06b9ca2f6262814", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691570411, "uuid": "f03b545f-8990-4bed-b240-deb574a2612b", "comment": "Malware payload", "value": "57cfb642f4f55dfec33c33877a501855613fe927", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691570411, "uuid": "f4dbe669-8749-4de4-bc88-e3b42d40efe4", "comment": "Malware payload", "value": "23302c96f2d5476c11ee86a1a942e7c19461e84f96ba8814fea5d8aefa2f607fe873b14ee57935b2ac4839a60f5f40bd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691570411, "uuid": "942f4576-94a3-4148-8234-e1d2b3775a3e", "value": "T1C7236590039C9FFEF65E25BC00846C754DA468F8722F45A9DBD79C8EC459EC522A0E8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691570411, "uuid": "440cbc28-aeca-4ee4-9642-48a87955999c", "value": "d8ce9fc3542a0847823df385d3c8424f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691570411, "uuid": "c85e9149-3ae8-43fc-a40e-46843b9d6ade", "value": "768:P+xi9eTlCCTo4a8EcyJWCfN0AWv1Tom3lCuKkw5AJPZHMT9SWPP85y18dj:Pr9eTl64FEnWxAi86VfJP2785v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691570411, "uuid": "eaa90c60-9a2d-438c-b2ed-ce64451e3bc9", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691570411, "uuid": "71c63b79-c7bf-4994-baab-d1ac2b18ab70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691570411, "uuid": "c129ee3f-534a-4ba4-9ed8-8d4f9419f542", "value": "SecuriteInfo.com.Win32.Evo-gen.25874.5451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e88cbb-36d2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691598676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598676, "uuid": "5bb4b669-886d-4ecf-94b3-f7fdf9b77a01", "comment": "Malware payload (Amadey)", "value": "841928876b23b4739e37e6e5de17c6ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598676, "uuid": "10b7a398-32b3-4253-b7b1-153a6729167b", "comment": "Malware payload (Amadey)", "value": "cc9d4dcd2af5a5bff210b6ba183714a47b15c6f6c7666d3f3c60088abcd21dc9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598676, "uuid": "8c7d2e69-c30d-477e-9283-5705269bd926", "comment": "Malware payload (Amadey)", "value": "ee89c6648faf8f90ba5d5e89512939aa0cd85441", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598676, "uuid": "508f92eb-b7ab-4d1b-9615-3d8342029aaf", "comment": "Malware payload (Amadey)", "value": "58cbe81cff31e67518939251263d4ca07b8574031c58dc9d7e2028fdae0af26cffe635a9fb9492f28da8456675dc6a6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598676, "uuid": "078a5675-1ed6-4d20-aacd-c1b85e4d896b", "value": "T125C4125777D88076E8B513B069F112D31F3E7DB2993483662346A9AF0DB2ED0A931327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598676, "uuid": "ffed57e1-3d46-40a6-ad5b-61ef74aa3b31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598676, "uuid": "7ddbe6f6-0acd-44dc-83de-2f68fd2c9204", "value": "6144:Kdy+bnr+Gp0yN90QEGyMCzfg8t24G4kY0gKob3rauNnp6xg2zbXkbamSMZXOdiOO:vMrmy90cIbbaMnCgOXkbnZXusFPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691598676, "uuid": "dbd29bec-996c-459a-999d-ccfc4f8994f1", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691598676, "uuid": "50f7c685-5527-4578-92b1-4cd046b35d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598676, "uuid": "4b8b572a-5123-4dd5-bf28-3ae740609df6", "value": "cc9d4dcd2af5a5bff210b6ba183714a47b15c6f6c7666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b09f335-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691583700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583700, "uuid": "78dd461b-9c51-4fd1-a77c-ce0eba644cbd", "comment": "Malware payload (AgentTesla)", "value": "f4d15d2513222294694efc84a480622c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583700, "uuid": "b4db1b9c-e032-44ad-a925-9c7ba5192715", "comment": "Malware payload (AgentTesla)", "value": "cdf6f805ecc70e4ca41b5e344059d9b45495d4a4229ac1caec22d609b39ed1e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583700, "uuid": "ec763b86-0503-409e-b5f8-f6053f7d6582", "comment": "Malware payload (AgentTesla)", "value": "1bb48da7a0a594ecb8894bf160eecb08ba5edba7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583700, "uuid": "05b36fa5-49ee-4634-8a05-498a270949fe", "comment": "Malware payload (AgentTesla)", "value": "e8220b8850c8e9daae698ee1f2d781591901a7b73648456053bec833bc5aa77c3ee6eb219c4582e6283f0f8568b499a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583700, "uuid": "8609cc26-8e22-44c9-8004-e7b1ed1c650f", "value": "T17305273C15696A4DF3A486FCB6708CFF17A56C2F80BBF9F3895CA4D306A97D04502662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583700, "uuid": "d62e5680-c590-441c-ba1a-cd38a7bf9823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583700, "uuid": "d5e649ba-531e-48a5-a59b-acc54d95f83b", "value": "12288:sEnnkOpEOSLYTGYNr+z8sKKJciR8CWZCHs88sQT0+P7pSrPpP:sukOpEO6YTGcPgctlTxP7pS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583700, "uuid": "f07aff0d-198c-467f-8351-06a201ef576a", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583700, "uuid": "8d0b836c-1b9d-4bf6-9580-e420f1b8bf0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583700, "uuid": "d2e00e53-e12e-4ca0-afd7-20ab3707fb7a", "value": "Contract PO-32021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83ac013-36d1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691598566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598566, "uuid": "dca7a50e-4cb5-4f8c-903c-64b4ef7e0008", "comment": "Malware payload (AgentTesla)", "value": "c86ef1b26183b4d137a74aa4159c4980", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598566, "uuid": "1434d434-15e2-4148-b384-0e438ab7622e", "comment": "Malware payload (AgentTesla)", "value": "ce963a56592eb02a8f5b9a4fd305119ad2eaa2c01b382f449e7d726f3044e114", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598566, "uuid": "9ad8469b-8020-4ce3-bba6-042703976fdc", "comment": "Malware payload (AgentTesla)", "value": "a844f64db746e611598c310c3013db0d9a881597", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598566, "uuid": "36af3f02-a2af-4358-80d3-0835b81085e9", "comment": "Malware payload (AgentTesla)", "value": "0e351e41ca0a244037b67f31b80968c328089bad7daf642113114d268c76fa70ef497257078796b975b7fab47315f823", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598566, "uuid": "151821e8-4e63-4889-910a-f293158d865c", "value": "T14434ED137E48EB11D658393B82DF6D2463F2A0C71673964BAF48AF6566422437C6E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598566, "uuid": "6836c5d6-acb9-44f9-9543-9af1944f3988", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598566, "uuid": "cea3aad4-f08e-41ed-b346-d02f921068ab", "value": "3072:W3KO/+FK/qwbtWxbQjMfZwWj05QCBqs3R0ia:LO/JiwbtWxbQezkTBt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691598566, "uuid": "67bf35b6-5640-4920-b800-e0002b880e04", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691598566, "uuid": "9735db96-8273-41bb-8732-d2e8bee9db72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598566, "uuid": "9bbc31f3-12c0-4763-bdb3-d5897f1cd6ac", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287f7df3-36d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1691601681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601681, "uuid": "8a43ab15-02f9-4001-99a8-9379e492e6a2", "comment": "Malware payload (Tofsee)", "value": "43a2b7af6527a42f54fb297f4b3bb4a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601681, "uuid": "b908b68d-0834-43c3-acc8-d29dd010a02f", "comment": "Malware payload (Tofsee)", "value": "cfd50ebd68ef10d129a02abda73eaf641212107379c094b1e84d50e0f7e5dab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601681, "uuid": "8f26d13b-5b1f-4154-92c2-c112f75f5e4e", "comment": "Malware payload (Tofsee)", "value": "5bb49a4655cb97e2f6924d497387758303549f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691601681, "uuid": "54b874d5-2ce7-4fd7-b777-dcb139d4ddce", "comment": "Malware payload (Tofsee)", "value": "06fd80182703f20f5d21eef8423a7157f8f368a87cf60785b75e3b6df0430deb7f11c3b8120e951c1e0cc87d523f741c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601681, "uuid": "16afa2a6-6da4-4634-b9fa-f69c2553f8e4", "value": "T11244CF227AD2C072C99B15704834DBB06FBF78765374898B37A9067E5E702C19B6A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601681, "uuid": "f5bccb15-c956-40d7-9a7e-b6c2180f8827", "value": "21e75c39e5b8b26ccac618e4f1755b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601681, "uuid": "4e334777-1e43-4b09-ab19-8eeeea02b55d", "value": "6144:azmmJzWLmiG+b4q48QXLFu7vA09LWmbFmU:YmLO+b4q4f87YaL5bAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691601681, "uuid": "753084b5-d925-463e-98bf-70b071ee00b1", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691601681, "uuid": "1f3992c1-6cf9-4c1d-b2ec-2ad7c6b5f048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691601681, "uuid": "7cd28d4d-6ae9-4e09-a68b-9f0c44d38d19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d8564e-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691571640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571640, "uuid": "73f18b08-288e-4140-aaaa-7abec26047e7", "comment": "Malware payload (Mirai)", "value": "220f76c8077aa19858766d1ed937620b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571640, "uuid": "7a17c8d6-b4e3-4fbb-ab2b-93dc53b815eb", "comment": "Malware payload (Mirai)", "value": "d02f75a55e4ce96a9d20b6c941aa6c09dfa83a3b55bafdcc6fcf69a0d709e0df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571640, "uuid": "e8a4eedc-7fc0-43a6-a184-3c901474d0c3", "comment": "Malware payload (Mirai)", "value": "87812da63363ec70e45c223a52375b6237c02900", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571640, "uuid": "867af40b-8bda-4f33-8ce2-b6f39eabb816", "comment": "Malware payload (Mirai)", "value": "ea2235b4c6e558384dabc4b3b0315fb5c320a5d130a2b5b33c7b484b8a89593a145253018d98d10bfa2c746f096fcb76", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571640, "uuid": "dea2952e-b18b-4db2-82b7-4d509e56d65f", "value": "T19033F1DF63047CBCD24291792A364D48FB76398D6702AB160CDE7D3F9CA34C0A618325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571640, "uuid": "b54873fc-982c-48fc-b52b-061bf5924de3", "value": "768:j9wHaPPxx9o21LvuhQ90xhWj7tlNrfNPFpooqNrzziHbvJcLqRQ2v9sPvl:jg21LuhQ90xhEp7hFjqN6FhtFut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571640, "uuid": "fddcc5ef-510c-4868-913e-5c42dbf85836", "value": 50428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571640, "uuid": "0c81fae4-8e6b-4b45-aebe-d5127bf317df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571640, "uuid": "cfa68079-d90c-4d05-ab95-3097201ed23e", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea78ad6-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602872, "uuid": "8e4cf0de-1727-4554-ace5-fc73a04af0d1", "comment": "Malware payload", "value": "895dd8b1b64fc5183dfc82215c512e32", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602872, "uuid": "cf765dc8-6158-4f4c-9af8-4202e90b603b", "comment": "Malware payload", "value": "d0a9ffcf4ddefa23938673d86deac0a145365d93a082a8f413f1d8324d6c2bb5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602872, "uuid": "cc9766d6-69eb-4021-9767-ebed2bbf4a82", "comment": "Malware payload", "value": "5030c4ec85d57c001f9fb5040ec0f1863a64ac56", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602872, "uuid": "5c4def29-0afb-4f51-8640-9c839151fd85", "comment": "Malware payload", "value": "fec91cb69f3fb1310d420cb6b3de71bbdd88b908121b74abf3c4560f174e627f151df7b9fb8ab2f4ed47e7e2a6bb03be", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602872, "uuid": "00da80c6-f79f-4a2b-8500-9dfbc163d43f", "value": "T19EF423704C9A637BCF5F21E6118611E16309DCAD83D9B523A4A3A6BD2124FE3506F78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602872, "uuid": "73f5148c-6b85-45d8-975e-b5ed63600500", "value": "12288:dpOb6H6HhKUeRjiI4fZEtNRMUHxUix3k7KEQqJ1cjp9YxCYRD5UCXqGJ2c7rOSo8:G6iKXiI4hEjDHBcDQqJeN9cCGGC6GJ2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602872, "uuid": "1857fb2a-b8a7-417a-b838-16310fb308eb", "value": 729335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602872, "uuid": "52a3b334-027e-4b84-880f-671ece961d31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602872, "uuid": "c6874404-bf3b-4440-bd6b-af568eddcaae", "value": "\u03c0\u03c1\u03bf\u03c3\u03c6\u03bf\u03c1\u03ac\u03bd\u03ad\u03b1 \u03c0\u03b1\u03c1\u03b1\u03b3\u03b3\u03b5\u03bb\u03af\u03b1 \u03ba\u03b1\u03b9 \u03c4\u03b9\u03bc\u03bf\u03ba\u03b1\u03c4\u03ac\u03bb\u03bf\u03b3\u03bf\u03c2.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f89301-36e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691608040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691608040, "uuid": "e647f0d0-50ce-4663-8c92-a296a33c482f", "comment": "Malware payload", "value": "28f9416f886f5f6561bc09ce0b76a37f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691608040, "uuid": "1c2ff43e-e50c-483e-b867-73e9825dd064", "comment": "Malware payload", "value": "d103ad24a28c98abb7eaf9e2e51431dfe4e7c3e61f60736392ef808f28d09d50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691608040, "uuid": "1acd4e41-8feb-4086-8e4c-31d7f1a761ac", "comment": "Malware payload", "value": "41262cc3846bd5913bb6746d3ab35a66221aa810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691608040, "uuid": "1e11f761-d21e-43b9-91a7-f1c8d27a7e9a", "comment": "Malware payload", "value": "670c7df7f21e69b4992a2c584061334ff5b026b9350b08de29c524f8073045a17b553b920857af2fbbf47b8ea218746c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691608040, "uuid": "7746c716-0e12-4d02-8966-9fdc6dc10fbf", "value": "T16BE208067BE94225D6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691608040, "uuid": "b67f677e-1b26-4a9b-a116-1283bd5837a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691608040, "uuid": "01287dfd-fff1-47bc-ad47-f36922f5f4a9", "value": "384:F0bUe5XB4e0XeOhbw0Q0mS03AWTxtTUFQqzFQObb9:GT9Bu9C55dCb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691608040, "uuid": "1b65045d-2fb7-4f68-86f4-c7644f296cdc", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691608040, "uuid": "c2416794-b550-436c-973f-b20095106bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691608040, "uuid": "2aa69c7c-1d81-4388-8d2d-3d42839a838b", "value": "bOMc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfa98ae-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1691602681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602681, "uuid": "3a1d83a4-8649-4d7c-a556-f590c73423aa", "comment": "Malware payload (Cobalt Strike)", "value": "61924fe3e9ddf5b3ca026575cd2d340f", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602681, "uuid": "0c2203c7-cea0-4a6d-82de-9a15f2853853", "comment": "Malware payload (Cobalt Strike)", "value": "d11d6fc860b3fc30b19004831fd789103eb27aa0b63c73cc5a37050169e37ed0", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602681, "uuid": "c9f72f22-3bee-406a-9a41-3b3257657663", "comment": "Malware payload (Cobalt Strike)", "value": "7649529423e5f2117e3aeb0a0d75cbb8b8e66020", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602681, "uuid": "d9c174d2-9cee-4439-8e5b-df865d82bc76", "comment": "Malware payload (Cobalt Strike)", "value": "4cdd3de1d05b4294124cf6daa0c32759986e570092345244dc7c5a9f66c7a686042f08aa5089431da5b03c70614c8026", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602681, "uuid": "fa1abbac-0a24-4bfd-b8c1-119c0ee46f68", "value": "T13E820B7FB64228E9C127D178C9EE2771ADF27022416B271F2FB8C6302E20979557D919", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602681, "uuid": "359c0865-6dcf-416b-a4e6-b48ecd80af30", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602681, "uuid": "0b9d0bc3-de79-4152-9d2e-aaefc1d3f2c8", "value": "192:jDMAe4Ckj19RZZ6wpSfu1bKcq5uHj7khBDSeKNH4n2UxS/R3BUbOj6kxiY:jDMAoKz6WtKEj7aBDiU2qS/5bAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602681, "uuid": "dc71321e-a7a6-4fe6-845b-40c0cdaffe8c", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602681, "uuid": "349068d0-f124-43e1-8bc8-fd4de883532e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602681, "uuid": "0a9d5d88-a9e9-4663-9279-55d5527530bc", "value": "artifact.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed9909f-36a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691580351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580351, "uuid": "9b18cb85-f5b2-4fed-a476-6824f6bf9bbb", "comment": "Malware payload (NetSupport)", "value": "a3ba188bfb83dddd2af270c4436c2d96", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580351, "uuid": "941a9987-94f6-4ee6-b34b-8c93e96e3ebf", "comment": "Malware payload (NetSupport)", "value": "d1e30d20e4c7e3f26f518c6f49b73aa78fe3e176a5b64fc84498435996e68913", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580351, "uuid": "70a074f8-9af8-43b2-9e15-53ba6f9aa1cb", "comment": "Malware payload (NetSupport)", "value": "58886ca3b0888edfb92edd0d523c7c6b71bafc19", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580351, "uuid": "46194ad8-b2ea-4aa2-962f-a2fc890dde12", "comment": "Malware payload (NetSupport)", "value": "fb31684b257ade4381b6786cc5cba922ebe2a2aa5f05abeaf823c99ea36d26a53b72a50f1925187dfac2aec1240bfb22", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580351, "uuid": "f8bf7f5b-ae7a-412e-8aa6-b39594c02acb", "value": "T1A3317E3372E8071CC2B15A3B68B5BA13962AB80DD50F4B8E32505EB81C1859CB955E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580351, "uuid": "71bbef74-c3df-4731-9bb0-eb262bb0ddb6", "value": "24:8NXTcaZsxqGt2N7oKqPaghW8O5qA+Wkp+/CWsyF7zIV0l7pEQeyTppTpZab/2XT:8dvwpSjN5ZDRzWc7iQ9ab2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580351, "uuid": "c2e52c81-65aa-418b-bc53-fe8745114587", "value": 1548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580351, "uuid": "8e717692-c4ec-407c-9384-0df512b51789", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580351, "uuid": "be37ff1a-4417-4b77-acc4-c3aedb24cc80", "value": "personality-upd.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab216611-36e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606624, "uuid": "8f4ce5b9-a7b7-4603-b1fa-032c5df0a9cd", "comment": "Malware payload (Mirai)", "value": "3e666d7845786eec54f1ae43963f82b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606624, "uuid": "c4dca8cd-12f9-4c38-9a96-480e35624282", "comment": "Malware payload (Mirai)", "value": "d2611656f426ec22c07993b633e3b345fb98039a48f31244a0f44e10a16c5ee1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606624, "uuid": "d7dc97ff-a193-4294-a8cb-99ee8fb7ade8", "comment": "Malware payload (Mirai)", "value": "3faa6d29eef3de80731d5abfa6b497fba151ff01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606624, "uuid": "0849159d-6ad1-4fee-ba08-f7741feadc4f", "comment": "Malware payload (Mirai)", "value": "a9d01fa54d50abda939bee0200f11abab028595eefe4c89e8777b533d81c284c75f37679d8206db02607b43d5cf96433", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606624, "uuid": "04223888-5e8c-464d-9854-08102f094ccc", "value": "T1ED3302626B6E2AE151B05777FC33EC1A629C17B89C6730963CF0661973C58064EF67C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606624, "uuid": "f801de7a-984b-43d5-8c1f-ebe5ec17a937", "value": "1536:69O/ZMAXIxNUk02TNLcPqF1aBexo4opKZbY:69O/ZNKyGNLGqFUFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606624, "uuid": "94479389-a498-4b64-8245-7b43ab1c039f", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606624, "uuid": "da827482-fd8b-48c6-9a5f-c02838f720e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606624, "uuid": "329c872c-9cfc-416c-8794-2c389a36a21b", "value": "3e666d7845786eec54f1ae43963f82b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3142eb-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691574951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574951, "uuid": "7c6f833b-c5d1-493b-a058-168005cc3cea", "comment": "Malware payload (RedLineStealer)", "value": "d40e4ede916273cd0c321b1f5f88b400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574951, "uuid": "20aa4b43-bfb8-4614-960f-306fa62e8bd2", "comment": "Malware payload (RedLineStealer)", "value": "d287a337945ae1802f910d24881039bf577a8765f6cb6540de6ac3bc89302e2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574951, "uuid": "1938016d-e005-4818-8e1b-a7625c96f55a", "comment": "Malware payload (RedLineStealer)", "value": "828a9263ed6ccc4327a758970020bdb2626b1576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574951, "uuid": "acf5cfa1-a758-4f7d-bc3b-f2c7ce2f7fb9", "comment": "Malware payload (RedLineStealer)", "value": "5163c7783fda47925c31a853b8aa929bfd8258740c1ebf1a7914761681d96e97ebaef0bcf6bc682055ef8fab196c1c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574951, "uuid": "a0b61835-22ac-4704-b3e7-f2b9b6553332", "value": "T1ABC41207E7E88472D8F61BB054FA07C30E32BCA25DA447761B869A5B0CB36D0E57572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574951, "uuid": "db575556-9b93-4cd6-9917-7a8b880c8e2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574951, "uuid": "a26bdf0c-1ad8-40a2-9ccb-05c05efad859", "value": "12288:8MrWy90SFXD6sN3Dhgjo67hpD3URWBYdo4U1ooi2:Cyf9V697hTBuoOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574951, "uuid": "b37a55f8-655f-4020-a9f6-bf321d0a31a0", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574951, "uuid": "729293f4-5ebf-4666-bbc2-674aae23a42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574951, "uuid": "65bd6e30-d28a-48a6-b27c-057bd1d878be", "value": "d40e4ede916273cd0c321b1f5f88b400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15c3408-3703-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691619976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691619976, "uuid": "dd2150b6-938c-4118-b5c5-3336d1b9fa54", "comment": "Malware payload (RedLineStealer)", "value": "03e4f34b8688988953e3095eda5cd615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691619976, "uuid": "12e52340-8e02-4df2-a0ce-7526cc85522c", "comment": "Malware payload (RedLineStealer)", "value": "d294f34079f7dd0ca83bff1bb51e276b477b445318d3b7f8c6a026f354a06d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691619976, "uuid": "58531319-d8a4-4d61-a836-0ff8d95ad34a", "comment": "Malware payload (RedLineStealer)", "value": "5caf47aec345e80424feeaad6daf1ee9ec9a7437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691619976, "uuid": "18c1bb20-d385-4078-9109-2479ea3eb9f5", "comment": "Malware payload (RedLineStealer)", "value": "ad2c59532bffa22ce60b82b8df5a49cc0e7a477c7aff52f253879f73d0389c481d0bfd3b51cad18f86f0702a2aaae6bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691619976, "uuid": "59a9584e-117c-4c8a-81e9-636e60c5007c", "value": "T15913F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691619976, "uuid": "ac5b15c1-5ebc-40c2-a5a4-a3d97c8b3735", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691619976, "uuid": "eb8c5eea-493a-4fc1-969e-6505a6c57b18", "value": 42295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691619976, "uuid": "e49b0009-c6bb-43ae-91ab-bf81d39ff7a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691619976, "uuid": "3cab4c99-84df-4c21-83c6-149027351ac6", "value": "03e4f34b8688988953e3095eda5cd615.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07f04e7-36b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691586071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586071, "uuid": "f2155ef1-fb5c-4154-a6dc-a5b06b0adf38", "comment": "Malware payload (RedLineStealer)", "value": "15c12113468fa297712c5122f89d017d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586071, "uuid": "a89e3bc8-5b13-495d-910e-895f4ec6c3c5", "comment": "Malware payload (RedLineStealer)", "value": "d34cfb0b005f7e7dc12206dc6f69ba664207e509791a55438e4b9c0d5410a7e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586071, "uuid": "d5130b61-00e2-49c0-a572-da13f1a98dc8", "comment": "Malware payload (RedLineStealer)", "value": "786b51d1a02fcdd9b8e2fc007f8c8bdc914e8efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586071, "uuid": "bc64efd9-d0cd-48f4-9620-e81aab7caa07", "comment": "Malware payload (RedLineStealer)", "value": "f74be4d315195300b13b3db01561e6ddaff90526a76ac5373d924d3055b770f82a7adb984f594ce2dbb3a32e736b8ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586071, "uuid": "7817b29f-6db6-4ac1-a20c-b5de5559d1d8", "value": "T17EC41347B7EA0036E8F227B014F712930E36BC75AD75539B2745AA4F0CB26D0A27572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586071, "uuid": "167c1e24-e439-446e-9f6a-02a5a79a5ed6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586071, "uuid": "e310b066-dc6f-46e8-ba67-127909dc9e08", "value": "12288:XMrOy90uMFJikHGoJx3JXYHuQuVf1RmdXS+hweqn:tyXM2kxx5CuQVXSKweqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586071, "uuid": "86eae391-c5f3-4082-91bc-426b690bcf7c", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586071, "uuid": "229e22db-0cf4-4eff-8ee3-b8bc6e645fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586071, "uuid": "d8adbb6d-505a-487c-896d-2a59fa4904ca", "value": "15c12113468fa297712c5122f89d017d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b20193-3696-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691572843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572843, "uuid": "d2d9e03f-70ac-46a7-ab7c-831e9297463a", "comment": "Malware payload (RedLineStealer)", "value": "7c8a14c81d3f3993125ae59311b79a55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572843, "uuid": "dd83d00a-8d1c-439a-b4a0-86b34c4bcf25", "comment": "Malware payload (RedLineStealer)", "value": "d4ab3b6fab08f3372df8939ac9d6134a5a4dcb9ce4f79e18cb0ed0c1b6c923a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572843, "uuid": "37d0f0c0-e0a2-4694-ac3d-5eb66af22224", "comment": "Malware payload (RedLineStealer)", "value": "f78ab33a58e7c7fe47fed17e7a6e04640f188b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572843, "uuid": "8986c554-e870-46e7-a371-43cb13db17e6", "comment": "Malware payload (RedLineStealer)", "value": "c173589ea1a4d1c4aa0eaab207913887624180abd04ea0e1c54e197bc67ff0a8377ae2781c94ca1ee1f74f6a4b312d93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572843, "uuid": "12ce34cf-42bf-452f-93fb-aace55fe8d1a", "value": "T113C41212A7E88532EAB527B01CF603930B3ABCB05D78435B2345994B1DB32D4E675B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572843, "uuid": "48ce7174-9492-4da2-991e-c7936c397f30", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572843, "uuid": "b35b58c4-4610-4007-9431-74d9b8eb1651", "value": "12288:rMr0y90HQiWQF5oAcb0rOoKFSxfG/ScSOl0h14Y0AD:LyydZOolzcSOahKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572843, "uuid": "385c6ace-517d-4e09-88fe-fba9ff1424ca", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572843, "uuid": "68772ec2-eb46-4066-b405-5192cdc742a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572843, "uuid": "1267022d-a13f-4979-8949-19eee0c301d0", "value": "d4ab3b6fab08f3372df8939ac9d6134a5a4dcb9ce4f79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e55814-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691603013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603013, "uuid": "8f98c9e4-3ec7-4d01-aa2b-68f3749ede47", "comment": "Malware payload", "value": "bf641d630d1a4f23a958c6b582737940", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603013, "uuid": "d83057f5-5a83-4eae-8154-e010e20feef1", "comment": "Malware payload", "value": "d6211ff31d125bc69005a99cc337af8acd9cb575eb0a2d9e5c396afc36e46f4d", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603013, "uuid": "22ce5e60-345f-45db-92da-ffe1ebbd77a5", "comment": "Malware payload", "value": "8cd69f1897f06638b13aecc4f17050e2c915387f", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603013, "uuid": "47c69b02-2295-485e-9a24-6b15219a92b6", "comment": "Malware payload", "value": "7ee1d47ec0f270dddf949386fc6e85a208058d98b1b303f6ebabac05757049050b1db5452c0fa39b8f14ab13a97c14aa", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603013, "uuid": "1beae44e-ca0b-435c-94df-2624fdd03c70", "value": "T154152375696CC7682080611ACEADF37C8EE9B8EFF2659082A04F85315F7C1752ED8D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603013, "uuid": "3cfe5148-e8c3-4770-bf66-ccc76d949319", "value": "12288:SGu4in0rotgWlFGg9QzM215mObq+l6pih6BXRfY5ddq6eLd/pKcsXzsyuoJoanR3:SGuD0UpagiIGBbnl1hGFYLkLzFsXpcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691603013, "uuid": "be1f1f1b-df4c-4ddc-a2b5-2d53829cce42", "value": 903205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691603013, "uuid": "0f510310-ad0c-48f6-9901-70daa92d4ca6", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603013, "uuid": "f490ef8e-faca-4cfa-964c-92d9b58236e6", "value": "nQUOTATION_AUG7FIBA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398ce138-36df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691604286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604286, "uuid": "2e100e68-7576-48f8-973c-a1a1395825fd", "comment": "Malware payload (AsyncRAT)", "value": "3500d4b2b971499632cf0a306f266cfd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604286, "uuid": "31a7539b-3308-432a-be84-2ba9f16f6b62", "comment": "Malware payload (AsyncRAT)", "value": "d674779e87fc5ee336f74f85a0fab74a06c74cf7e95af033700e6140539df97f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604286, "uuid": "3a73b01a-7794-468a-8eca-4fbad83d3051", "comment": "Malware payload (AsyncRAT)", "value": "fccd254666c5f3d45d905b81d466d133753a6477", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604286, "uuid": "9566b4fb-965b-4c59-8e2f-ad700cdd795d", "comment": "Malware payload (AsyncRAT)", "value": "dad7682fa42ac8fc46d21691f74de43d7adc90d4593e235c8b920eab2dc411ec2e9282c65fb1d87cae7066524cef2913", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604286, "uuid": "565da7fd-c076-482f-85ca-ba96fb3fdde4", "value": "T114536C002B98C966E1AD46F8ACF3950146B1D5772102CB5E7CC814EF6B9FFC64A523EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604286, "uuid": "95d81636-1318-4894-86a7-9339af62f490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604286, "uuid": "da20fad1-d1a8-438a-b4cb-aa748bcfeee7", "value": "1536:gIe8Lwzw4hQD7rDN8kYDxmheee/a8GbbXwzsbGItpqKmY7:gIe8Lwzw4hQD7r58kYDxmEe2GbbX52z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604286, "uuid": "b38bea68-70b5-4ed7-81f3-cd0c8bf25f20", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604286, "uuid": "2c5e66a0-81db-4472-8e48-663ec143eea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604286, "uuid": "3e84d8ab-6626-4b42-b994-0ef5accac7c8", "value": "3500d4b2b971499632cf0a306f266cfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75b6a53-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691599800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599800, "uuid": "69318efa-c6a8-4cef-8b93-eb01abc8bd8d", "comment": "Malware payload", "value": "b57257fa678c9fc3f5aaf139c508e69c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599800, "uuid": "b48a91da-fe66-4bc8-951d-befe9d41cac3", "comment": "Malware payload", "value": "d7275817cda3cbce7c42f8527425d6bf95e798d49f1e76b4d59767d6f0100b73", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599800, "uuid": "9f057c46-2b29-4130-accc-02fe59261fb4", "comment": "Malware payload", "value": "77e5b4bb25665d80359f3eb823a43262b71c316a", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599800, "uuid": "05e73a87-4673-41c5-ab30-2518b07a4ae1", "comment": "Malware payload", "value": "049c0361b791160abd50f17e5adf91ef3d211afdcd2c6aab757e4afbeeb17a55ad6efd9bb587fd7eaa60df7fe37c3cda", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599800, "uuid": "a8fde7a3-2841-4c69-9db3-6ef8c514eec6", "value": "T1EC55E0039D588B43D02993B8BD434EA91F1A2E1DA9C67AEF11537ECB7A703314D8E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599800, "uuid": "f309c4ec-cc2c-450f-ab85-c4942704f0f8", "value": "24576:MpcCRKKE+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXVyeixNwVMIR+QzXhJn3cjw:g6LwVMIUQzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599800, "uuid": "cb49d7f3-4957-4de5-97e9-50a88ba92066", "value": 1289216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599800, "uuid": "6b8e2519-54bb-40a2-b58a-9d97cbeb9cbc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599800, "uuid": "efd36c03-0986-4538-85fe-ac8bca2193f5", "value": "Swift ACC Reference A2300078.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ddd121-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691549137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549137, "uuid": "155fe7fc-3cd8-443c-a215-f3d6e1aa1155", "comment": "Malware payload (RedLineStealer)", "value": "aa1c91b866474035d353aafaececfe74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549137, "uuid": "9603acd0-26b1-4050-b6d0-517a958536f4", "comment": "Malware payload (RedLineStealer)", "value": "d7d18ac1183ea184a4e190bb4cb5cd51c60c048974339523dbcf6ba3d1a26746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549137, "uuid": "39c44ad4-20eb-4976-b1b1-9f8b37022f72", "comment": "Malware payload (RedLineStealer)", "value": "e5ab6796bef15deee1f4b5b064408bac52373dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549137, "uuid": "7d89d076-0268-4bbc-ac3b-e8d9512e2484", "comment": "Malware payload (RedLineStealer)", "value": "c1ac0f4dfe4d26c21e0e181d738ab72eb335f1090570cd89e781557bc30115e3764948e175c37e6c96a0fc12a985ee44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549137, "uuid": "8a314bd3-daea-4e69-8570-7b97f69f9dff", "value": "T16574F102F7D59032E9B1277048F702930E36BCE69D74975F674A994F08B2284E5B177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549137, "uuid": "d3ad464f-242d-4814-a12c-46e3d82cdb11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549137, "uuid": "a56188c3-4431-4f85-bd29-328d3e22ef64", "value": "6144:KKy+bnr+Jp0yN90QEeXSY4mcBunbDcumvYB2m6ohfX2dP3npeznLcvB23sIZ5:mMr9y90kKLBub9mwB2m6OfXEPXwPZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549137, "uuid": "d5a6f82d-67c8-4025-aa53-18fb2c7a15b8", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549137, "uuid": "d3360927-b7f0-419c-827c-59c1c9d5407d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549137, "uuid": "a1e521a8-d27e-4078-bac8-45b5f8d61bc1", "value": "aa1c91b866474035d353aafaececfe74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a515a907-36eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691609620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609620, "uuid": "13a2c35d-e247-4e21-bc75-b518d08eeefb", "comment": "Malware payload", "value": "37236d6f64c3cdcc1edf6ce53a30c7e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609620, "uuid": "68b5575f-a782-4e44-8f3a-2bff737aaef4", "comment": "Malware payload", "value": "d8682263956304591cb047e7999c995d07a09177b5965aa43fe69ce84fd257a6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609620, "uuid": "244df592-54e5-4b8c-9bcb-fb9863c0ade9", "comment": "Malware payload", "value": "d315fb54f42ee2bf555edeb963c08ec6846438b6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691609620, "uuid": "437f33e4-40d9-42d6-88a9-61c31e551926", "comment": "Malware payload", "value": "69aac70c8f4ed394624aef49d1a7fd17488dad5a2f31cb7414283c0ee48d64c3e042c35bfa9e37d20c33ee86aa36dfae", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609620, "uuid": "c8ebfd84-c24a-4ae3-9a7d-4eb4317cb6b1", "value": "T148463364EF20246CC13E24B8445F158399BFCB6BB325895F2816F7682E175D622C37AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609620, "uuid": "25c408d1-72ed-4d60-aedd-28a4c0c48b15", "value": "98304:ieY6pMsApE6M8fMfGf4spvBDCT9yzSs4KkEsqnBl1+LkC8rnOjFxDWqkhj2dPxwR:pksAi6MMfJW92loEsqj8kCOuFxDWqkhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691609620, "uuid": "72c5d01b-9a38-43ee-a4b1-9f62e4deaa2f", "value": 5830655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691609620, "uuid": "f4b87af3-c0e1-4303-97c4-86c95ce294ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691609620, "uuid": "841a8165-9b55-4d44-93b4-826f07993616", "value": "37236d6f64c3cdcc1edf6ce53a30c7e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b342e1e3-36ae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1691583445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583445, "uuid": "a6c86637-1195-4734-bd25-f5b0d00b2486", "comment": "Malware payload (Smoke Loader)", "value": "c84ded775d454fc674c6385a58a8112d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583445, "uuid": "c50b23dd-e041-4166-9983-47e0094cdf09", "comment": "Malware payload (Smoke Loader)", "value": "d8bdb32cb558ab6bfac8f7b3525475297e90779b55e437222ccd77ff15b8b8ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583445, "uuid": "dbb13b37-96f3-4893-91c1-029082603d16", "comment": "Malware payload (Smoke Loader)", "value": "ce5e15cbeb241bcb62780824df8889e8d0386d35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583445, "uuid": "a9018301-ad49-4c8a-b824-19acfa97d82f", "comment": "Malware payload (Smoke Loader)", "value": "8ac230ac07e345b97bf74da9968a14bc5b8661eea04e7076772967971b0029035eacda5cc27f5148c4ae94e8087bc142", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583445, "uuid": "1a90b28b-f48b-4b67-9bd0-d4511e7c8b16", "value": "T1F2642B1362F0BC72E5264A329E2E85E4360EFD91BF55379A21287E2F4571DB1C6F2702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583445, "uuid": "4ffc86f1-283f-48a9-b975-30e53df66684", "value": "8e25d4d631d3b08e523de592552d01fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583445, "uuid": "9b94bc83-7ff8-4dc7-aed8-4fce801b4749", "value": "3072:h1PbkQZ5uZhLib8HmWxo0kSDAZW5bFERbdTJkmGTj3YD5G:/bk5Msm+kScM5RmbdTemGv3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583445, "uuid": "c04c56ba-9f7d-4062-8310-ffdc8b76ccfe", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583445, "uuid": "b3096152-8e04-447a-8b4b-287e6138d6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583445, "uuid": "c2b1ae26-5c81-4817-b25a-f7889374272c", "value": "c84ded775d454fc674c6385a58a8112d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0164e7cd-3687-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691566396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566396, "uuid": "30e3ffb7-5485-4257-a8fa-b25fac6a2085", "comment": "Malware payload (AgentTesla)", "value": "023724470a84b79a9efbde752322ddec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566396, "uuid": "db71847c-5429-40e4-a3fe-beb946b1330f", "comment": "Malware payload (AgentTesla)", "value": "d94631983f4b432da3c6ad46185145e0e90ac651c39d07d44bf0eafbd7509b7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566396, "uuid": "6ba31fe4-d6d2-48f4-9daf-02755502ce3b", "comment": "Malware payload (AgentTesla)", "value": "692e670efba456eb81d99d9ae04f4dea8a44d481", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566396, "uuid": "3861890c-b6a1-4c67-a902-36dc730deaf4", "comment": "Malware payload (AgentTesla)", "value": "efe13cebda493e0cf0e856385bc680c6843228793e45f1d98eb3e573920d9f16f047d85cd3971a250eb767ecf551f87d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566396, "uuid": "32a18c4c-0c9c-45db-b4a1-6990b41ea31d", "value": "T137D4121A713B5EABE17846F25BF1054583F6626D542AD6CE2D9520CBE0F2F01D900FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566396, "uuid": "57ad286c-ae98-4129-9772-1a0f339eb3aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566396, "uuid": "6c3d1f43-6a15-4f75-9003-6730611798a2", "value": "12288:9OSLYTyv6CYBYCY1CbQsAfErtpwjA4ksxxb1TChR4:M6YTdnYJsAfc85F9TCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691566396, "uuid": "9a23a58b-40d5-4a3b-9323-75f0c29c24b6", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691566396, "uuid": "4300ce5e-e882-4dab-9735-283fdde57e37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566396, "uuid": "b609e697-259d-4a31-9ec3-861a890f87d7", "value": "023724470a84b79a9efbde752322ddec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a703ace2-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691599745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599745, "uuid": "b83a89d7-c0a4-44da-a60b-21f1caaf9e87", "comment": "Malware payload", "value": "47744907cd9c75469fc03468cf36c56c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599745, "uuid": "30b81f10-5412-4cd7-85d0-4cab86d71c0c", "comment": "Malware payload", "value": "da020c59571292296777a163d94a6d474059c8191dc4f2f013e0db537ed9c567", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599745, "uuid": "2fa4a643-cacd-4e69-aebc-6c43108644da", "comment": "Malware payload", "value": "bd4834ea090ab6d427a56d9dee95641ea8ac87a0", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599745, "uuid": "b97708f1-aee5-43a7-9b83-97ee7fc697b2", "comment": "Malware payload", "value": "8e7564c2335d795edae380ac5af3e52e9626d4809c9c7a6f87e3c4a874c1930921b8f88445990df0acb8dc266c6b9e1b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599745, "uuid": "54aa51c7-7b30-47e0-8899-7f25294948c5", "value": "T12805D0039C588B83D06847F8BD434EAD1F093E1DE8867AEF50627EDB7A706254C9E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599745, "uuid": "30be5881-8e11-4243-9d88-78e40e092487", "value": "24576:CP6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXfceixfSQR70nJPVobnrpVUu:66EQR7QJ4PU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599745, "uuid": "b6e18c39-72d8-4ea8-916d-b418e282a70a", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599745, "uuid": "4dfb63ce-3230-4130-88d5-17012a00ffcf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599745, "uuid": "0a0ff354-ff76-4f19-83e8-438badfa3e63", "value": "Facturas Electronicas1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881c28ed-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602700, "uuid": "fe9c8ac8-213f-4d12-acb8-3207a40c38a0", "comment": "Malware payload (AgentTesla)", "value": "2d7d9dac8bc30f3af2c71cd22526fc84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602700, "uuid": "4c5782b0-c66e-4abe-906e-8c2f7f7f2303", "comment": "Malware payload (AgentTesla)", "value": "da2f7d93f1133c9eb2646888530e91b3123a8e30584b1a3fb621b229d6697abd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602700, "uuid": "50c9389d-9001-495d-821e-36b4896a3529", "comment": "Malware payload (AgentTesla)", "value": "1e4d052314f696d4ebefd30b4f4bf9fdd9337212", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602700, "uuid": "285cce43-85e2-46d4-b47c-ce8ea5cc36ca", "comment": "Malware payload (AgentTesla)", "value": "6cfd7ec4215fc131b0480921665eeba5edad568e5ea6d40701535f4861fb550fb10d42f7e8f87d2db8b0e3a3dfac6bd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602700, "uuid": "d269a7e5-3c67-4295-a36f-e6a46d0ee5a6", "value": "T13BC44B4003BE48E1F9B7AB520BD914F9AF23B1C41D3CBA762968961E63FC9441C953F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602700, "uuid": "e25dd56f-adc3-4af1-9891-9cadc4cc4f6b", "value": "1536:c+tCWIfgiB4ptqFXADFzVPq+/w90ayfd7CeNIYwirBJZpqvKHNrnXy2u0L3J2h3:c+tCvfgiOzqFQPq+/wBiwirBRxNj52h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602700, "uuid": "4a1a3662-b1a0-4744-9930-cd4385920259", "value": 554776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602700, "uuid": "6f992598-d03a-4969-9346-651ea699d600", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602700, "uuid": "b1ab2f00-b582-4603-9988-18dfabd66c73", "value": "DL86997055.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f87fac5-3698-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691573748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573748, "uuid": "30d8b8a2-45b3-4b91-89e7-b7f135e34ab9", "comment": "Malware payload (Amadey)", "value": "54b6085823688c61e367e7110a5118cf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573748, "uuid": "e741cbaf-522d-4ba8-acaa-dc87e48c0d98", "comment": "Malware payload (Amadey)", "value": "dc73c788b655c9b87ba08482135865562efdc22ede7c6158c61b3f9c9822fc18", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573748, "uuid": "cd3c6919-d493-467e-bfda-2662eea65afc", "comment": "Malware payload (Amadey)", "value": "a91a6ff3f7bcf730472e7293a1138a98cd6bdec0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573748, "uuid": "003db548-d503-4292-88ea-4ff759d0294f", "comment": "Malware payload (Amadey)", "value": "991ece50defa280df6a12e632dafcead874db7a6786a2e66b03d3da565c9576eb64c07ee8fba6941115d2567140ee221", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573748, "uuid": "0e4746d6-90b2-433e-b09b-a3ef56073002", "value": "T165C41212F3E99066CDB637B01CFA13930B377DA1997583AA3346690E5D726C0E57232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573748, "uuid": "e2a30323-4673-410b-b52b-856a0df32e11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573748, "uuid": "d0f31f25-ff9a-49f4-ac97-bd1d9d8674f4", "value": "12288:8MrVy90CpiG8901CVhSQdfl6E8noSKatBhnMq1N9:ZyvAVhSmdz89FMQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691573748, "uuid": "b0977d5d-9be3-4f4c-9299-d378ecd5bfb6", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691573748, "uuid": "f7ed476c-5b2e-4303-8d1b-776a17711e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573748, "uuid": "7e64a6a6-8098-4d21-8fb4-14e745ef1627", "value": "dc73c788b655c9b87ba08482135865562efdc22ede7c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3226bb-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691599618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599618, "uuid": "b285f597-c828-4cf7-b7dd-d98e11c68c6a", "comment": "Malware payload (RemcosRAT)", "value": "65234c47f590f09aecca2aca58ff169c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599618, "uuid": "50d5b360-5c9b-48b8-afe4-a2f02624b3c7", "comment": "Malware payload (RemcosRAT)", "value": "dc99dacdbd53fe4163b9e32e7ef490b354d8c0c81089614ceae1ecada11263bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599618, "uuid": "91c640d1-877a-4479-9eca-4671f581800e", "comment": "Malware payload (RemcosRAT)", "value": "21f3a5df13468d304d2dd2591e546eb17f6ac680", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599618, "uuid": "d997fe0a-b372-43e8-90c5-f92436d139f2", "comment": "Malware payload (RemcosRAT)", "value": "01637099d14202a8054a58fb3633cce033009beb8b5b9e459956771b32d466bf84175bd80331276c5ba66a99cbd75c50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599618, "uuid": "3b0137f0-ed7e-47b4-bd39-c41fb158f038", "value": "T1FB25BF76EA925C37E17314789C0A5A547C2C7FB30638A446BBE43E95AF3D290363C366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599618, "uuid": "f0894e30-917f-4827-a54c-273b71bf93f5", "value": "bdf6349f4337edc78aae879092566618", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599618, "uuid": "34e7b10b-e5f4-4b02-9e40-03be8ace9526", "value": "12288:q+V0OGY20hP4SpWD4XIiIlYqHrvd6FE3TNDJrYb0fZp0B0Yi7fLssVcgbbFWWRpX:qWAs6lD4XNVQrvd/DFR20fI0JzR/R4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599618, "uuid": "36a2c3fb-c135-4b5a-afab-b5be10ae0fde", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599618, "uuid": "63d06723-9949-43fc-916f-84d3a8b53836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599618, "uuid": "07e49d3b-996b-4e1f-a9c9-33b04f1f65c5", "value": "65234c47f590f09aecca2aca58ff169c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766d8cf5-370b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623286, "uuid": "f280a440-bcac-4a73-a481-3f295fecf7e6", "comment": "Malware payload (RedLineStealer)", "value": "2af0ccc411507702a1d0b6066bb1e22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623286, "uuid": "f8b5f85e-f54a-4cc2-9b17-954b80b08f04", "comment": "Malware payload (RedLineStealer)", "value": "df10aa95562e7c9b515a82728cd003236354fda81e3d348bbca8a120e07efe0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623286, "uuid": "4057a6fd-d4b5-4aad-bd10-3be5f7b135a2", "comment": "Malware payload (RedLineStealer)", "value": "774121933a011be5d2ce21ed6aa4141ef732538e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623286, "uuid": "4a2c7803-7d07-44b2-9bd4-1f14d46ee15b", "comment": "Malware payload (RedLineStealer)", "value": "8ad8a01a50966380d3004383acf10d00334967858d31e2e949eafe389b2b28560844696415df1cce0df160353d150dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623286, "uuid": "c4e217c6-d03f-45c4-9d58-db0a8dccf889", "value": "T17CE41292ABEC4432E9B52BB00DF507E31A357C2158B5962B5646F85B0CB3BE4F831727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623286, "uuid": "fbba611f-de1c-421f-8155-59ce117a8e41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623286, "uuid": "89ca365d-315b-48ac-8682-a6073794259c", "value": "12288:kMrVy90A2kOylHezf2J64p1IaSVf/pgK5vMDSQ/133N8t+sOREwZ3ucMXo:ZycyW2J3bIaQp1OZo+Y6+p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623286, "uuid": "83b4888a-5fb0-4177-85ab-c7b31572873d", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623286, "uuid": "5f9f6052-5eb5-45f5-b1ea-8087863e6c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623286, "uuid": "17b5e104-b56e-440a-8de5-7c9ed95c3f88", "value": "2af0ccc411507702a1d0b6066bb1e22a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da00d1b4-365e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691549150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549150, "uuid": "2398e723-6541-437e-806d-46bb0f39b7d1", "comment": "Malware payload (Mirai)", "value": "b3f5ce18be425a4122268abb250a9f15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549150, "uuid": "bcc78419-b2dc-41bf-bd4a-d77c2a249c63", "comment": "Malware payload (Mirai)", "value": "df5316103bcc440f3d168c9ca3937a09dc83cbc5950204407f6152222c9fc46d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549150, "uuid": "e928a4e5-766b-49f0-a29d-9027093d03f8", "comment": "Malware payload (Mirai)", "value": "f73296ead1625db810185b139e87837382425788", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549150, "uuid": "837efd11-da5a-4448-8ab4-ee2d6aa44589", "comment": "Malware payload (Mirai)", "value": "2d17baf6927250ad2a120d19f27408e78e2231005876a6a749c3cb69f2e9ac33eba3856bb04637c876da04a248a29dd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549150, "uuid": "28b0c457-d8f0-4961-b60e-25bd8236f194", "value": "T15F533B99F4028E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549150, "uuid": "40a59121-687c-47f6-a1e3-a4269b39c91b", "value": "768:Ge4gpsM204GEkRbj3eX1VnQiiQthc3gFHu1eu48B8vB6J7EzNfXuuJpoz4K3p:Go3EkRbrOSiPDFu1X48B2SEzNfeuJwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549150, "uuid": "a5cb2778-d200-4f71-bf81-673f567e59be", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549150, "uuid": "3d3a333d-f7d8-4084-bbca-20e2b5e35a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549150, "uuid": "a956aaad-d10b-4fbf-a0d5-746387cee456", "value": "b3f5ce18be425a4122268abb250a9f15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1496e090-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1691599500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599500, "uuid": "46000c36-4daf-4e3a-bdd4-0d45a0f810fe", "comment": "Malware payload (RemcosRAT)", "value": "ed8efc1acdf865223c780f1dd9071bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599500, "uuid": "ef628028-948d-4ede-b323-cfd4ba99e4c6", "comment": "Malware payload (RemcosRAT)", "value": "dfe0f95ffc9ad74d75e0c2089a34fd96594e47b9c635eb5c884cec8f1d20ef0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599500, "uuid": "ff2b5f84-4bba-45e3-9069-2ab16ab71da5", "comment": "Malware payload (RemcosRAT)", "value": "de5917d558ebdd8135b5987bdc414f81304603ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599500, "uuid": "5ddc2113-0c0a-4099-9fa3-ad0963ad37e4", "comment": "Malware payload (RemcosRAT)", "value": "c38389d340061e871f9b09c3ad3000f0f7ca8dee311c16122a290f67bc2b4d130c1181bd15de963615d13cd92291a2e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599500, "uuid": "b5adfe12-34f9-4185-b99a-68c93091d1c4", "value": "T15345F1087014C649C6FA11B6EA55A4F80BB7BD21E932D20F9AED3D6F3B732164C01F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599500, "uuid": "b77cdd01-657d-4a21-a039-8c50caf48a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599500, "uuid": "0418000a-6d0f-4662-a75d-3812f22d97f0", "value": "24576:qjDik1YB0o9StYbwwI+mql8iUqszeWhcchwDINbm38VfXhW:qjDikqBV6YESmqqosLc2wDg+8VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599500, "uuid": "1aa8bf6a-600c-4faf-b7c1-3d3a1b4a4885", "value": 1198592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599500, "uuid": "67ed5992-4c4b-4835-b001-774772be4ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599500, "uuid": "f1036946-350b-434a-95f6-009031218122", "value": "ed8efc1acdf865223c780f1dd9071bde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d37ee5e-36df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691604292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604292, "uuid": "d22eb458-f432-4e3f-a0cf-b144c8e124b5", "comment": "Malware payload (Amadey)", "value": "1a5edff7e8b2982fc6a31c5f44e71ce2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604292, "uuid": "481097a7-c1df-4021-bbcb-99012f20be08", "comment": "Malware payload (Amadey)", "value": "e001744f90c4963af16f997f549bc7777a25e1d9834f208ca688b7c7165db9c7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604292, "uuid": "54d05459-edd3-4ace-904d-df16ef38aaa8", "comment": "Malware payload (Amadey)", "value": "bceea36d1b4ea44b9d2b7d5bb206638764bf9742", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604292, "uuid": "74adfbb5-25b3-40bf-a5d7-e4e6205ee1b2", "comment": "Malware payload (Amadey)", "value": "0746ae75b2f1fec5155f437a062268ff35e0d09b205ce5db6a2cc531fc25864f9adc300cde48548b894214e4b717d8a8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604292, "uuid": "508627f0-302b-403f-9799-eb26f6fdc721", "value": "T14F3408557812C032D56061762DB5BFF2C59DA828ABB049DB7B800F77DA112F73A70E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604292, "uuid": "dca85a96-b2cf-40df-9668-bfd2e978ce70", "value": "698e68059e2b8538f873da69a2766d48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604292, "uuid": "4a8a53db-8702-4e7c-86a3-a2c9ee10503b", "value": "3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604292, "uuid": "b29baf7b-64fd-48c0-ac72-2256e47a1acd", "value": 241243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604292, "uuid": "c1b797b9-846d-43a5-8831-afec9f65d07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604292, "uuid": "3e261dab-cd6b-4f90-b82e-f1465067b880", "value": "1a5edff7e8b2982fc6a31c5f44e71ce2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc1b2b6-36a7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1691580349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580349, "uuid": "4eda80f8-52a8-453d-ba18-595e9e23fc50", "comment": "Malware payload (NetSupport)", "value": "3529ca64cce888c517e9923f305293f5", "object_relation": "md5", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580349, "uuid": "d7749947-beb4-42fa-9b71-6a687760be25", "comment": "Malware payload (NetSupport)", "value": "e136ba37e3386e6cef8d1cdd1fa81c1859cfdf3fbd24c17efc40c9379a46c672", "object_relation": "sha256", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580349, "uuid": "82c8045d-3b04-4219-b5e0-84d47e5d37d1", "comment": "Malware payload (NetSupport)", "value": "ecddfb559682c7ff13daec3fe1326f5961f91ad3", "object_relation": "sha1", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691580349, "uuid": "c811ec20-d835-4d84-a982-6b99ea62cd4c", "comment": "Malware payload (NetSupport)", "value": "19849a2a78b038fee1892796b3ff9dd1d89c0925af0a334347ec98d17f61ba24f0940ccccaa37aa80b29ed8452c8381e", "object_relation": "sha3-384", "Tag": [ { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580349, "uuid": "08a0c9cd-1dc9-430b-8ce1-a924bd81f175", "value": "T148C08C50851ED865C02B0A1A8909CEBCA82311CA316ACDB046D4174CEC434695F8A4CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580349, "uuid": "49efbc3b-2427-4efe-ba1d-cafc976d293e", "value": "3:HRAbABGQYmimiLXIhzKEgZUsCo1YSo/QJ+SoIvyYesbBSn:HRYFVmizLXczfjSoIJtRvyYesbBSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691580349, "uuid": "d291ffb1-e516-446d-9bb5-683fce594e88", "value": 149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691580349, "uuid": "d074dad7-62bf-496b-a9fd-0515cec4ca03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691580349, "uuid": "0b7c4791-9f01-4d21-bcdc-0fa7ae56ca90", "value": "download-EN(local-upd).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33769b87-36d6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691600410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600410, "uuid": "0abdf47f-6b49-4158-b03f-ef85725930a9", "comment": "Malware payload (RedLineStealer)", "value": "f432c4790360e967dae29101272bc22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600410, "uuid": "0235c1b3-8030-40ee-af10-526e036b16f8", "comment": "Malware payload (RedLineStealer)", "value": "e1d680bc0112e599878b0c7fa09c89082d4d2d8620ed5e1d3a697083741c13dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600410, "uuid": "423ff2bb-3bd9-4c5e-a998-64c749f49829", "comment": "Malware payload (RedLineStealer)", "value": "fac99d075113f509c6f83d2d64b780e27e5f1526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691600410, "uuid": "c5bb4e37-5793-46e6-892e-18d3c1bac9e1", "comment": "Malware payload (RedLineStealer)", "value": "a4304f4823bc2e5f65e568db4a3b08474abc952c8721b9d9c97027bd0b172abb118196e08574af37df0be19383d55463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600410, "uuid": "190fca0f-29f4-4b82-8d39-f9619c47e7a0", "value": "T10364F1227AE2D0B2C59B11304930DBA16FBFB07165B481BB3765067EDE703D15BA278A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600410, "uuid": "88281786-ca68-4711-ba1c-ae53d78dc67c", "value": "21e75c39e5b8b26ccac618e4f1755b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600410, "uuid": "c9efd940-b2e9-4fae-91a2-ea50e88362c2", "value": "6144:WNPvEcdLxy4GIOIB1KawJtsoIcS8YpuRlCHhKFsPOkFELfqP:WNPhnGIOIB1Kaw3DdS8Y2lCsmPOMEWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691600410, "uuid": "df667d5a-e55a-4570-929a-5701a24a56e9", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691600410, "uuid": "08ca1cac-bab0-45dc-8c25-e1bf0ada1932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691600410, "uuid": "6409d213-bb13-46aa-8100-13c9affb6f33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b479bff-36dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691603001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603001, "uuid": "c0d93a89-ae4b-48db-95ac-45f16f86dcff", "comment": "Malware payload (AgentTesla)", "value": "8b1f08edf534c44ce38afc994fc04702", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603001, "uuid": "617f4ab0-ed09-47a8-b57d-7d4b71dcced1", "comment": "Malware payload (AgentTesla)", "value": "e1dfa20210b95ab54c97edfb1ecef7a381c60e337c912242642008851f0bcd57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603001, "uuid": "77326cac-5826-41a2-b736-12bfc0a06dc9", "comment": "Malware payload (AgentTesla)", "value": "2a1dfab392ab42e2bf9e10f1a968e96b952ad561", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691603001, "uuid": "f29bfed9-06d2-46f4-a4be-c67e80eb5530", "comment": "Malware payload (AgentTesla)", "value": "7bd4bfaeba55dc38df07f8263c1d81b970161d3ca1278f9dc2165fc0db806cd226be442c5ae7b9a4ea0f6c70ca0b8ca5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603001, "uuid": "6dcb6c06-1940-4108-91ad-2132bbcb6e6c", "value": "T12DF412FDB2FB1D75C3295632D6A2540513326B0BA163E34F0A4422E9491BFD3A356ECB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603001, "uuid": "8daf0710-56cc-4196-95ea-523c6fbafae4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603001, "uuid": "ce7eba6f-d16b-4fae-a847-cf81babef83e", "value": "12288:43GGTIYlV2UwwjIkP5k+G0MB32g8LL+xQ6h4n0gb/ltOHESH9vnbghKU9IoKaRd0:43xIYlVNwc1XXMQJLL+qr0q/WH19vnEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691603001, "uuid": "678b0650-0dad-4590-9a05-79346cf84e7c", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691603001, "uuid": "6345e500-3236-40d7-bf96-0ca8c33168dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691603001, "uuid": "621b116f-d597-4e24-b174-e01201a52707", "value": "z42uDQovoFVvxZt1Xd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe835c8-36e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691606276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606276, "uuid": "4a3e1496-6730-46eb-afdf-2644c3a8346f", "comment": "Malware payload (AgentTesla)", "value": "a4068080e979a1fee7bce6baaec0f5f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606276, "uuid": "822cf3cb-ac31-48d7-8865-7ab976049b0f", "comment": "Malware payload (AgentTesla)", "value": "e227cac009c4c07036de567a0acb34cb3ad5de4e60015dabdcdcfc5bf24791db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606276, "uuid": "959cb461-044e-42c3-8be3-861053465466", "comment": "Malware payload (AgentTesla)", "value": "76a35cc8a849a765003f4bae24e46021459622cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606276, "uuid": "c854523a-c824-4915-81fa-5357738e20fa", "comment": "Malware payload (AgentTesla)", "value": "3deb7e7142b531c421ad476ab9d89ab29e82d984879723820ed76cf7b14d31dc8292d7b966ff6db07b540cf80d828dc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606276, "uuid": "52b5c8a2-6712-4157-aad3-94c229cdf6b9", "value": "T17415383C14296E8CF3A586FCB6748CFF17A5692F90B7F9F3884CA4D706A97D04502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606276, "uuid": "f86ae2df-2a93-4b73-8784-5adbca6f65e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606276, "uuid": "eab45046-6139-420c-a159-6abf3b7e6f30", "value": "12288:tEYKspEOSLYT/YkkoeLfHRFCTcVEeU0yLXKv2CpLTlWK76:tBKspEO6YT/YkwLfx4Tczy+v24l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606276, "uuid": "e6c4ad96-847b-4440-81da-f5406dcada79", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606276, "uuid": "03902813-3803-4fcb-b1bb-a7aeeaccc06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606276, "uuid": "f1959473-eb40-4b3f-8fb3-8fc549363845", "value": "a4068080e979a1fee7bce6baaec0f5f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28267440-370c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691623584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623584, "uuid": "99563f19-2c57-445d-8197-51d07207883c", "comment": "Malware payload (RedLineStealer)", "value": "d85471d505d63d2540e6b063479f826f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623584, "uuid": "d651a940-47be-4d58-ba19-a7d4136d0f89", "comment": "Malware payload (RedLineStealer)", "value": "e2fe4f3a5d56e5600b1aef04f2949b1723e9ac4e285a426f62f26c785f13130a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623584, "uuid": "2adecec6-1fc7-4326-8965-a811623b7bd4", "comment": "Malware payload (RedLineStealer)", "value": "2eea5f8f51415080ebe671b8f76b3fa4b7d6352c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691623584, "uuid": "700b95ee-4eee-478f-bb4b-5ad038d85090", "comment": "Malware payload (RedLineStealer)", "value": "3aa2eb808cbe7fb72250d13a9013669fd7a959bfe4668f9dc9e0bcda2dcc834d6842f84a04d9ba19252d24648774fd6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623584, "uuid": "9aa85395-029a-4298-bf07-c374fbbae8b6", "value": "T164E41246E6D96133D9B61BF019F213C31B357CB16978862F2385AA0E18B2651F63633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623584, "uuid": "389f4137-6fbd-4583-8101-24fdd2193501", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623584, "uuid": "d433b9ac-2797-4114-ac6c-8209e7df67db", "value": "12288:oMrqy90FaWmK51M1Mx32oqkG9sYrpNy3gkwAM1gT3xATIOej1GU0/:CyMh51MWx32oqMYNugkpec/ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691623584, "uuid": "2bcabb81-64e9-4210-96b6-e3e82f0cc4cb", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691623584, "uuid": "f6f7a669-b0e8-44ac-9bbf-fd07df0f505f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691623584, "uuid": "fa43124d-88e7-48d4-acf2-3c449408ec13", "value": "d85471d505d63d2540e6b063479f826f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e197f5bc-36f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691614017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614017, "uuid": "9c04e1a6-0e5e-4868-b15b-fb3ea7369609", "comment": "Malware payload (AgentTesla)", "value": "14981bd4e07fceaf3db670c4bf0f6b03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614017, "uuid": "eb9941fb-0e4b-43be-ba80-8c75c3f16e23", "comment": "Malware payload (AgentTesla)", "value": "e3699bdedcf4bebffc1e2e2af639da53dc9abd0e7bcb4e917def61a01a880b69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614017, "uuid": "61ff49d0-0385-4e95-b335-df77314fee03", "comment": "Malware payload (AgentTesla)", "value": "6a67a4c9435d8dfda53159979b6b241d22540977", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691614017, "uuid": "4694a5d7-4130-4d5e-9518-0d3e37a2099e", "comment": "Malware payload (AgentTesla)", "value": "ea0cf0cf9db05b6a394051c94a3e7b49fef12ab231131400bfde6bd5dc8e4e051b7ba12267f8ec2d7a89195cfef61099", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614017, "uuid": "2c83c27c-567e-4d28-bb65-42ed89e221b0", "value": "T1FEE402FDB2FB8D30C2A91632D2A550011376B39F95A7EB0E055822D1992EFC68356FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614017, "uuid": "3d79cde3-85cd-4dd1-8e0a-8572a7e56dd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614017, "uuid": "6c3b9b45-6041-4aad-a169-41735e4b5a0a", "value": "12288:JLgGGTIYlV2UwRXPTpMiaJQNsZ88L9XTw36CJcOCgL2TsQTVS7lNE:JgxIYlVNwR/BNs88L9Dw36yf2TJS7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691614017, "uuid": "6dbf3be4-36a1-489e-b6af-02e53db36a8d", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691614017, "uuid": "11fa257b-5211-4f50-ae27-319f1a7bf57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691614017, "uuid": "7e72d4de-0a6b-4fb9-b987-dc53c4dcb2b2", "value": "Cotizaci\u00f3n_0082511.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e3a6ee-3699-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691574349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574349, "uuid": "09f9e580-c2f5-48c8-a47b-4b1e6d1e9c71", "comment": "Malware payload (RedLineStealer)", "value": "19211dfa78610baf3aaf8e64cc018e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574349, "uuid": "b60cdf70-001d-40b2-81b9-38d5bab3aa3e", "comment": "Malware payload (RedLineStealer)", "value": "e37138bdfe1a29e4565646f8a19dbcbc9d9d0158682c35978fabe691eaa474db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574349, "uuid": "9b7efecd-0f6d-4e11-b425-b73750af3da0", "comment": "Malware payload (RedLineStealer)", "value": "3092f97a7162ff2fc72008a6ff74f5d3a364cf6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574349, "uuid": "82e69fb7-8464-4030-8647-8f0be6f868cb", "comment": "Malware payload (RedLineStealer)", "value": "6d116b472757729733420ee4079d12052d86b078fbd925cd3401216a86884c5698618730e42f6a836dd34484635598ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574349, "uuid": "07786df7-6abf-47dd-8438-44f0bb873f69", "value": "T141C41263A7E55173D9B107B069FA03D30B39BCE5AC3983273751A91E2C72745A83272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574349, "uuid": "7b26e3f5-035e-4f7d-bb75-28df816fa3be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574349, "uuid": "42d7d1a7-12e5-41e4-b827-67a5838d6f87", "value": "12288:sMrAy90f7eBDv8yX5in9UkYZKwJiziyACyRtd4CG:ky7BQM8nGZDJVC0j4CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574349, "uuid": "f96f2c93-a414-4846-b1e8-1667b2f32f5c", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574349, "uuid": "61cdd9ae-e463-4077-85cd-cdf5ff85d03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574349, "uuid": "2ca98b91-64d7-492d-90ea-6310d2138d05", "value": "19211dfa78610baf3aaf8e64cc018e1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d81e4c-36fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691617806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617806, "uuid": "d1ff1adf-e391-4862-84c3-c6353eb63477", "comment": "Malware payload", "value": "f089a1e6850683c604cc68f2e2baf4f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617806, "uuid": "ae8990ce-187b-4190-883e-d079b270a723", "comment": "Malware payload", "value": "e42169df49c408afd751e3e2c195b9d2635222cc47612ff777d9d555ea668e0e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617806, "uuid": "874d7aaa-374a-42b7-abd2-ce8db07953ae", "comment": "Malware payload", "value": "ec9da53868f40c8e3f32371fea2a3da00218417d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691617806, "uuid": "0a663571-acb9-4b38-810a-a94e7ea590af", "comment": "Malware payload", "value": "60c3bbe9a3a2122f8ce5adbe381fc64d30be956cf29917259969bfa1eedbf4d5cf9fc901186ba506483df5359d7ea3eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617806, "uuid": "14c38574-aef4-4253-9564-b83efbebb78d", "value": "T1EE43D655B8825A6BC5E423BBEA6E518D3371A3FCD1DE3217CC111B24BAC942F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617806, "uuid": "838e27ce-d298-4f20-851c-a88d8da6c08d", "value": "1536:IXZC5KAZsFuKyJCpL5xsXEKHnYj6rojTlG9WgVaRxd42+:IXZjME6DYGr8BG9jVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691617806, "uuid": "479a9663-4c9d-45ae-a988-0c8c18fdef58", "value": 55572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691617806, "uuid": "80f4188b-61e4-421e-bb4b-c60f72c9646f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691617806, "uuid": "c0bd4cee-0626-436b-8bbd-e28261327406", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357b7ce7-3676-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691559182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559182, "uuid": "ab90297a-00dc-4475-ab22-6a1f4db7d183", "comment": "Malware payload (AgentTesla)", "value": "670fbb26064af2f2109f858879862f7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559182, "uuid": "bdb29aed-9fce-47e5-ac0f-971d8229091d", "comment": "Malware payload (AgentTesla)", "value": "e4f3e27eb68f3c97e90cffaeb3e38bb206f92c1edbf5420f2785ce8e4cea07b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559182, "uuid": "9349d474-294b-4b13-ad65-59b86e348ddc", "comment": "Malware payload (AgentTesla)", "value": "dd63a58670e844a40a5aac08d92738a535cb215a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559182, "uuid": "36f0fbe2-6b53-4daa-97f7-da2e35794e32", "comment": "Malware payload (AgentTesla)", "value": "0baa3d1a1608df329d733fc16e4a7d4d5f2a5a2a8a4b4522b2719cdfbf0360321bf697cfedbc4f998ffbe51da06fcdb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559182, "uuid": "ee88462c-dd81-4df1-90bc-02f307065acd", "value": "T187E43332E1D6B8AB7716F1BEEADAD4A81445F73E35C01A2513BE8A4D09043D14E6CBD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559182, "uuid": "dc6feb26-b630-4e36-a608-3bb8b0733aa2", "value": "12288:ogHw0ftnqQ9a0u7peCFK6HzoqPkUCm6Vy+9zbF14TjZzen9t9kBKg+8uav:ZQ0ft5u7peuobUP8/b4T9W9bU+8uav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559182, "uuid": "ce6b78f6-d4a1-438f-9c60-9325945ca9bb", "value": 681485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559182, "uuid": "d4b25261-be73-4ee6-ab8a-15572fad6ab6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559182, "uuid": "2e49cf0a-59ec-40ee-86d1-e2c658b6b80d", "value": "FedEx Express Shipping documentations.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7266b424-366d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691555419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555419, "uuid": "dba63267-85ec-44db-b8ef-7bd7cb49f9e1", "comment": "Malware payload (AgentTesla)", "value": "a723ee2bcd94cd2ff4d77cb7c21ac847", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555419, "uuid": "65b5fdd0-d825-4128-8d31-59fab6467cae", "comment": "Malware payload (AgentTesla)", "value": "e5cd48a71dbf5a7be455ee465bb3ea361543b40172a1bb19f28be98c17291103", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555419, "uuid": "eb211641-a2a4-42b9-a1dc-201fd61ae2e1", "comment": "Malware payload (AgentTesla)", "value": "f266a4c88dd15f8ea2e047486064469df58990b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691555419, "uuid": "d3b84c9f-eb49-40da-b1b2-8e503d86b6e7", "comment": "Malware payload (AgentTesla)", "value": "077b48fc734a0cfd3ad3fefa308bcd0b5ab5f789d0289c002d433ca703c401096f73bc9dae32d311afb82a5a04bf1ed0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555419, "uuid": "edae2ee9-3815-4821-90a8-1351d348dcd7", "value": "T16C050822E77B654AEF29A2E84E2F447179D6DCC0F1B1C588B7E7680385C23114E35BE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555419, "uuid": "47df29ad-54bf-4af3-bf80-f59f0b5a6554", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555419, "uuid": "7d0e3c09-02b8-466e-a4a8-426b224f5d5a", "value": "24576:AUYRs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUOCOguXoeklQR:AtRs6CE3jLbO9Rs6CE3jLbOau4vlQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691555419, "uuid": "15ba2c07-cf02-4107-ac4b-40ce042708f3", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691555419, "uuid": "5d625f37-d812-4b40-9d6e-eef69fa82b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691555419, "uuid": "e61641d4-78fe-4ff5-89d0-1baedfadaab2", "value": "SecuriteInfo.com.Win32.PWSX-gen.657.18837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f05893-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571638, "uuid": "1b1d9d8b-ea45-4fa8-9e72-b1edd46ce383", "comment": "Malware payload (RedLineStealer)", "value": "794d371662f4e1550e826d29f21829f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571638, "uuid": "469bb728-c572-485c-b045-571e58d460fa", "comment": "Malware payload (RedLineStealer)", "value": "e62c974af920ba5e9f1591bee7b463cfb690752cb9af1469bda287842103b562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571638, "uuid": "6b1d85ea-1482-463e-a61d-5d35f889ec87", "comment": "Malware payload (RedLineStealer)", "value": "6d69a2a8b441df980b6aeb4fe5b1e52b9d232546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571638, "uuid": "d28dee22-736f-44fe-902e-a01fa4dd3298", "comment": "Malware payload (RedLineStealer)", "value": "142e1b0ea6d7c7afc6882da230ba4818182c84deafd60dd0a965891c61dc64e5bf3db9996d83234789d16c739ce41cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571638, "uuid": "484ea389-b0a9-43e1-8db3-f544b9ebdc18", "value": "T13DC40216FADD00B3D9B61BB018FA03D71732BDA15978825B2791E54E0CB36C4B532B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571638, "uuid": "b80609cd-934d-4365-96c1-5a87eff727ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571638, "uuid": "17577bd0-e603-4eff-ad00-2c3d06cde02a", "value": "12288:UMrcy90eKZQNvyDN6hp/pUT1x8HNe2mT63Wyt/NiqCWmKBj/:oyzKLDw4AeXcWy9NgPKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571638, "uuid": "561dc29a-7375-43b6-bcf0-4cfa3af455e8", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571638, "uuid": "8fe0c8b1-586e-40a1-bfb8-be26e2d1aeed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571638, "uuid": "d95bfae3-e633-41cf-8b73-622ef13b3933", "value": "794d371662f4e1550e826d29f21829f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f71326-370e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691624787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691624787, "uuid": "16d841e0-3d4c-4b0a-9015-56ca86497848", "comment": "Malware payload (Amadey)", "value": "15e9e8eae1a69fdc50214420ef50cef3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691624787, "uuid": "f68b415d-3fdc-4f3f-a57e-068c9e7ddcdd", "comment": "Malware payload (Amadey)", "value": "e646d2150c36ca3766066218621416951bf0b6e5c957e241e5b6f79e7301f972", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691624787, "uuid": "ff75684e-c9de-4207-8384-eddb9d17c24c", "comment": "Malware payload (Amadey)", "value": "1951bcf9da1ca70dd3843d1157c52815b7be3748", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691624787, "uuid": "83fc9b36-83b5-498d-8876-e14440fdd327", "comment": "Malware payload (Amadey)", "value": "1102bbca16545a9158efe16ddbb08dc837c747c25513d061afdb3808fd683d9e60ae71d9ad8d2fe5f53799d6e3459bbd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691624787, "uuid": "4cd0940e-dc7a-482b-9f97-3f07b6a13003", "value": "T1C3C41212A3ED9432DEB52B702CF713D30A36BDE25D30526E2782690E0D726947971B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691624787, "uuid": "41ce5071-462b-4d39-ad99-5bf61ba93312", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691624787, "uuid": "805958c7-9f31-4ccc-ba68-a7225159ddd5", "value": "6144:KTy+bnr+wp0yN90QEcnyS0kqe+W9AEgZ8nOMuRA+77vaSUI9wzmIvvoZQS+zsvqj:RMr0y90ONWUAE9OX7eSUIJQ9oSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691624787, "uuid": "c5e945e8-3410-45e5-b421-d76c8a3c6051", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691624787, "uuid": "5c1cfee9-6be6-4c79-9ff9-a3499f53c8e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691624787, "uuid": "d99a2f50-d707-4bb8-b077-d471d9a37106", "value": "15e9e8eae1a69fdc50214420ef50cef3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811c6cb0-36c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1691593669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593669, "uuid": "88d9b3a4-a230-4812-b1b3-96bf539d857c", "comment": "Malware payload (AsyncRAT)", "value": "720dc5b959d225b79168364c86ce43c6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593669, "uuid": "a3d41fdf-cb8a-42d5-96ea-163ba14a25e5", "comment": "Malware payload (AsyncRAT)", "value": "e6d3b5e5e32627fd5ebfe02729366a88a0af661ac60cf50e5acba8a575908732", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593669, "uuid": "6b26939c-8e48-4af7-88ab-e2c6a23a18e5", "comment": "Malware payload (AsyncRAT)", "value": "6280b36f15930f1e3f41270f8dc2d0803dd47dbf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691593669, "uuid": "95cf4066-7562-4624-bf86-1b01f5bf1722", "comment": "Malware payload (AsyncRAT)", "value": "60cf2e3f17b3ffc28440fabd3ffaca9f0b1e3b96f7cc5c685fdfe627f5dae936cd8894f48f7ae5944f74b81ec5b57516", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593669, "uuid": "8c320bea-5135-4877-9dad-4d726949cbb8", "value": "T1FA236D0037E88136E2BD47B5ADF2D2418675E6676903CA5D6CC814EA2F13FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593669, "uuid": "485fbe7d-b324-4d66-8906-193f375cea39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593669, "uuid": "2460e523-171a-490e-9b21-985b244a4282", "value": "768:4q+s3pUtDILNCCa+DiptelDSN+iV08Ybyge+UhwVl7ggvEgK/JvZVc6KN:4q+AGtQOptKDs4zb1/UinfnkJvZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691593669, "uuid": "d5d7565b-957e-4ca9-8d9e-48217a0418b9", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691593669, "uuid": "81be14f9-98b2-414a-b029-95449243d592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691593669, "uuid": "5b46141e-ece3-4be9-8675-f7a8cd079b66", "value": "bOLQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e432042f-36b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691586963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586963, "uuid": "fd57802a-5d2c-4064-9213-1233c244926f", "comment": "Malware payload (Amadey)", "value": "fb622f4c921952c552e41e30c677ba95", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586963, "uuid": "6fc2acd0-a3c0-4990-9f96-631b172be83b", "comment": "Malware payload (Amadey)", "value": "e6d978fc78722b5c6221101d619cb875ae2055af8c0be27ca0086a2a58bcaf11", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586963, "uuid": "9ad1aafe-ad03-46c1-aa82-26cf7baf170f", "comment": "Malware payload (Amadey)", "value": "021644989d589544031f3236a2d6f0973e42e0a7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586963, "uuid": "16d4e09b-8df8-419d-99e3-271af0fe18c6", "comment": "Malware payload (Amadey)", "value": "453112fc3bb6f7e57b3cc81a1b17056c461565fa81c2c77583b1143c6bb11dd8df17303e9c92f8db98672fe5e2c3be1c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586963, "uuid": "78bea616-e76b-4c8f-bc1e-7ad1bfada8ac", "value": "T162C41243E6E89567E9B127705CFA43C30E35BC718EB8975A3281994F0CB3590E531B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586963, "uuid": "60a7590d-836c-4fab-be7c-097dcf1ae617", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586963, "uuid": "3ef1710e-a8f5-4ac0-8a0c-8ba2b3f3dfd0", "value": "12288:+Mrey90gWM0vObcRREM2yGhkZ6mqSg9B56HXYPbL:8yn4JREMbGhaW0HgbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586963, "uuid": "c8a8c7d0-94e5-4d8e-acde-5f55ac05fbf4", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586963, "uuid": "c9bda7f7-723a-4572-8019-f0ccb42ec2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586963, "uuid": "09b122ce-2b4c-450f-9792-c17974a404d0", "value": "fb622f4c921952c552e41e30c677ba95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f609205e-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602884, "uuid": "5990c333-98c5-42cf-b1a9-f2045fe4ef8d", "comment": "Malware payload", "value": "e727100f00ffd509e4599cbd8e3896f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602884, "uuid": "4c7e4acf-c628-4662-9e90-b80c6310d0d9", "comment": "Malware payload", "value": "e71cb1523d57cf5f2bc554d02bb7206877fc88c093598cd28fe1e380542e5097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602884, "uuid": "5d9ac460-c74b-4e91-b1c2-a98f67d811ae", "comment": "Malware payload", "value": "2fff4857ce3b2ebc3bf1a009175a6707e5ca1ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602884, "uuid": "572e6873-f924-47b0-9cdd-62fa285498bf", "comment": "Malware payload", "value": "b43a60c40dca43e00b076ea4358bf438f847dbad10503f8c6483f2e57096d6c98ff175714473af97780a1868db3630dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602884, "uuid": "184d964b-4ac8-4a78-beeb-2bf8ad3303b5", "value": "T169A49DA278D935AFED2F4974035FEAB22A795CD07381496D8F40360D4C36A4A90EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602884, "uuid": "46a222ec-51cc-4478-8a14-1e8d8ac2c881", "value": "dd68e663380c71f66b512f005f1be7ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602884, "uuid": "7667c6f5-064a-42c2-9395-e76b2f2d0062", "value": "6144:6cqNGUt5PZVheNA+ff0DOs4AcN/duCOeKe+dBu0NvPr10mnsxQQBYw4:b0nhe2eMOsPmIjvBTFr106sxQQew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602884, "uuid": "430aa8b6-7d42-45ee-901a-e64b7bc326ce", "value": 492016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602884, "uuid": "22574007-bd29-43c3-b1f5-646ec130a3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602884, "uuid": "c26f6b13-1602-4f03-961e-cfef1448eb43", "value": "rPRESSUREREDUCINGVALVE_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c2e0f1-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691602726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602726, "uuid": "d41a2220-c71f-4e1d-9ccd-88e08f3bd213", "comment": "Malware payload (AgentTesla)", "value": "9b44e38142c6d3365a094051201dcef1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602726, "uuid": "2740878a-00aa-450b-9080-447cf71792fb", "comment": "Malware payload (AgentTesla)", "value": "e7396edea14ad1833cf5471a7ee743e1f32ded9450f6a38eab87d5bb22e17c51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602726, "uuid": "f4aeea3d-c8f2-4c80-a8f4-3c0fb6593816", "comment": "Malware payload (AgentTesla)", "value": "6cb9738f74e3a999db57454362b33ac5c7d15fed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602726, "uuid": "7bc90bb2-7ebc-4a6c-83bc-a0859d7fa1f3", "comment": "Malware payload (AgentTesla)", "value": "a6dad2a2cdca4a614977028ea8f675f98b7febe16d746d751912aeb10b668292a768fc5b315039fa0df29518217675ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602726, "uuid": "fe271617-6ad6-4717-a06c-6f0f70ed133b", "value": "T1ACC4874D3BEC48C5F2B63B02439C09D4538FB8C66979154CE8849A2D2BFFE85E962375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602726, "uuid": "49eedbbb-d8ec-4aa7-95bf-580d394b2768", "value": "1536:95FjaXGxbMN75ro6BHB1Z9QrcWI/giB4JtqFXgDlTVPq+fQdU6y/97CeNImDCt3s:hQRQrcv/giuTqFwvq+fQBCwud/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602726, "uuid": "a6b6121c-047f-43c1-ab4e-ae026bca7928", "value": 557456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602726, "uuid": "b77e873e-c915-40da-b114-c1b78f32c42a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602726, "uuid": "cd862db2-e91a-43ea-be6f-713034e468f0", "value": "CD-7868768.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600d2b95-36c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691594472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691594472, "uuid": "35c9f648-16a4-4ff6-8c1f-13fcb433f9c7", "comment": "Malware payload (Amadey)", "value": "18017cd03fc93d324fcc6f61339c1816", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691594472, "uuid": "c1f51446-97b9-4af0-a6db-b2cbd7e47690", "comment": "Malware payload (Amadey)", "value": "e765b5936acd648174759ffaa7c35a4c28f726a4c4976a2f6c274b09709abd4c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691594472, "uuid": "5e96f802-e383-4142-b10d-62ba3e66088d", "comment": "Malware payload (Amadey)", "value": "362cc88326c244563d8073cd39eb9c0a9b0197d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691594472, "uuid": "14e53688-6ac2-4c49-a83a-f13f39ea1170", "comment": "Malware payload (Amadey)", "value": "3d0a925d51241645e36f2c475e007e3c5e69ea00c44daa72f963c3d225230b2df49786f2f29fccdac343e4cb4e1603fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691594472, "uuid": "07e84602-7380-4746-ac7c-4840aab3e386", "value": "T1ECC40223B2D95173D9F11BB008F713A30A39BDA25D78831B3795985E0CB3789B47672A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691594472, "uuid": "2690ba37-af19-4792-8fdc-2228485ae861", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691594472, "uuid": "0e776016-ae80-44c8-8172-e1dacb69d350", "value": "12288:tMr0y90Ohhad0eXU2zKpg0OcdE8a+7iJdONzKW:FyfvkRzKi0Og1F7yINeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691594472, "uuid": "bf58afef-6821-48a3-8dd5-ec8d7834eff3", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691594472, "uuid": "d2005b4c-0d4a-463e-9e7c-1b5c9d207e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691594472, "uuid": "33b6828d-2752-40fc-a0bf-23114f0c9ed0", "value": "18017cd03fc93d324fcc6f61339c1816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bef4c3-36b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691586503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586503, "uuid": "12ea3366-0136-4a45-a47d-5a74ff6c5ede", "comment": "Malware payload (AgentTesla)", "value": "912136a0e8a0205584488e271dc75cda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586503, "uuid": "67d693ef-4585-42aa-bee2-20e6434ff43e", "comment": "Malware payload (AgentTesla)", "value": "e779c84e8326a66b641597c1193cfb4954e458dcfe09c207a038c18449cc515b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586503, "uuid": "a84eec43-bdd4-461b-9b13-3f84b6a932c5", "comment": "Malware payload (AgentTesla)", "value": "531ac5eaa9792e6fe8188d960fd69e210b192b47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691586503, "uuid": "65e1ed25-0411-4cdb-b741-07e1b2ae22b0", "comment": "Malware payload (AgentTesla)", "value": "a3f8f882f51d0efdf2af0d4df125d6ab145e3a1a2e1498ff6e25a1b3339f881f957c54a5a6cc63999230b0597733d223", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586503, "uuid": "06ad6068-5da3-4725-820b-cebbfb38a55f", "value": "T1C1F4273C156D6A8CF3A482FDB6748CFF17A4682F80B7F9F3885CA4D706A97D05502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586503, "uuid": "f3fba462-046b-47e3-bc0d-51ac6b3ae8ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586503, "uuid": "05f3dde9-f000-494c-95cf-77b2e607be53", "value": "12288:HEm9VDpEOSLYTr+7FQkQBhcOVzIzNeyySTnor0XC23b+c1:HL9VDpEO6YTr+7Q3ANZh5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691586503, "uuid": "e09dcfd2-8055-4d6b-acea-e7c227d0ddb6", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691586503, "uuid": "134d360e-168b-498f-b2f6-dee1c5bf05bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691586503, "uuid": "f576d1e0-43c0-4e37-9ec8-2561f4779a5e", "value": "Proforma Invoice_24.06.023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0139603-36e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691606606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606606, "uuid": "55cd0e62-29f4-4b7b-997e-200b48d0a868", "comment": "Malware payload (Mirai)", "value": "fdfbd32ffa6a442d812777433a5d0a1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606606, "uuid": "7922b545-438c-4f45-926a-8c40ed76b771", "comment": "Malware payload (Mirai)", "value": "e782a59546f8aace6df7eebfa542349cb664e663273a7ff30e928f2c4d2ff1ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606606, "uuid": "c73cc75a-1996-4af8-a74b-9aab94decd0a", "comment": "Malware payload (Mirai)", "value": "45d67d7ee366efd5dd0a392d5647539f032322b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691606606, "uuid": "ac3a3e16-4487-496e-89c9-b459b1885429", "comment": "Malware payload (Mirai)", "value": "3ff36bbd5224e336c547b8729de17d8495c4c460847404c263aa1ac339751e2a4856260323ac5bae653248d74b746bf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606606, "uuid": "fc438784-769f-4519-bd10-7e83e6662170", "value": "T184C2E0E67F773D9BDE350139389DCE369274B052D76EA653A200824921071BCBB329ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606606, "uuid": "b915beb0-b5bf-4bd7-95a7-b4801da17c9b", "value": "384:Mp1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8Q+/BSM8NyF:UMwKDZOFbBy6sSHRYfeAxdd8Psg0Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691606606, "uuid": "690187b2-1244-417c-a479-dcf1b283a2d8", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691606606, "uuid": "5afc50a0-b941-44ff-bc80-da004463d9c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691606606, "uuid": "b008e428-b561-4fae-9ee1-2457597e11f8", "value": "fdfbd32ffa6a442d812777433a5d0a1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63795f77-366b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691554535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691554535, "uuid": "2150bba4-c91f-48ac-9161-2485bc090c9b", "comment": "Malware payload (Amadey)", "value": "80c5467943096da95b6e63a8ed22b435", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691554535, "uuid": "047175ec-70d7-4f53-8b6b-e5a0b34bbb0e", "comment": "Malware payload (Amadey)", "value": "e86339614b704a7442f8714b516ce8326a4ad5b5f41dab3104a708efc22d8647", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691554535, "uuid": "48d1c4e4-f76e-465b-8a34-b7f4590ad2d2", "comment": "Malware payload (Amadey)", "value": "d8104805b94144657a890e09176bdb8e64ea2952", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691554535, "uuid": "8929853b-8fea-4853-839e-11efbf370626", "comment": "Malware payload (Amadey)", "value": "9ebb7e41af3d202cda253df042fcac78a02f60d3fbe5606881b1dbe5daa710e7bdb4f2be59f02dcb944ae71eebefca3e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691554535, "uuid": "cfed9d88-db81-4abe-971b-e10045111f05", "value": "T102C4125363D88422D9BA27B018F703831F367D61A970937B27969D8E1D736E0B872727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691554535, "uuid": "e16a909e-3bdc-469e-ba7f-4c68ef18eb9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691554535, "uuid": "5f12a6c5-756a-4701-bc2f-bfbc3fe81d0f", "value": "12288:yMray9003yz+MlbpyVSQYlNu4BEaXCToRUfNAoMX2O:UyP3yl1yVSfbyTEUfNAMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691554535, "uuid": "8ebc2a2d-a61a-4e21-a2b7-57da527afadd", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691554535, "uuid": "f9834b3c-c1b7-4a64-968b-d64229ab4e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691554535, "uuid": "2707846f-69fe-4a3f-832d-c7120158d6d0", "value": "e86339614b704a7442f8714b516ce8326a4ad5b5f41da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f112621-369a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1691574606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574606, "uuid": "31429248-062b-466f-9ede-574c2bddc037", "comment": "Malware payload (Mirai)", "value": "74268608e53493b67e1a8dcf16959e05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574606, "uuid": "1df97cdc-70d2-48c7-ab82-b3a05393c251", "comment": "Malware payload (Mirai)", "value": "e8c08f995e19a16dc651fb77f5b25150137398afe4cb1331337d1693d929dd2c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574606, "uuid": "fbefb0df-cd71-46cb-897a-62fa43267f55", "comment": "Malware payload (Mirai)", "value": "27ad1d3a11b9171638bb0e03567cff61201ceabd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691574606, "uuid": "aa7cd5f1-a86f-4384-a22e-84a410527d0c", "comment": "Malware payload (Mirai)", "value": "67cdd3732ba6aee2921cce4bb2dcbd58f2b948617751132c5d6a285bb06a35180dcabdbe6026fe85ce7314d4006a0bf9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574606, "uuid": "bd125c8a-ac78-4c9e-a7c5-6a354732a1ce", "value": "T165C2E1EA3E7779ABDE35003938A98E3796B1B461D75EB713A201410960071BCBB329DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574606, "uuid": "0f77c44b-958b-4aac-9fd7-b3d3fa8d5bf2", "value": "384:Mg1DMwk8JPyGYhDZREXVZVBy6sIye1iWLRYh4Sw4cGJYeRzOFGBzd8Q/e+nBjlND:RMwKDZOFbBy6sSHRYfeAxdd8wZnI0Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691574606, "uuid": "6e29f143-3ac6-471b-a2d6-4a4e0185e11a", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691574606, "uuid": "37e56be7-112e-4ea6-ae22-dad4696ebef9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691574606, "uuid": "5e2b26e5-f5ff-4f36-8bf9-0b563185f609", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d94e8cc-36de-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691604024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604024, "uuid": "6c120cb7-27f0-421a-9e78-cc53ec05ef58", "comment": "Malware payload", "value": "c8f4fdb6716e45d7efe0d1e3b7d40f42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604024, "uuid": "e39d2129-fe83-4714-b798-6d293a910479", "comment": "Malware payload", "value": "e8cc2e708a649522e9f894abc3075c1fc656a7eb2164900df51bda8a6301bcb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604024, "uuid": "11fd5f00-ee50-4230-a24b-f958dc7fe50b", "comment": "Malware payload", "value": "5bb6a06627dae7e575fb2ef334a22a54668450ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604024, "uuid": "16c99d0b-e679-409c-a2cb-da9770c9b40b", "comment": "Malware payload", "value": "6531293f2760f3211dca38f2bcad50513d30d85dadababa39517a03d5e8992308a1b218bf5b7e6368a9e7c29f9421ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604024, "uuid": "ee8c1c96-0265-40b8-873e-abb434cf8247", "value": "T151366D12B284557AD06B1A7A583B9658AC3FBF603A36CD4F17F47C8C8F36A407926707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604024, "uuid": "61dcc268-bcde-4924-acc3-9143a4a3d0dd", "value": "8ce1fca4fc6211cfde9fb8c1b7d1fcb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604024, "uuid": "b28ae319-4219-4ba8-9bc0-08327d9f5686", "value": "98304:rsHn4hPknV8YuUHnUEcV40z+3jJH6vBHDREe:gHn4Pk+YfHfc4zV6vBHDREe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604024, "uuid": "4f63b966-ee11-49e3-b73d-0e02aedfaf20", "value": 4899840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604024, "uuid": "93c7f511-53ae-4a1e-a563-695373a41918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604024, "uuid": "dbff58a2-7620-4fe6-9b96-29420492e37f", "value": "tgmap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5e4bf2-36a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (zgRAT)", "timestamp": 1691577338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577338, "uuid": "99eb5499-20f9-4b8d-8d7e-ae8281cb53fc", "comment": "Malware payload (zgRAT)", "value": "c9f2bb5695d59e35d3918f62d5ca6a54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577338, "uuid": "1f664411-6b1e-4002-9394-fccca5387899", "comment": "Malware payload (zgRAT)", "value": "e9071c48c764c5f49c0d4cdcf2c92af9976d03a043ee31ad0834708225154d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577338, "uuid": "80c3b01b-d01c-422d-af1d-c6ef517d4b06", "comment": "Malware payload (zgRAT)", "value": "22ec93e58056c5277347f55d841cb381b7e34025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691577338, "uuid": "e18b5793-90d9-47a9-a7db-1863ddbf89d8", "comment": "Malware payload (zgRAT)", "value": "3e9b528b706ce2232d54a19a0a22162bfc26ce05df74e4665d352d7c62566385c1e3229760a1bd130df4199f1bad6e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577338, "uuid": "3cae9a95-a7c0-4466-866f-1a78d4ed92a2", "value": "T1E5F2E947F66A81B0C6E9673BC5BBC1005371E582B963CB4D784E330A68137A6DD86BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577338, "uuid": "4d141f5d-ff80-4645-b444-686ab48f3228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577338, "uuid": "f4182a0f-4269-4525-847b-efd200d64ce1", "value": "768:k7j2ud7hWFLozhzpX27E+Kx73Oa091LVgY2UxuT7zVhf:kJd70FLoJp0+Oa01LN5WzVhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691577338, "uuid": "b5c78b26-dd3b-456c-851a-4e7026d8cee8", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691577338, "uuid": "0980c2f0-7458-4532-a04d-87a3bda565a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691577338, "uuid": "cb7f53e3-272c-4680-a35c-1eff17ddf878", "value": "e9071c48c764c5f49c0d4cdcf2c92af9976d03a043ee31ad0834708225154d7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459ac241-36f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691615473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615473, "uuid": "88edd251-c3ca-44f5-a0cf-4d97454a1fc9", "comment": "Malware payload", "value": "9dc59c231c11656c36181890e3699bec", "object_relation": "md5", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615473, "uuid": "0c06621f-857c-44fa-9c6f-3dd5bb12f2fe", "comment": "Malware payload", "value": "e954167775d56cd819a15df364b572e83dd0096100ac1ceb27227d3cbbd7d8cc", "object_relation": "sha256", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615473, "uuid": "f6a1c6c7-57b3-4a26-9f8b-383346b97e8a", "comment": "Malware payload", "value": "9c4cde8c2413fe82edf3f820a68baba75a60deaa", "object_relation": "sha1", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691615473, "uuid": "60e382cb-c697-433e-a7db-e319149361f5", "comment": "Malware payload", "value": "465cc17545acf45bb2e39338523e229ca7ad195418702fa06a3ef1f42d8a36f991c71e34914e7eabb5e756fc749e7eba", "object_relation": "sha3-384", "Tag": [ { "name": "178.33.94.35", "colour": "#22E0CD", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615473, "uuid": "b7ff9a53-7839-4aa4-85da-180768c5c8f8", "value": "T1E454F143BF46DCA9EBFB4136859C42C6243F7F951E4282E72E5BB30C98726D09B85D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615473, "uuid": "41da05c9-0731-4255-a74a-c5d0df069532", "value": "6144:DTCiuxS+i3eb4j+wNvmCGfZFxADyd6RwV5U1Sgi6WrjykWK2BGi3xapWQ:PnusT3cgtN0FeS6Rq21SgH8tWDBaQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691615473, "uuid": "42a3cace-a6dc-4637-9aaa-ffcb7a42dc27", "value": 299362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691615473, "uuid": "8a566098-733a-4f34-b4c2-f7f2f8283b36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691615473, "uuid": "f47bed81-efab-4f26-bf51-1e4e761e657d", "value": "Google News.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab21a70a-36ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691597175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597175, "uuid": "6a128e6c-7ce3-4d91-a449-95123e373c84", "comment": "Malware payload (RedLineStealer)", "value": "49be8d8eb7aa623ced1335b70e3bc5b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597175, "uuid": "dd57f8d7-3c75-4897-a017-504bed2afa80", "comment": "Malware payload (RedLineStealer)", "value": "e9893e4c75f80d9d9bc5140ae29bd351b1f9ad42774b3b965059fc53d897806a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597175, "uuid": "c54a87d6-55e7-4ce9-bf7e-b826744e3bd2", "comment": "Malware payload (RedLineStealer)", "value": "7c7a724ef2a40f4abaf9ae0f19b9ce4bbaa7ad1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691597175, "uuid": "53bb1136-ac61-447e-94f9-148354fe5de5", "comment": "Malware payload (RedLineStealer)", "value": "91e27e2a11754f97ce1f8e692175dd8504e56a8a0da1c369f437908008cec2f2f8606f44a7d01b96289d80e6092a8ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597175, "uuid": "ca6d0f29-a6e8-42e0-8c6d-12df907cce1b", "value": "T17EC41243F6F840B3D9B1477018FA43930E36BCA18D78971B1695A95A1C73BC4A932B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597175, "uuid": "5f009e3c-6a7f-46ac-8b76-28355bf10d63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597175, "uuid": "6e9aabc8-3ec8-4325-a128-603f6e94f111", "value": "12288:qMrby90VkHCNau5j2N5lM3A5POyvJniDcReZ:1y0+eolMQ5POyxnMca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691597175, "uuid": "26d87269-4709-4000-9348-9f3336a2a14f", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691597175, "uuid": "ed4447e1-352e-4d59-baa0-18871c009965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691597175, "uuid": "5079ea87-9059-47f7-abda-3f4a04bf6180", "value": "49be8d8eb7aa623ced1335b70e3bc5b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037ceb35-369d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691575849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575849, "uuid": "035828d1-5596-4559-b58d-a211f9f223de", "comment": "Malware payload (RedLineStealer)", "value": "ac4864ff0ba016cae6ccd56ddee1cdf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575849, "uuid": "4b95a899-9915-4291-ad22-27c25f7c4599", "comment": "Malware payload (RedLineStealer)", "value": "ea9d0219f5730de1f129b50245c4cbe72299642baf2a383fa58a6137a2f225a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575849, "uuid": "41193e6e-925d-40bc-82a6-744b08de5674", "comment": "Malware payload (RedLineStealer)", "value": "a55a332f2359363a7ffaa48e8e9e2583951c003d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575849, "uuid": "247396f3-62a0-4b45-9802-f27a721d5d45", "comment": "Malware payload (RedLineStealer)", "value": "34943c0812d22c7dda0ab3e33abe13d915769a213fbc13913857b6ba02c6f2fbeb707c40948e88429e2c92ca24b6f3af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575849, "uuid": "c4eb50fb-0293-4bb3-8271-ea7ae9c56630", "value": "T1AF03F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575849, "uuid": "8f84df23-a181-442e-aefd-feb337b9f929", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691575849, "uuid": "d8fe833b-4d3f-45a0-9456-9acd501e0b2a", "value": 41380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691575849, "uuid": "31ba1609-3c95-4bd2-a3b2-0cd9302297d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575849, "uuid": "9ddfcfe7-ac6b-4896-86de-1c2db30d9311", "value": "ac4864ff0ba016cae6ccd56ddee1cdf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de133288-36b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1691588241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588241, "uuid": "88cd533a-513d-46da-a167-311eed554ab2", "comment": "Malware payload (NanoCore)", "value": "6439e72bf9a76098bd8e554dca72a9ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588241, "uuid": "982a16ea-a609-447f-b0c7-d6697b37fcc3", "comment": "Malware payload (NanoCore)", "value": "eadaa6c5195abd231c11c4540550773fcd11c24bc7ae715a71d971deb720b8bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588241, "uuid": "aa7bf386-3005-4aa9-baa2-69dbc39b155b", "comment": "Malware payload (NanoCore)", "value": "6a57125dbaa2b03681190588e6608006036eb8c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691588241, "uuid": "0852e9ed-7181-421d-8230-5c455d7a20d5", "comment": "Malware payload (NanoCore)", "value": "d29bd122910f3060984df1920a7d121ca35aabf32ad8562c07711b0e8dc6d5efbab357709399e9d956bfe50f023b36d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588241, "uuid": "93329d40-9b2b-452f-81ba-5f7941460d5f", "value": "T1AA835C01374C99A3EB6C2176A8AB588103F4AD7F8791E11D69CFF16518B2353122FDAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588241, "uuid": "531135a2-b7f5-4f7a-9fe0-cb91cfbbe252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588241, "uuid": "a1512451-aaf7-4169-8001-d03ec9f1d08a", "value": "1536:FQPZ0IlTXBmt66jKklrX3ty5DK3Eaqo36G8cTugO:adNMb4o31O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691588241, "uuid": "54e69edd-ef03-44cd-84ac-fa951a9ec7f1", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691588241, "uuid": "0f24f2e4-2ab5-458a-acae-e6421ed94406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691588241, "uuid": "11fa9398-c07b-4a34-966f-df625e0a2b97", "value": "RFQ NO-2302377 Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c398a9d0-36d0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691598075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598075, "uuid": "9ab7d636-b8d0-4b3a-ae06-346f58748650", "comment": "Malware payload (RedLineStealer)", "value": "afabd42d9f3c9d1e3c645033a37e7614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598075, "uuid": "f66f01a3-4da9-4cee-9667-950d1a7da36a", "comment": "Malware payload (RedLineStealer)", "value": "eb3df69b7d0f67a753413aac03b939a5230490fa76bd83d9eee5820ed2d73e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598075, "uuid": "52c748b6-e82b-4783-839b-d0e92bd67489", "comment": "Malware payload (RedLineStealer)", "value": "903edb5507793cb02367bc78056728af02642d09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691598075, "uuid": "130d7cc8-0d9d-4f95-ab31-7886bb57a47d", "comment": "Malware payload (RedLineStealer)", "value": "630805592f39a2ca45c3f1ddaee78fb7eb4e2024790976374bc517d07ac82fadc77732a3c7534d7913a3b637fdcd9fb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598075, "uuid": "2385e76d-b1a6-4ce4-84c2-ae718041b14b", "value": "T1EDC41262FAE99173D5F1077058F203871A31BDA2ADB4936B27669D4B0C72BC4643273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598075, "uuid": "c518666f-8815-4d77-aeda-a42e5b62f263", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598075, "uuid": "7e24e3ea-52db-44c3-a007-48fcaa29128b", "value": "12288:FMrsy90Iyfkq8uBdcO7LktxQ6q46PirNAOcK0bKVd/L2:Nyvycq82CO7LSUHPSwKL/L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691598075, "uuid": "358a4793-fe8d-43fe-921b-8619759a2517", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691598075, "uuid": "c03926d3-266f-465b-96da-4091eea8aa73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691598075, "uuid": "dea28f36-2e42-4a55-885d-6fbfc21220dc", "value": "afabd42d9f3c9d1e3c645033a37e7614.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527cfc36-369f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691576840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576840, "uuid": "6fcb9e1d-60e3-4e9d-a0ef-fad10ec6dedf", "comment": "Malware payload", "value": "c589ff94a7c672afa8ccc696671c81bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576840, "uuid": "60427078-f4db-4e37-b0fc-0fb21ef0c904", "comment": "Malware payload", "value": "ec50e4a34bb79d8cffa9618ca49b6a7e2c361d21c90b5b8650bc052d2a840579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576840, "uuid": "7934eed7-2cb3-4eba-99d7-be934090c80e", "comment": "Malware payload", "value": "82171bc9baf85a7d8ef70981ac47bce87b4b1bba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691576840, "uuid": "79424653-a1ab-4007-b7e0-6fc66d6e54c7", "comment": "Malware payload", "value": "7ca7cab18932b935c400c0719e4a2a37654abc53c6db0608c5789890cc648676af2d1892048c73909f4dac98d24ca0d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576840, "uuid": "9359305f-6935-44a2-821c-dff7a742ee35", "value": "T1D884A51B22A82CD4D1B9997C533BCAC9E3796D460751D6CF64E803422F2BBE4797E390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576840, "uuid": "a80fc990-264c-4bbb-a20a-b32b87fcccb5", "value": "cd11deebcf434055e6c97868fbd33e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576840, "uuid": "f0d33caf-85e3-4dde-9d6c-e74174ce544d", "value": "6144:FHc34gal8XQAtsar4XTtmK49iJW+VT0EXUFwJ6+jpUO8ps5:FYy8XVr4XTtmK49iJW+VT0EXUFwJhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691576840, "uuid": "b41ded8b-8973-4338-8781-5369de5962d2", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691576840, "uuid": "2787f932-301e-4075-970b-48713f786b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691576840, "uuid": "00f9f4ec-abbf-456c-bbc8-d17124d0e73e", "value": "qtcefwing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8831452-36db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691602862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602862, "uuid": "3ce4aac0-a9ed-4ac0-85f9-79fed6938c8c", "comment": "Malware payload", "value": "31180f4e9c35a0dbae25f9716726b2c6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602862, "uuid": "4ee2270e-65f0-4584-b9a6-122e51893480", "comment": "Malware payload", "value": "ec96022991264841e5482258fed687aa19233bea0bb57938e493201966089f4a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602862, "uuid": "8d39409c-365d-4026-b684-3e6211ff93e2", "comment": "Malware payload", "value": "7052ac2e93c695e3d34456e29af28b5beecb60c7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602862, "uuid": "fa2244ae-8b45-44bb-b2ec-635c3d0dccd0", "comment": "Malware payload", "value": "0f81b8e8e3bc4d1713e4d045ba27491fd350dee889a6ce478efbf2bb79048f63a89dfb0f274c6677154919951b67e27b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602862, "uuid": "2ccfea9c-5528-4735-b490-3838e156be8d", "value": "T1F7E423F02259A379BC4F1AFBA971607DDB67B04AD603F006F024841B09775985A3F7A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602862, "uuid": "e45f07b6-38ae-4729-908c-42e1eb1cd394", "value": "12288:ESnWsLl2r7VZDMmV7sstJGfPmQqjSQOtHhtk5qiVaDTz/4ZGqF6N1pP5+s:JlEZD57sstJG3mjjB5LaDTLYapxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602862, "uuid": "79b0d1e2-cfb7-4e87-937a-c5214352097a", "value": 720000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602862, "uuid": "d25729a5-b2c2-4d30-9612-0294b8dac592", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602862, "uuid": "d329a5c9-55d8-4470-b632-9acd71670a50", "value": "79076889381.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d17860-3694-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SystemBC)", "timestamp": 1691572261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572261, "uuid": "dd91107e-44fa-46a5-9781-c26f7a79ddbb", "comment": "Malware payload (SystemBC)", "value": "e3fe0be8cd50ca837069bc2564ab0532", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572261, "uuid": "0987d20d-57df-443d-99f8-94d65e6e3c26", "comment": "Malware payload (SystemBC)", "value": "ede84803bface8bb45d2f293d8766f6099dab30b1f2d74207398835ff255e385", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572261, "uuid": "6d0bace7-4678-4a97-b7a5-b73d4f3d0e69", "comment": "Malware payload (SystemBC)", "value": "05e41077b6ebefe2fc34b03055f8c5b31cff1664", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691572261, "uuid": "282e38e2-3295-4996-964f-39ed4decfde3", "comment": "Malware payload (SystemBC)", "value": "568fcb10763888784cda8136d5b2d89f5f64be05141b814bed926ce7afe3cd15caf3ad96b142b1ba6e625dad5c256770", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572261, "uuid": "86a447b7-d00b-4c1d-8910-2e3433d64f8d", "value": "T1125622AE6194335CC41AC1355133FD48F3F6951E0BE9EABDB1EBAEC067A2411D906F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572261, "uuid": "88a00f7d-65e9-458c-a072-4107f56fc520", "value": "531372f8fed94a7a0e3b8ef647c7fcb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572261, "uuid": "d673ac45-d8a1-4a82-b130-f4b6a58a9e35", "value": "98304:QrsZ8pbhGL9G900NEOrx0i5P4GzmJPLYJZLKU9Q+Rg8gvUbgQw3/5cU6mWL:QawGMvrui5VWUDLKUe+yN5Qy5cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691572261, "uuid": "c7d1a010-26f6-4a94-89a0-72ae435d38c0", "value": 6071808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691572261, "uuid": "5abf6151-16f5-4a94-8310-c3f4479d9b3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691572261, "uuid": "baff6de7-b35d-4b12-b6bb-7f0faa962549", "value": "e3fe0be8cd50ca837069bc2564ab0532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e52e0d6-3692-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571330, "uuid": "6851bb7a-f2d0-4b91-a43a-e43b2e54bed4", "comment": "Malware payload (Amadey)", "value": "003eb195527cd56b47fba7773f79715d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571330, "uuid": "5f1c1b78-b45e-49ae-9fe8-03eaae72fd58", "comment": "Malware payload (Amadey)", "value": "ee478a1bda2ce4e787f98cc07a7aad1685d5e6190a211c634c23fcbc4b998331", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571330, "uuid": "ecdf77d4-bc5e-4c54-9961-af4b0d055fd9", "comment": "Malware payload (Amadey)", "value": "27f68d45fceb1848a60efbb43a5772917a782f78", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571330, "uuid": "f5f7979a-e885-4872-8f42-810a4772ae33", "comment": "Malware payload (Amadey)", "value": "4b9da534b57425d6ff71d0d007daa62899ec1c60beb829a9395b2cf9ba4a459b80f9c10c6626c47208680cc2e775249f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571330, "uuid": "221656f8-766b-4183-844a-f4287d0ba399", "value": "T19DE41202EBE9A572C9A617704CF752C3173BBCE55E78D21B2746694A0CB32D0E53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571330, "uuid": "50915ee8-b7cb-454d-ba1a-c9f9e3d57cd8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571330, "uuid": "ac717154-358e-4bea-b2fc-17e0ad4f5325", "value": "12288:yMrAy90hyJ0KcT4Aw4mTnxw3xaskgc79gIeBXz/i6W3QerR2V8TIZ:2y2Sq4ADmTxw3xaVxgvBXzGP92V8TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571330, "uuid": "09317d66-dc35-47b6-80f3-d249112c1624", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571330, "uuid": "5cdbe10d-f15e-4d35-850c-5732c38182e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571330, "uuid": "091131ed-721a-4d9f-9177-eb1e5d7b0028", "value": "003eb195527cd56b47fba7773f79715d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1202e07b-36e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691607656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607656, "uuid": "a0b4f44e-f24a-46b6-aa1f-42baf4396e8c", "comment": "Malware payload", "value": "533a7f7b93217b70d0f383de616f83b1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607656, "uuid": "f70eafc7-043f-46ef-bb81-755cc96ff6f0", "comment": "Malware payload", "value": "eeb28f9a12ee1c3f4b236a72b00687dc45c7be4fcd75587578fe39c0c5c01e2f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607656, "uuid": "3a7251ec-86bc-474b-aec6-c73a6f20c629", "comment": "Malware payload", "value": "1c147b641b02f1e86341da33a3120691a0e31ca4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691607656, "uuid": "9382277b-48d6-457f-b605-924fe70c653a", "comment": "Malware payload", "value": "0cd344e82c4a3873ec5a087e7341cc2a8cb9580562d07e93f7bc384460203d51f87405f1cdb53cee865ad6946678e578", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607656, "uuid": "28a60517-582e-4be9-b3ed-f2479ccb2c3f", "value": "T10F01C069592D5400D9273AB0D14CD2D500D518219F523CCBAFA0E9008EAEAC0FE232D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607656, "uuid": "6b38a52a-b39d-4453-8170-6b951ae1f886", "value": "12:5jwtyhuUTY2e708rcTNlIJjUzTytbORJ5WVcbG9xyOayhuU1xyFvTytttD:9pG2801TNmtGLRnWWGTpphOvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691607656, "uuid": "56fd8099-e735-4b2b-aa8d-e529e088560f", "value": 731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691607656, "uuid": "1f8659a8-844e-4f1b-b67d-097b7ca13884", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691607656, "uuid": "26601cf1-acfd-47dd-b2b5-55eec2a5c6de", "value": "CURP_Conexion_Segura_v01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfd6dd4-3672-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1691557639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557639, "uuid": "db9f80b0-8d91-4153-8cd0-a35c7b4f34ec", "comment": "Malware payload (njrat)", "value": "c9b0d7988ea042b928cd9f348a767f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557639, "uuid": "e626431e-8a85-4655-beb7-538d90994fce", "comment": "Malware payload (njrat)", "value": "ef1e23d4e80f53f0cc4b13bbc2c37a167916673f5ce41841d2a70f6de00f9f26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557639, "uuid": "cc9f719e-fbc3-4129-b675-a4b768a2684f", "comment": "Malware payload (njrat)", "value": "2cf3c04f7e23c747ce62e44555b5d9ab2515064b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691557639, "uuid": "fa124ee4-7b07-43ab-964e-dc9a6cd5c4b8", "comment": "Malware payload (njrat)", "value": "6e25c9c63a23dbf0a61542ea9a3b14f7da4f0cf2d8692b2e47322c0742b8fedfcb65e9df6285e3ff09d5248665697efb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557639, "uuid": "15e300dc-c175-4bd0-82ad-2102d588cdb1", "value": "T105C239593FA08176C2EF6BB406B2D72102B2E2075A27DB5F4CD844FA5B777C04D81AE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557639, "uuid": "b555e920-802d-4734-ae9b-43b04d33d278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557639, "uuid": "f90bab8c-ae8d-4e25-89b1-727331cc3481", "value": "384:7Ld6haZIVi/dMkt1cpDkjetHzCYe/iBY2OzRLTm3yilqr63sbCJtVvGf:vw0IVi/dMc1uT5e/gsEzzVvGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691557639, "uuid": "f36c40ec-2696-44d0-baed-bf902de947a7", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691557639, "uuid": "08124b37-3d84-4aac-89f6-3d07f4161a10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691557639, "uuid": "b3529553-c35f-4d95-a59c-bab15567aa30", "value": "bOLe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88c4cc6-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571938, "uuid": "affc49d8-f896-4e57-ba46-4b938392d31c", "comment": "Malware payload (RedLineStealer)", "value": "fd5c5ac12a1dc494e2de1f518b20e171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571938, "uuid": "0ee8884a-dd79-4623-8bac-b1a14a8dc202", "comment": "Malware payload (RedLineStealer)", "value": "f01469f3ee02fbe1ad0de9f1076096930d785b5d4935840da6cab23d4a071f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571938, "uuid": "1b1af130-186e-4612-a52c-a50a00af510b", "comment": "Malware payload (RedLineStealer)", "value": "a1170b7ac2d20eaf557fe5613958dcd59a590a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571938, "uuid": "7e9ae9cd-28a4-4268-b5cd-a3bdee73d477", "comment": "Malware payload (RedLineStealer)", "value": "17e39002d8843e46e09090dcd0677f21efebe0adf69f3c7e9e6701c14e98eb2e36885e3337b1f5db1e9b6251e04f2ea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571938, "uuid": "a89bad6e-386a-45f0-8232-dcefd4161937", "value": "T134E42302F3E984B2D9F5177149FA13C31F357DE05AB483AB2391996F4DB26A0E53132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571938, "uuid": "69210b37-ee4a-4cfa-8dcf-c7d8412eec68", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571938, "uuid": "2e46a69b-31a6-4a3a-9083-053d3d79cec9", "value": "12288:DMrYy90TCdUpr7VSo1QCE6zrOvrL8/yxEuB1HdeKr+HWRbysVkgm:3yP07z3E6zrAAqxjYpYk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571938, "uuid": "54b89f17-86bd-437d-b643-1066acb4d19a", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571938, "uuid": "4bca077b-64a9-4992-90bb-5c1f711142be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571938, "uuid": "f29d774e-23ab-417d-9ac7-e9a4a2db0379", "value": "fd5c5ac12a1dc494e2de1f518b20e171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fffdc52-3662-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691550690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691550690, "uuid": "96c9616e-2ae4-4306-9021-4d13d7fca2b7", "comment": "Malware payload", "value": "3b65d7b4780cd11de345861570b689d2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691550690, "uuid": "76b6e96d-983d-4802-9211-7bbade07216e", "comment": "Malware payload", "value": "f01a584fa98c97594ab4c73d6fe091da6096ebadff0bf165565aaa6a0b412140", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691550690, "uuid": "630287c2-94ac-45a0-944e-9da20c213adc", "comment": "Malware payload", "value": "c7c7ae34adfa10a1f745a997f7ebe146d378c38e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691550690, "uuid": "b921e006-bc2a-4597-9290-7936aa38a61f", "comment": "Malware payload", "value": "0983b7f6502301ca66f361139bd3d087ea9fb2f1b711ac1ab16ca18ebb60f94b5e6a1e8e1414e01dea90fdf364e5c840", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691550690, "uuid": "6398dec8-ed3a-4fbe-9969-36ae73ef2f5d", "value": "T18AD1A57BF30AC34509226251C79AA80EDEE4469636354CEE39ADC9042B2777D4FA0ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691550690, "uuid": "b35800ce-bb9b-4c93-af16-70fc309c382c", "value": "192:WiTHRYY5dGAK1W2inbpYgnj3J82oMZA2KU36qu8Va:QYvGAKYLXj3J82oMZA2Ki6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691550690, "uuid": "0deaab47-45d1-430e-aeeb-67cc95fe0945", "value": 6256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691550690, "uuid": "960b91c4-c59b-4c6b-aa67-5a7658be3752", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691550690, "uuid": "5bf7f261-482a-4f87-a741-6e173e0146e4", "value": "brindes_shbrindes_com_br_MP_.vbs.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb98e871-36d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1691602008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602008, "uuid": "19414ed8-9bf6-478d-ab37-ba5302078df6", "comment": "Malware payload (RaccoonStealer)", "value": "6931ff7ad83fe96704f0132cd08e455d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602008, "uuid": "7fb92a39-074b-4b19-80b8-89793c9bd3b9", "comment": "Malware payload (RaccoonStealer)", "value": "f01ed4b69c65150ecd61f81a3ea50c1cee798c38e52b725a7ccc369d00c49c9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602008, "uuid": "573e7895-625e-4fa2-9ba5-81a3ebff9be8", "comment": "Malware payload (RaccoonStealer)", "value": "744714ae544193d79f737bf9a5a6574f14327543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691602008, "uuid": "8cb5be9d-cf03-4abc-aaa2-2aa757b63486", "comment": "Malware payload (RaccoonStealer)", "value": "acf180e8bd92fb9afd4e76ab222547e8b04c12334a1375e16bcdf6917a3cf79e3af606c0491158727c5d2e6caa2e1815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602008, "uuid": "ee808928-34c9-4eed-a4f4-ce7c3bd010fd", "value": "T1397633B75229208AC0C9CD37C93BFD96B2F5273F5E43E8B055C17ED226614F4A6069A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602008, "uuid": "d391dea7-51ca-438e-9623-48c3e62ca05e", "value": "66aa67d3802e3257c00bb5cb8af2a0b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602008, "uuid": "32fdb8e3-4087-429a-a73a-3af7f9bbef9e", "value": "196608:3+f4+kYCUmndDgOLdw/TGhfqB4oUtUUHY3+D:ug+PBmnWOLybGwBGtci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691602008, "uuid": "ea629254-8e67-4144-8f03-8e6352eb7544", "value": 7226880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691602008, "uuid": "b9294262-c7ab-4c91-9605-70ce57533d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691602008, "uuid": "12dc5a9f-cadb-4564-8ba3-afeeaf608a09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10aa2cd2-3684-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691565133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565133, "uuid": "a205245b-2b25-43fe-991f-9ad6e5b4c9f7", "comment": "Malware payload", "value": "d6dc6b4155cfc36fe8ea78aa82949533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565133, "uuid": "f616b909-8aec-4859-85be-011b93a61987", "comment": "Malware payload", "value": "f08804639b16a4f20eee9a183f8591727143da8262410acbbec5b38beb3f2d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565133, "uuid": "039c0fa4-096d-4989-83f2-94789208817c", "comment": "Malware payload", "value": "439b2fd421abfdfa6b741cc5d6589b5f8bedbd26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691565133, "uuid": "77347319-f80b-4201-9d71-678e650a3e55", "comment": "Malware payload", "value": "cc6884636e8f4059896a1664268047331df5f11724255b146bec4350f805c8ef081d183a06e5b8a45b588204decb8096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565133, "uuid": "557c7e80-f301-4e59-aa7f-47147289c8fa", "value": "T1AE419E1B5F549DF6E4064BF425C781037078603063A7C6261FB1063EB1A73A836689A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565133, "uuid": "9ca96e33-aa00-4ff4-88d9-3d60c5af4c85", "value": "a1bcc8694a7dbefb0c6366cea951c008", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565133, "uuid": "40db353d-b32b-4489-b89b-fb25a1c71515", "value": "12:e/1GSGMO9lmXnlcHSxbZffiZYcjQvpGnik6g8kXiYr:e/1GSNcl9yxVHiOGupG1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691565133, "uuid": "59c9023c-febd-4751-9181-bbd5bec2c791", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691565133, "uuid": "f7ec7d17-cf5e-4e70-81dc-8b1c28f4ac7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691565133, "uuid": "35dcb6e4-53e2-4b36-95c6-2c1e7074fd2d", "value": "rainbow_loop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b56a4b-36b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691585461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585461, "uuid": "0d14f00e-7645-4552-b2c3-ab8b90d002ad", "comment": "Malware payload (Amadey)", "value": "c080a9c551cae818d4e912c3fe963d5b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585461, "uuid": "0a61e5b3-512a-43e8-8be6-5c4be756364d", "comment": "Malware payload (Amadey)", "value": "f0c1989360d06d0952478e355a290439ae401a1d2c9efeace3990036082f411f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585461, "uuid": "285a2de1-2b76-4999-ac72-72c7a8a331c5", "comment": "Malware payload (Amadey)", "value": "edbe8caf620a0d9c8d96a68c260e65c40e467075", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691585461, "uuid": "1e9da997-1ae0-44d1-bb34-7be147d2ac9d", "comment": "Malware payload (Amadey)", "value": "0b62212c15a755cf274c45c8b53034f010ead0417ad3c58af1fbc5397a1d80ce672e085dac468ff9547246736a76bb9a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585461, "uuid": "6cbf87cb-f089-4321-bc0c-68db901c2c0f", "value": "T191C41212BAD854B3D8B6173118F707830B367CA27938D3672385A94F0D726D1A9B277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585461, "uuid": "7ffdcf7d-e766-4f8a-a7cf-0e8ccaad7e88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585461, "uuid": "ff5f4fad-ac1f-4e5e-b767-905495d5a6a1", "value": "6144:KQy+bnr+8p0yN90QEiWfhvx1BBobb0NxwFh6fIFj8OGku6v8e1vWsPSr0l7W5hfN:cMrky90ll7o/0NxmIFkux4PSglW7fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691585461, "uuid": "57860a48-e240-42c7-a374-d67367e28900", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691585461, "uuid": "b10cdbd9-77cd-470e-a733-941460790921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691585461, "uuid": "52f070de-c1ef-4d50-9714-c2094f3f7449", "value": "c080a9c551cae818d4e912c3fe963d5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccd2731-36a6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691579757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579757, "uuid": "91e1e23e-4d16-4f37-be41-6fbffb406964", "comment": "Malware payload (RedLineStealer)", "value": "c2375a354129c2c3020c616b2fe4e725", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579757, "uuid": "a7e15a1f-cf1c-460b-b933-dc0fbdd8a896", "comment": "Malware payload (RedLineStealer)", "value": "f12f99dc78840597e56c58acb7d3c0b401391819f335eed4fd6b7b18410634fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579757, "uuid": "be3ea905-be87-4fbd-babb-bd22d16f2729", "comment": "Malware payload (RedLineStealer)", "value": "e59304d271ca1055d7541e7dde8332466b20ed91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691579757, "uuid": "f79f47e3-ec9d-4d46-a006-49b2c97dd239", "comment": "Malware payload (RedLineStealer)", "value": "bcd916d00b33b39f3610d7b4f7936de6b6064f32fa3a1e7fe9ff6c7e16c3c5b68c8bfae5ba000ca8766667c94b1c92ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579757, "uuid": "70207f9a-1e6d-4785-afc5-c87edb009b89", "value": "T1BBC40223E7E480A3DCB207B018FB07E31F3ABC6199B8925F2751595A0C726D4B57572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579757, "uuid": "366e7529-e250-4bfa-b7e1-8e292e5bf063", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579757, "uuid": "e070bce9-cd93-44a8-bdad-b342b61fd30a", "value": "12288:NMrEy90P+sSyIMaVfnvWEps8yEusisf6yXQfj:ZyOUpRWE/yXshfXAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691579757, "uuid": "c1b9211d-e7af-42c7-ab31-365ee8ad9998", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691579757, "uuid": "43d086e4-1c28-4e3e-a603-fd3844ad4363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691579757, "uuid": "b68ea427-1907-4493-be2e-ec9fc6c4a1c9", "value": "c2375a354129c2c3020c616b2fe4e725.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1f7df4-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691571944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571944, "uuid": "8f4fe37f-e8be-4cda-8899-b263ffb7152b", "comment": "Malware payload (Amadey)", "value": "e8695c11b60e899d8091e3fcec4e29ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571944, "uuid": "fcb64d1e-de49-490f-857f-7f58e90082dd", "comment": "Malware payload (Amadey)", "value": "f32f26fd08b4fa68d6e3a905d1d2e6d545998ce185981d9400169e7bc4d63322", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571944, "uuid": "b18d3002-5781-4dc8-9a34-a1a4e008b0be", "comment": "Malware payload (Amadey)", "value": "38db94c58e6c05e976b8b8b9cae1d6f2beb39fce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571944, "uuid": "e182ad66-16d0-4e3b-a983-b9e6b38b37ea", "comment": "Malware payload (Amadey)", "value": "f2fe96abddde807982a0c874be3c9251999f56d9ee1b95adeb80edab0464483e1dd80934faafc7312de5366e6bf5ce2d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571944, "uuid": "ae5bb00a-ac11-430f-b465-a85dcaee93bc", "value": "T1E4C41212F6E84576D4F52BB01CFA06C71E367CB08D7882AB6786655E0DB22D0A77433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571944, "uuid": "65c5c895-2ed2-4e51-920a-910fbd80437c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571944, "uuid": "175f2ee1-d1f9-4bc9-a5b9-8114ff74ba50", "value": "12288:KMrUy90eNuxVBArGgkBV0IA+qO0ixSUScSj/TsoJRWacg8VMp:qyHNujyGBE+qHwesoJRXSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571944, "uuid": "0ceb4ce1-7868-4f85-a7e2-01ea600ab170", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571944, "uuid": "3e875d5a-d685-4f70-8e9f-3ed7856cf400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571944, "uuid": "5bef2e1f-277c-44e4-b69e-7932bf925070", "value": "e8695c11b60e899d8091e3fcec4e29ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50bd605-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691599769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599769, "uuid": "18c703a4-4126-4809-9f68-7161c469f882", "comment": "Malware payload", "value": "e56afe64811c57ecc95c1dbacebfc8b7", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599769, "uuid": "2128c330-0822-4fb2-941e-ed4beefbeb89", "comment": "Malware payload", "value": "f333559e3330d8e3451bba09b27642589788d99ae3093e8822fa241703d6fd2a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599769, "uuid": "45744b36-9471-40b0-bffe-b800b6b87064", "comment": "Malware payload", "value": "8438bb7cf165ca11904453c4c45f101c9d9abfad", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599769, "uuid": "b35d78c3-69da-407f-9596-c84ea32f8704", "comment": "Malware payload", "value": "cf1bc4f4ab76d8a24eb321677d3827a631abe0210a007704c220b5150c85b0fbc72fe85486c403cf8353c0cd955f0262", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599769, "uuid": "4e95ed0e-51f5-49ce-a68b-4f8d354adbf4", "value": "T191A412193085C917EA1772758BC0A95392DDFC036779CD8F32E9F31E6B383801695B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599769, "uuid": "a40a4f15-b562-4a16-9783-227157ff1ee8", "value": "12288:8pvWWM/QyJ6luxG9PcnE78UsZUn4NmbaWuZjNXTHL:uu5/bJLt9SnQ0uZjhjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599769, "uuid": "bd1fe047-9a63-4ba7-b53c-7b539f21342b", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599769, "uuid": "6ef1718f-d747-41f4-802c-27ed6208d4e7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599769, "uuid": "e35f8c2e-8e37-4a20-b4d7-3c296844622a", "value": "Products.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b3bf3e-369d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691575851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575851, "uuid": "5c5d844c-29a0-40f3-9929-ee66ae38cabb", "comment": "Malware payload (RedLineStealer)", "value": "ec10b42a2206336065fa126168ac2ff1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575851, "uuid": "a34a14ed-bb24-4c8a-8df2-f842dd775f8f", "comment": "Malware payload (RedLineStealer)", "value": "f417b066f16905712a6beb86cce7a84ea3260c36c38774e75be1d6779554b5a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575851, "uuid": "507aba55-c5be-4869-93fb-b16f769a6cce", "comment": "Malware payload (RedLineStealer)", "value": "a9feffd2d9bbd3c8a1b09338c527321c0c69e7b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691575851, "uuid": "30a139c5-ad5f-4444-b16c-061a78d22cd1", "comment": "Malware payload (RedLineStealer)", "value": "7f7764693a824522dbd70cf91f68221a66660cfd8f8d561a1ffe9220af392e670562dbcb2b68adcca282e397ad45d8ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575851, "uuid": "01cc1878-afff-40ea-ae0d-cf90bf324a3f", "value": "T14CC41242A2D840B3DDFA17B04CFB02870B35BDA55C6457AB2751E92A0C71BC8B476B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575851, "uuid": "5a5ce5fa-f13a-4e25-af74-18614cc0e78b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575851, "uuid": "df15fd92-863c-470e-97de-0ed46071e39e", "value": "12288:5Mrvy90tUmvversm6aBDHTxQ0eUZTqDV0S:iyyUm2QmXBrTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691575851, "uuid": "6e0bc2aa-bc57-4d81-b4a0-9c880e1b0faf", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691575851, "uuid": "31dc068c-51df-4cfd-a09e-0b0f1acd81c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691575851, "uuid": "0acdb8e9-2c6a-4a13-88cd-e7c317046fa6", "value": "ec10b42a2206336065fa126168ac2ff1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351bda3f-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691571637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571637, "uuid": "683fa35c-cfa0-4750-8142-5079107182b5", "comment": "Malware payload", "value": "ed6ee557f5bc933e947563247f26b8b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571637, "uuid": "f8f0aa62-0d00-48ba-9990-b9ff7ff645a0", "comment": "Malware payload", "value": "f41b1bcc66f4fb5fc0304de416cff8900cd258219e259e0f9894f351268c1956", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571637, "uuid": "72b95278-07e7-4082-bf92-021423f2c3c6", "comment": "Malware payload", "value": "57533827586bf5bf67824cbfc530b1c65e35a158", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571637, "uuid": "578162e3-7ed3-4644-8664-102985571fff", "comment": "Malware payload", "value": "904375dfdf4955db55a1f8e38b56ba34535373a21dc0111b3c79711d2b21418d8cf5451ea02c0c501ac87e5adaac3d30", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571637, "uuid": "2c4a3166-0ce5-44e4-8518-a85549403db7", "value": "T16733F1E11E4CD292D9B10A3FEE2E9547EE3E6DF4AA937D374639251E9027803217490B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571637, "uuid": "5b8abc3b-ba5b-4b5d-b285-b054441d30b0", "value": "1536:FeymYbtlLoDova1K1wQAQkMPvb6RbAd8Sn:Pxb3y1QBA0piK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571637, "uuid": "28740712-b514-43ca-9758-d4078a28a748", "value": 54568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571637, "uuid": "fe441a32-87f2-440f-bd60-9075afdcc015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571637, "uuid": "b8eff112-f84e-444e-acfc-c80b6e71604f", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e58894b-3698-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691573746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573746, "uuid": "d1a35770-92bc-412b-b1c2-a4f190b04137", "comment": "Malware payload (RedLineStealer)", "value": "d4be69bdfbef6404d082f47fdf0b1e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573746, "uuid": "52219e65-947c-4b5e-b82e-966e5f34d6aa", "comment": "Malware payload (RedLineStealer)", "value": "f4ca8b1b284c06c3ac650d9e2b47701cab32d3f1304bc02be4915b6657a28470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573746, "uuid": "c4e2358a-32c7-47ed-8d99-920307275cad", "comment": "Malware payload (RedLineStealer)", "value": "592a22eb97c1deee0623849a9555d9af6215aac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691573746, "uuid": "d04e35e1-e335-4e08-a20d-d7507d5784dd", "comment": "Malware payload (RedLineStealer)", "value": "34ccaab8a1b5919bae78e74d714acb610095007f2cbd163a9d606d6376f17864dc05ea1681795b69f63232174f2028bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573746, "uuid": "6ec7d3ae-d920-4641-9d7d-8face94060ae", "value": "T1C2E41207F8E89472D9B427B029F703930B32BD919C7446AB3686E90E4EB37909670777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573746, "uuid": "eddf5b1a-e395-458c-9114-25130fce9196", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573746, "uuid": "442717cb-7871-4052-abac-c0bde78efb42", "value": "12288:aMruy90pQzYFWI4f4biUJycXdWQiqQUZ6kamhTUIZLL08No:IymQ2Wb4hJ/DitUZ6kaBI5LZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691573746, "uuid": "a806a627-6b54-4041-a9d4-4819f6ae910a", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691573746, "uuid": "1a5c478c-a1be-4055-a510-da61b82b8186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691573746, "uuid": "2f4aa71d-b9d9-4949-9d33-744446b4c2aa", "value": "d4be69bdfbef6404d082f47fdf0b1e24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4721f3f3-36df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1691604309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604309, "uuid": "52ab9816-c251-424c-98b6-d5f3df167550", "comment": "Malware payload (ArkeiStealer)", "value": "5fff52c407b5b46c10416067dac16d62", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604309, "uuid": "2d005da6-79d6-4cae-8a56-cbf8260b2ed9", "comment": "Malware payload (ArkeiStealer)", "value": "f57210d90101da3bc77c55f813ba64f35dbb6d0db50f71467f18816486b9d6d0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604309, "uuid": "cb41e963-8849-4294-8b0f-3236706b31f2", "comment": "Malware payload (ArkeiStealer)", "value": "c2263843ea244e5bd6c403342efaadd0af1c5522", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691604309, "uuid": "1680e102-6edc-4e21-a0bf-86bbaf18bd35", "comment": "Malware payload (ArkeiStealer)", "value": "25873cd516daf82e141325b648165ccebd4a82e6516c903f4f7fc946923a6f415962a725ed0dd566e1abca6db1c6e193", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604309, "uuid": "ba753c33-225b-4b09-9d7c-f8a549b8c888", "value": "T1AFA4D112AAED6B71E1D68A328E2DF6F46A1EFC908F1977DB124C791F09711E1D136302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604309, "uuid": "f8ed1f9a-aea2-4dee-96b9-4f070b346d6c", "value": "46c207d29e8eaa8317918259507bb42f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604309, "uuid": "81bd4d78-8965-4289-944b-506075ea2b2e", "value": "12288:owsyp7b4azkEOSnO29StlqMNPFSrYI9TvQ:owdYazkyh9SrHPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691604309, "uuid": "033f04ea-ac46-448f-b0fd-e8a7274d4051", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691604309, "uuid": "b8df8bdf-074d-41e7-8432-0ff4de942071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691604309, "uuid": "3d8c71fb-ba5b-43ee-967f-05aeeb8f768f", "value": "5fff52c407b5b46c10416067dac16d62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff09db5c-36aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691581854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581854, "uuid": "2a353323-5dad-4407-a2a8-66a6d7a3908d", "comment": "Malware payload (Amadey)", "value": "28d2b4b44f5eada09dc23438fac6d625", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581854, "uuid": "cf79902c-5ee2-4d67-b388-63be5b3184a5", "comment": "Malware payload (Amadey)", "value": "f5ac6e1c73c935c36aa734ce70dafd61c88047513feba38105e79c1725f9f530", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581854, "uuid": "087cfcc7-d85a-45ce-8498-c1cad80e227e", "comment": "Malware payload (Amadey)", "value": "0b7537c2d4c2a754907dd7f9ee330e05566b3960", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691581854, "uuid": "6319516e-8304-4e43-b4fe-8d7a4399f0bf", "comment": "Malware payload (Amadey)", "value": "2916aea1c9c1217d3bc29e2ecc16922869340bec6d1b2cb38192961a0a7764eb0b9658633bfd99c2c20ba2e9f92ff448", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581854, "uuid": "b3c5e4fb-e6ed-491d-a484-1dd70d058b74", "value": "T1DAC41212E7D881B3D8B5177058FA03E71B367CA0493893673B41A9AE1DB36D4B53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581854, "uuid": "7bc936f8-2760-4903-853b-2527230312a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581854, "uuid": "389abc94-0a67-445e-aefc-2c83adba4a92", "value": "12288:cMr4y90FjNrTOYwrCCbgrSA6NvHfcNQPy8zdikCC6Sd:8yMTwNbg165Hf+apikpzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691581854, "uuid": "f714b8ee-f1c9-48f4-a1c7-abe586d085a6", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691581854, "uuid": "03d51028-761b-4ab5-b13e-d34af936888f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691581854, "uuid": "7150e3a0-8e04-42f5-b24a-ac36b9e5ae94", "value": "f5ac6e1c73c935c36aa734ce70dafd61c88047513feba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a494244f-36d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1691599741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599741, "uuid": "f081b955-37e5-4152-8a19-5e9a8ec14cc6", "comment": "Malware payload (Formbook)", "value": "0aeb945f9802dbd2e6485ca74b71fd34", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599741, "uuid": "69d34d3d-0138-4978-96b9-b80ca32123f9", "comment": "Malware payload (Formbook)", "value": "f5ad8f80ad318e62dcf909cc3830456b7bf855558a62923d4b5b6167f4a35ec8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599741, "uuid": "00c8745c-2daf-4b2f-92da-415efe467d4e", "comment": "Malware payload (Formbook)", "value": "392e10ae44651a1dab9c9f68e882a5abefaebea7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691599741, "uuid": "60da29a0-3d92-45bf-93b4-57111f14f314", "comment": "Malware payload (Formbook)", "value": "9e2622668d5dcc11989727c6bf0dd8d115beba6cdb81fdfa8ece80941e40a2d7fab97614292b8eb30a551efed821b990", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599741, "uuid": "72dbbb95-4441-46a8-a4cc-64b25c099d6c", "value": "T12435E003E804DBC3D41D83F87E530EE91F0A6F19E99569DB04627F9B3B70A72099A51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599741, "uuid": "4e6aacfd-7996-46ff-a1bc-7e704f012b5b", "value": "24576:cRZyQw6VfZy6w6V4jKaWlEzp7ai9dlzZbtQA3Qp5EfIwMx:cbQ6VRK6V4jKjOzRdHt/3XfI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691599741, "uuid": "718f177f-85cd-4220-bd3e-8bb6818e5274", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691599741, "uuid": "8ff2d8d8-5f97-4a60-bac0-19e601d19ed1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691599741, "uuid": "be0aedbd-0190-4edd-b83e-550ab0c30410", "value": "damaged goods.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8358b6-3675-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691559038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559038, "uuid": "6259f196-e238-48f6-a473-86017d983911", "comment": "Malware payload (Amadey)", "value": "4fb4b36d01d9375e6220ea51ba9e032c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559038, "uuid": "fe6b1966-b6de-4d8d-a1cd-2c2aa375064a", "comment": "Malware payload (Amadey)", "value": "f5d48d32b39860994ff0134d3b721f8d3f1add6fa55ed270496defd134c2b482", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559038, "uuid": "e69f585d-6fa2-4b97-ad45-06b45c3c5cab", "comment": "Malware payload (Amadey)", "value": "6a3dec8da2a802b7f6b76d280b7a29cf4d219b79", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691559038, "uuid": "d2133729-01b1-4c09-83bd-65582d26ed33", "comment": "Malware payload (Amadey)", "value": "19afbca2c52b232284b2e3c7118d27498814f3152945cdeefb0fb8e6b5b2ff4c0abc1394a7d86dcc871c703139f16c93", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559038, "uuid": "5636596e-4d13-4ed7-a7ec-e27108a30e6f", "value": "T161C41202FBE89472C9B117B054FA02D31A357CA29CB4932B178ABE5E1C736C4A57176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559038, "uuid": "d504a8fa-03ab-45bc-b7a9-4ef9a6dddfb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559038, "uuid": "70f01a3e-cf3f-49f9-a2d8-44e6b3becc86", "value": "12288:gMrIy90O97Mpt/43M8SeYA0O+gBYCrjV3x6/J9GA+:4y574/43ri5OzfVBwJ9GA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691559038, "uuid": "3dbfca2f-381d-49f8-989e-7879d3f10ffa", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691559038, "uuid": "389da711-9b05-4a11-a838-d1b0bfb2d701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691559038, "uuid": "3e6c7e52-8096-4fef-b7b9-ff6c8d27e716", "value": "f5d48d32b39860994ff0134d3b721f8d3f1add6fa55ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5317d4be-364b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691540763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540763, "uuid": "d6bc8340-07ad-461b-b713-1713cf459446", "comment": "Malware payload", "value": "d551c4827d935d36c7ef63d0d3edfd81", "object_relation": "md5", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540763, "uuid": "05c415fd-4f4b-41b6-a9fc-737991092eeb", "comment": "Malware payload", "value": "f63d7b47f65cb89bd23032bef103c7576f9f1f0086c62d31f4da59e81c34259c", "object_relation": "sha256", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540763, "uuid": "4b8f3451-e6f9-4942-b285-fa1cc7149f78", "comment": "Malware payload", "value": "9db94ea59d04b2c8d8e01a822bf5b7c1eadd994d", "object_relation": "sha1", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691540763, "uuid": "cc92310b-97c5-44cd-ba18-8ebc50cf5bc6", "comment": "Malware payload", "value": "95da4afb099752ea943b672077d2f28ae0160b047f86b171f51cf34830155b01d326ef8e6023a428f096827ac2a4122f", "object_relation": "sha3-384", "Tag": [ { "name": "185-225-75-33", "colour": "#CC9E9D", "exportable": true, "hide_tag": false }, { "name": "FakeSG", "colour": "#824C9B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540763, "uuid": "f499f052-a76b-4201-a478-1d54deca4dbc", "value": "T1CAC533139B219E94E413317FACDA7920FE6E9336BDA2BD1C866AC68350D9CD6D56CC00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540763, "uuid": "5bd07c69-84f6-41e9-9235-0c769cd2c2c1", "value": "49152:OcqtE+5PWZMB1qEzda5D/GatWTjvE/OOKncjznXkPv+fiu:OVtEgPdiERqpWvMOODP0n+fF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691540763, "uuid": "dc86e9fd-e2d4-4dcb-abb6-ce1bc6c68609", "value": 2609107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691540763, "uuid": "6f7aa723-74cb-41c6-8c9c-1ad3e249c2be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691540763, "uuid": "ea369617-58b6-44c7-bb16-1db5c435a62d", "value": "independencest.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e757e279-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571936, "uuid": "5ecec46d-9703-4557-bb50-9b8eae2c3bb2", "comment": "Malware payload (RedLineStealer)", "value": "18e2f65856adea2f7336ea302d1a58c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571936, "uuid": "e25ccda2-7bb5-4ada-ab84-8540c76248de", "comment": "Malware payload (RedLineStealer)", "value": "f6449d4e6dc9393eb01f57949cf77981bf2ec0c4855e5ae902ed512e0be48aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571936, "uuid": "88231836-ea59-49e6-ade6-efb694026007", "comment": "Malware payload (RedLineStealer)", "value": "6f5b60ea6f8b64335045440ec6a99bf244064038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571936, "uuid": "5dd00534-d3e3-4fd8-a9b3-062fa8deaeb2", "comment": "Malware payload (RedLineStealer)", "value": "cae02060a1c89d54b794f8e4ec725717a9d18a4c852863bc601ae0dcc79ee06ff07b475e82dd7146eb18ac82079dba42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571936, "uuid": "da3eb432-4aa1-41aa-96d0-2098c410184f", "value": "T140C41203D7E89073EDB52FB058F602931E367C624D78836A274599AE19B3BC0A835777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571936, "uuid": "9039e9ed-0d7f-4194-8873-1a4e237ce0c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571936, "uuid": "8279bf86-78d4-4d70-b126-6197fee3c443", "value": "12288:5Mrqy90C51QtWF8nAavlo+38rKNQaWfOhDcAfOmJ:PypTyo+Mr6/WfYDc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571936, "uuid": "8a923843-afd2-4e6a-921a-4f553ea6fbb0", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571936, "uuid": "d874962d-08b3-40ea-a1a5-0a47ba3d1197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571936, "uuid": "e3fe7d01-a1ae-4b2b-acc0-7156221d23ed", "value": "18e2f65856adea2f7336ea302d1a58c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852c5b94-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1691549437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549437, "uuid": "33080820-d19b-4fb3-9c59-c2db4b580dea", "comment": "Malware payload (Loki)", "value": "eb6c6bd7d85535f8e516a6ded6be132d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549437, "uuid": "0fe76743-e803-43fa-9941-98cf821e6496", "comment": "Malware payload (Loki)", "value": "f7021617f41a370a760b4e9760922f5f7672e162ee56ae862f9da5121e86bd0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549437, "uuid": "7eca6f83-0429-4f36-9126-be63e72c3493", "comment": "Malware payload (Loki)", "value": "6c75ea020d14b71527669b5d84e29775b0146c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549437, "uuid": "60c5b193-95a4-4adc-ace6-98c8daa8ebe2", "comment": "Malware payload (Loki)", "value": "f2fd603ecc76cfbcab6bb9f50b54e3a09815d18eaa415d55e11c26e435c322fdf17b674c14b2f4d89a93815cdabfcaf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549437, "uuid": "3faf3e14-eaef-4be9-90da-43737b48ae62", "value": "T170F4063C15696E8CF7A586FCB2704CFF17A4692F80BBF9F3885CA4D706A97D04502266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549437, "uuid": "22bbf397-51f5-4b91-996c-814abc47b642", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549437, "uuid": "7a17fdb7-2fe6-4251-b195-e719b8bc066f", "value": "12288:VEEDipEOSLYTVhT29Uy2WG5TGb7qPLa1cW4K3rtkpPKxn:VtDipEO6YTVFK2WG5TG/qm1J4K3sCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549437, "uuid": "f56a9222-aa56-4292-b78e-7227a1700354", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549437, "uuid": "ffc7f610-ec26-4ce5-b33f-8610cd992b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549437, "uuid": "6544872f-d2ca-4c75-964a-cd88d00b0ae7", "value": "E-Invoice#001818843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805cedfc-365f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691549429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549429, "uuid": "4d1fdcac-f99d-4d67-ba79-b2193e7f1117", "comment": "Malware payload (RedLineStealer)", "value": "667527b46b3dd0c730ca7a302df10a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549429, "uuid": "5f8ae2e1-889c-4bed-aa18-e31a9a55046c", "comment": "Malware payload (RedLineStealer)", "value": "f7e60889b9396913bc14a6e130e320373e1bf1d2a1c588cb9302711e698adc85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549429, "uuid": "d59d3125-b0e9-4c0e-9489-171324611186", "comment": "Malware payload (RedLineStealer)", "value": "a2bf7b5c3d9033e280a8f17c68bda0abac4a2af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691549429, "uuid": "922b0749-e670-424d-9017-42803a268ab1", "comment": "Malware payload (RedLineStealer)", "value": "c7c5e84ff3d271deebf7c3c4a0bab86000ba2737ad8bd816e32e312af0a530585dadfcf3ec8ee6868e55dba60a0837a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549429, "uuid": "dea8ecd7-c3e5-46e3-aa3c-554a0dab98b7", "value": "T165C41122AAE8D036DDB517B568F712C30B35BCA18875867F27468E5B0E73AD4C53132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549429, "uuid": "7ea3e3ac-dc70-4b2d-ad6c-363a486e3559", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549429, "uuid": "a7efee38-9973-44bc-a77c-16f42f78a68b", "value": "12288:PMrUy90zGwp7FjSQU2FApvvmnXyQU3EJS:fyXwpxjSvVxvO8CS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691549429, "uuid": "be9fc4f4-ee34-433a-b5cc-58f186a47587", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691549429, "uuid": "8fa3faf6-49b3-4ac8-9388-35f35642a90d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691549429, "uuid": "fc6d9525-0bc7-40dd-b82e-bd94d07b3c12", "value": "f7e60889b9396913bc14a6e130e320373e1bf1d2a1c58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3145ae4c-36af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1691583656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583656, "uuid": "2e8bfe5b-9aaf-4137-b4ed-4b0f7f2afaf9", "comment": "Malware payload (Amadey)", "value": "482b777c17575c518915d0423a9a7c31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583656, "uuid": "8346c68a-15ed-4595-96b9-63ca89cba926", "comment": "Malware payload (Amadey)", "value": "f89dd69d865509f7eab095beac1ad73591012bfe5fe0a3ac892678a99bac11b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583656, "uuid": "0883abc6-c0b2-4667-ad00-38a3e107a80c", "comment": "Malware payload (Amadey)", "value": "64734ddfba60b214a1552be7744d0a6de207e1a4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691583656, "uuid": "2b2dbc8f-02ec-4964-920b-241736b2443e", "comment": "Malware payload (Amadey)", "value": "3e634eedd6f6758245ac2b33e39100401b24562276230d8b1b5bb137ce958ffdd219f2aa4fbe2d9be2e271c0c764d5e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583656, "uuid": "43c39b5d-7ff6-40d4-ae55-8c81710ab831", "value": "T10FC412479BD88132CCB613B058FA17D30F39BCA19D7AC71E2245A95A1C336C4A63376B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583656, "uuid": "05076ac4-1b8c-44d3-a80c-d342a598b194", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583656, "uuid": "e2a31b0d-df89-4589-b7ba-2e04d76f1986", "value": "12288:FMrfy90pFwGTcgFfdkErCJeTXCC4RNgBYCcgO7gH/BQFkO:WyAw4cgFfXoMzLO7gfB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691583656, "uuid": "4ee1d321-3497-4a31-a8d5-cf40439bfeac", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691583656, "uuid": "1f32e50d-f958-41a4-b347-10f047e8c4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691583656, "uuid": "9e504d3d-2ad9-4127-a0e6-564a0f7deedc", "value": "482b777c17575c518915d0423a9a7c31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bb6c02-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1691571688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571688, "uuid": "d9115f76-9b87-4fa3-922f-13865806c458", "comment": "Malware payload", "value": "abf56e7d4e936a25a98279ffd09be972", "object_relation": "md5", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571688, "uuid": "ae5735b1-8dc9-449b-be1d-143b1d2a3ac3", "comment": "Malware payload", "value": "faaad410c8c8d4a1008700953239604b4c25db1d8a61139f962464d48f5a5352", "object_relation": "sha256", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571688, "uuid": "67a60d43-47dc-4c83-917a-fe3ffce9bcc3", "comment": "Malware payload", "value": "e498020f47c4e450e59e20ed3d33779a0a5f1be4", "object_relation": "sha1", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571688, "uuid": "309c9636-1cc9-460d-9318-f753818ecdb7", "comment": "Malware payload", "value": "12bd3a29d3756db537520a2220436bf20e21b6712e59aa21400163a2d6032dc85eb893926fda374ab3361abf3824c2ec", "object_relation": "sha3-384", "Tag": [ { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571688, "uuid": "7de4229e-d9dd-4d66-968d-0bdd0aa7a69c", "value": "T1426633D0514C9F46BDFDA22EF716F68B8C4B274831BA591C80658D196F93C73B8322B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571688, "uuid": "67706401-8808-4d83-ae96-210a7fc283c4", "value": "196608:IeWGG40MOrc8qaJ0iVFPq6gP0IFTeWbbwnhS6c47YfD+q:IezRD8vzGbMIFTjAnV3kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571688, "uuid": "e71ba171-709b-411f-b98b-c898837186f7", "value": 6519888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571688, "uuid": "8bf7bc95-ce15-47c7-b40f-3a0ea4729953", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571688, "uuid": "37d356fb-f60f-484a-b368-77fa419a6836", "value": "arq1A3bD5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f821cca4-3686-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1691566381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566381, "uuid": "90c89d40-cfed-4c56-b7d7-6db6a1e8a1ec", "comment": "Malware payload (AgentTesla)", "value": "4ee46eae1d7757b7bb1892c06fcb2393", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566381, "uuid": "ff643e52-58a8-4947-b204-1c06a70d100e", "comment": "Malware payload (AgentTesla)", "value": "fabbc9025f69a3acca316e85321c79bf83901f320a03d1efbd864037f5c7085d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566381, "uuid": "57f79bc8-d720-4ba5-ae84-67e98a090573", "comment": "Malware payload (AgentTesla)", "value": "f66ff8ebdde840c622c8e3a7fec6000d59e83558", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691566381, "uuid": "6019f6a8-d413-4ac1-b83c-6d55ffaa300c", "comment": "Malware payload (AgentTesla)", "value": "673ee5815a4625df80596f5ac1565fc2e1eebc8193bfc29721f088af0e5ce1856e022d5112866138df99652cdd704ea9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566381, "uuid": "4efbb80c-afee-4894-99a7-cec369abfc88", "value": "T1B6E4120432B58A6BD67CA1F107AA068047F5A24D993AE9DF2CC916C7D2F3F05E740E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566381, "uuid": "b80bf446-35f2-47e3-846b-a8b472f0dff8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566381, "uuid": "a01ea3f5-aaf7-4ddf-ac15-374622f9c484", "value": "12288:qOSLYTy4+0LmXZdQcqxUrE5dn+5ulADsTQqRrxrBXJ6SeXH:16YTS0LEQzxUrYn+5u6oTdR19J6Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691566381, "uuid": "7a5bdf6b-4e6c-4967-a6ab-97eed0477e95", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691566381, "uuid": "02a8f3a5-1baf-4517-bfde-14d02c07afa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691566381, "uuid": "4504aa97-a439-43a2-8151-8a2f6937eaff", "value": "4ee46eae1d7757b7bb1892c06fcb2393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34894744-36b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1691587098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587098, "uuid": "b325c562-cd7c-43d5-9e49-a6dc6bc07d68", "comment": "Malware payload (ParallaxRAT)", "value": "18462ea23f4eb50b95c5c3c30674f26c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587098, "uuid": "d79a9092-8a76-438f-b171-797e43583484", "comment": "Malware payload (ParallaxRAT)", "value": "fbf003e40568ccf053e2abd44541c8a2da441970e6e59231612de39ee0d0273e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587098, "uuid": "1c412736-3562-42e3-8590-f596c9b8753b", "comment": "Malware payload (ParallaxRAT)", "value": "052ff2ecd199f4fae7965edc8a5ae0fe45583a10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691587098, "uuid": "c60db339-62cb-40a8-92fc-03ee215083b2", "comment": "Malware payload (ParallaxRAT)", "value": "782174269b7123338c29ca3bfe804749968443b8f298f8122db8fda560b9c11506adeaf4a3250ce2954c9c61a178ff96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587098, "uuid": "9bfdca55-9e24-4432-b226-1f7eafef69e5", "value": "T1D8854B721109A41BDCB4C7752253FEB5A871EEE9B91EC2A25FD0BF6B783514C096B203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587098, "uuid": "3e886738-7205-4e15-bf7b-3e462dfecd71", "value": "c4d010441c17e8245adced7fdcad59f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587098, "uuid": "7f2f0d69-3c39-4aa7-a5b3-b117989b1c68", "value": "12288:QNVVsrGvaRlb2nZS1dUpSp3fHdwBhT3eTcS5x:8VTPnZSXUpShfWBhT3ewS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691587098, "uuid": "d065519d-bdaf-47ef-9725-810a6d35a53e", "value": 1717248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691587098, "uuid": "da5d7cd4-8cee-4dae-8fde-1cca6f4ff06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691587098, "uuid": "47a79d6f-2efe-4144-9825-d7666ca1d985", "value": "index.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78adfd4b-364f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1691542545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691542545, "uuid": "93499222-affc-4af2-8f1b-329aba8b845d", "comment": "Malware payload (STRRAT)", "value": "30bb7390115b12a186b7669772988121", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691542545, "uuid": "988f025f-0ed9-4e72-b14b-7cee4e44ea76", "comment": "Malware payload (STRRAT)", "value": "fc50cd702c7bb3811aa49a445e4fe6057d2e71f2c19f27fe897386bbf6ec7c11", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691542545, "uuid": "a50f25d0-1100-4b80-9cd5-5046de00b314", "comment": "Malware payload (STRRAT)", "value": "a23a15e81070e313a5ac7cde682fe7c3eeb0c2f8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691542545, "uuid": "42ce025e-a328-4eb6-a090-c11a73a8529a", "comment": "Malware payload (STRRAT)", "value": "8a0abc1d2eecd1ca1be15333645b3107cf5b5396b91c5eb7531268709a0d3e72d3f5680d3c3cbf5d541fca651775dcba", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691542545, "uuid": "111002d5-8f40-4777-9db0-5d4a42947a55", "value": "T1BDA413893855EAB5F0A7A5735C5256B6595D43ACC28FB01B22FE2A020E30DED5B03DCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691542545, "uuid": "9e5be73a-52ea-4815-887e-4b3715e4c32a", "value": "12288:WvJ9RM4TS3hHJDyxieR5pjWaWWXsKwKuClvfRoQtK:WvJohpesecWcKw2lvftK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691542545, "uuid": "cec3b0e3-3bdd-4e77-86d7-b21dc8aa51f2", "value": 457417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691542545, "uuid": "8d5dc8da-24fb-4ade-ab22-934a0e91b87d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691542545, "uuid": "60ccf649-35b0-44ab-a5ba-d3bc6b25fe32", "value": "NETBANCO TRANSFER 3307281 EUR .jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed591082-3693-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1691571946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571946, "uuid": "bacfa391-5cc2-4bbf-888d-220924e6e627", "comment": "Malware payload (RedLineStealer)", "value": "862bfa95fff21671fbe2eaaf8b5a73da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571946, "uuid": "7193d53e-72a1-4da6-a17d-fb1946afded3", "comment": "Malware payload (RedLineStealer)", "value": "fd1483009f8b73688521dda68d8b1c9d928cffd2c8507b306477d91239f1b199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571946, "uuid": "a618087b-becb-49ba-8f65-cc523722e927", "comment": "Malware payload (RedLineStealer)", "value": "2e4cffa0ce215c05174dd1af204fefdd46e8eb9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1691571946, "uuid": "a28aa60d-3abe-414c-a698-260223f57904", "comment": "Malware payload (RedLineStealer)", "value": "f392b5416684ab5f4e85693735b771da4b5feab1044510ac020aa572341e75c8c432769a5896687e2c401f33ae0654f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571946, "uuid": "a99e77da-6e28-4312-9e73-49e14db6702e", "value": "T1E6C41253A7E98137D8B1277008FA03C30F367D61A975839F23869D9B0DB2690A97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571946, "uuid": "575469be-e765-41b3-81cd-e5daf95f5a41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571946, "uuid": "fd6c2817-1690-4b12-be05-61ae6e2f31b3", "value": "12288:6Mrdy90fSCFarmme/lcMsMA+Xxq/IKichx7tC:byoSXrmmClFA+h3Kichx7tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1691571946, "uuid": "78e81b20-5337-4b81-933e-127ee3a8dd99", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1691571946, "uuid": "51b2f2cb-df52-42b2-8287-440e2f656bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1691571946, "uuid": "c0081b28-3000-410d-ad86-e66b79a954ab", "value": "fd1483009f8b73688521dda68d8b1c9d928cffd2c8507.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }