{ "Event": { "published": true, "date": "2023-07-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-07-22", "timestamp": 1690070581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "eb98921b-a191-46a1-a730-6a146d2cbd6d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51649c77-2865-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690012611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012611, "uuid": "d3f6f4cc-9062-4dcd-8672-3fd59e740b6c", "comment": "Malware payload", "value": "f540d84aa68f4db4a4a40f850949f403", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012611, "uuid": "db312fb6-8567-46bb-95ff-f2e2debfa63f", "comment": "Malware payload", "value": "007f7a8b294caad2eabb046df5d2b48130d1586ca623d6d425fb2756105f26f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012611, "uuid": "7a77e79d-0c69-4aea-8280-84926ec58b9e", "comment": "Malware payload", "value": "533ad8538436793fc0d61c2972764d5edefacb21", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012611, "uuid": "437d4944-8015-40f1-acd6-f661b7038821", "comment": "Malware payload", "value": "5154c22eb2c910822c4cf6ae04daf10978bc42b688b43a56a58d188e3c018ff2f8dceee1a69076021f7f7494d50736c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012611, "uuid": "9e955a20-8ba7-4316-a837-6e236a14119c", "value": "T192E34A07B5C1D8FDC8E9C5B44BAEA136D931F41D5234B26B27C4EA236E4DE205F6EA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012611, "uuid": "486b6e4c-b913-467f-b900-ac27866dba2c", "value": "3072:wex8zfVEfcvcq4n4EUxI7KnKn1Ke/SfTVsmcQnfQt/omr2:wex8zfWjq4LbAJ8t/t2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012611, "uuid": "b0dc80e5-c8ff-4182-ac28-bef80e06c7e6", "value": 151208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012611, "uuid": "7df08952-7a99-436c-8d83-89fe59ebcb3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012611, "uuid": "da774f39-68ac-42ac-b91c-57d6b699b101", "value": "x86_64-20230722-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be54b4b-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009273, "uuid": "09b25468-f72b-40c0-8ad6-f4fca3afa79d", "comment": "Malware payload (Gafgyt)", "value": "2d5feedda6639502b6f302d62e72ef3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009273, "uuid": "d5142312-4981-46fc-b444-b9bc660dae42", "comment": "Malware payload (Gafgyt)", "value": "05160814cad1c079c36112d7d186ea51247393f99c56390341998dfd9430d168", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009273, "uuid": "1ccde13f-650d-458e-98ba-cd7100adba6c", "comment": "Malware payload (Gafgyt)", "value": "6ed30d7bd77d9ae836752818362bd018523ec354", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009273, "uuid": "d2f585b1-eb43-42fd-8e2a-f54c002fc334", "comment": "Malware payload (Gafgyt)", "value": "d3472df2d5519cf7767244f22950c732bdabe64c284a4076d198f88b86310cd8c7a5f802eaca049a90cd6cdddb7e0e4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009273, "uuid": "d33155b7-2b2d-4eae-b166-1e08bea06c35", "value": "T1FAD31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009273, "uuid": "11860091-1574-4631-9438-fbd919b34964", "value": "3072:Sdf+fvEqa9FazYA7IboRh5e391CErktmCQA9FX9aH:ifWEqa9FaNh5e3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009273, "uuid": "ef822098-a377-45c3-a9bb-6d811828e5ed", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009273, "uuid": "5419a307-39e2-4f3c-9ac5-a3a115eea556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009273, "uuid": "2ac82e15-60b0-440b-b925-1864c5407254", "value": "2d5feedda6639502b6f302d62e72ef3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d648cf54-2868-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690014123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014123, "uuid": "a0bae6d5-d3a3-4899-a608-6d29e0a67f8c", "comment": "Malware payload (SnakeKeylogger)", "value": "234b4926590cedf9517347b6c8d02afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014123, "uuid": "2f8386dd-a2e0-43c4-a4ef-f6358471abcb", "comment": "Malware payload (SnakeKeylogger)", "value": "05ea84c903e4eb75d9defe3cd550ef0ee979086ade208e9cf84f5d80530820ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014123, "uuid": "0f9ccb60-2f7f-4cce-9284-f7146eb53ad0", "comment": "Malware payload (SnakeKeylogger)", "value": "3de64f470833a28906cb1c03bb23dd844842831c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014123, "uuid": "56e01a44-815e-4d37-9b70-94d83e01e4d5", "comment": "Malware payload (SnakeKeylogger)", "value": "f6e84919056e7d7e09f55a122deb060a4f8652dfe56fda698b845430e091ffbb93c2d9c8315741c46bd4070de80b889e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014123, "uuid": "adfd047a-3f27-4f1b-b6e7-974f09d19663", "value": "T17EF4173858BC1627C5B4EFE58AD09427B2E0A96F7214ED346CD357D64206B05E9C3A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014123, "uuid": "1b1a1290-9c1b-4e26-aa5e-023701596c45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014123, "uuid": "1b71b902-c43c-45eb-b152-a98b0a76e11c", "value": "12288:SO7c7DBL+8KXXB+yji5ao4BEfWgr2h1vUGfjHGtqBgSOVxO5qN:SO7S1L+8mBbmf4pR11uYgSSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014123, "uuid": "5f5817e9-4f96-4bf8-8ff5-c04d606291af", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014123, "uuid": "a52cd4c8-fd6f-47a8-a36d-6d9320deb565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014123, "uuid": "9d104019-13cc-4941-9203-ef5e2464d90a", "value": "BBVA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c9e51f-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014879, "uuid": "f29cbba6-e7a9-439f-aa6d-7575c16d7b45", "comment": "Malware payload (AgentTesla)", "value": "25df456a869d743850ff06b2e6c767d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014879, "uuid": "f2ae67c2-6ebf-49a4-b44b-b2b23e452d19", "comment": "Malware payload (AgentTesla)", "value": "0658452ccc78328852c795489f159daee6833e8101dc16ac93538c6c7c8b39df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014879, "uuid": "57be711f-5953-4b0e-a6a9-52626546f7a7", "comment": "Malware payload (AgentTesla)", "value": "ff562751dc0bc00d2d47ce2d4a2b1dc85c5284b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014879, "uuid": "26b65800-c198-48ed-81c8-57f6a054169a", "comment": "Malware payload (AgentTesla)", "value": "7d791292e2d73da41ced4f8457f861635747290eccce2241fbb84f41604ab7c761f407be7fb0e7d18f6228bdb256d76b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014879, "uuid": "878ceb10-c320-4189-a7c3-22fbfbd02277", "value": "T112453AA460B84967D87ACFF19EE5942231D2AE6E7064C43C59D677961273302F0CBE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014879, "uuid": "e478f473-1fef-4fae-9faf-575b56d6e10f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014879, "uuid": "d55d9f89-9213-4b6a-a72c-1176553721bc", "value": "12288:fR0Txd7nPeWHxfAfrms5xvHdxSAZOQZ53KrEVvW+f18ICh/iRZCBcvkq8cT:fRHOoKYFx4QD3518IWiRYMkqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014879, "uuid": "016d71b5-0ed0-4a82-ac29-c777850ef17c", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014879, "uuid": "ef6fe559-2011-4673-bf43-49dd3987a82c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014879, "uuid": "778847e0-d1b6-4824-af92-5349f685eeae", "value": "Swift Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a50c1ce-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997943, "uuid": "0bf135dc-e27d-49bf-9635-189af85d214e", "comment": "Malware payload (Mirai)", "value": "360cbc1a257045f33e71a3285e73aa6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997943, "uuid": "2d3f3441-17bc-49de-b0b9-9517c01bd002", "comment": "Malware payload (Mirai)", "value": "0762e779655fc96669905b3ed02595e07ace387ba834716673d9e90ce09cf9db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997943, "uuid": "48ce9d56-9d5e-40f3-bc06-15bc2e428912", "comment": "Malware payload (Mirai)", "value": "7ba210984f4d1aa5bc2ec7118700ec3aea3894d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997943, "uuid": "e22106c0-8777-42fc-af86-e1a3292aa2d6", "comment": "Malware payload (Mirai)", "value": "37f52afdd293d519467fa0fdc155fff1663f02f7e1593e76e50b738ec60173d1e513744f12bc8133937148e182e84501", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997943, "uuid": "6f13b83a-b32e-42b7-98c1-ec19c448e67c", "value": "T13393741AAFA05EF7E8AFDC3346A91B4524CE5416258CBF75BD30D918F20A24F15E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997943, "uuid": "b5b3ec18-71d5-4cc2-a219-3729591b1981", "value": "1536:GRWuNskH9ZBLPtSZRop6/hWOqCx5E8FjBwFudSZCLHS8:iWuNskH9fPtWap6DrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997943, "uuid": "5f7e3d32-f98e-4edd-8adb-d497b8209850", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997943, "uuid": "44574aec-a20c-44b6-abfb-1d7327198073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997943, "uuid": "a75b088a-0bb8-49c3-bde3-25abf47eb569", "value": "360cbc1a257045f33e71a3285e73aa6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed6dba6-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009332, "uuid": "38ab6d4b-d6d8-4215-9c7c-9dc01df0a0ae", "comment": "Malware payload (Gafgyt)", "value": "fab43a3dd6d6f74e8e0f96a99da723ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009332, "uuid": "d551a0cb-81ff-47d5-98d4-c63101fa0be5", "comment": "Malware payload (Gafgyt)", "value": "083464e8d3faa8abdc324ea8cdab22a7c6559fcdad7b23a855b844d3ddb0632d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009332, "uuid": "eb2f45b0-7783-49a8-a636-648c08287fcf", "comment": "Malware payload (Gafgyt)", "value": "b8ee7a62f58ea11f481a456d5a729bbf7d77bb81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009332, "uuid": "6f0c127f-7e4e-4293-8ceb-e75cd0fcca6b", "comment": "Malware payload (Gafgyt)", "value": "ee3028512f4ed120e73bb78d4944c6a5ba3687cadb25526c91c7a1c6a23ad704f476ca520d5297bab3854e9f719fd0e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009332, "uuid": "56a6fcd9-0d34-48d2-b9bc-851b99355572", "value": "T137B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009332, "uuid": "7c8bf237-b1e7-4043-9154-59e222a81f6e", "value": "3072:WD3l+XQzPeV91310pWudFKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCFypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009332, "uuid": "59cd9659-6d59-485c-b6aa-7d03a01df7ca", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009332, "uuid": "4b9d0694-3229-4ed6-8c4a-0ecd396c7d4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009332, "uuid": "ce7f660d-54f8-4a0a-88b9-d69512289398", "value": "fab43a3dd6d6f74e8e0f96a99da723ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9713bf77-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009292, "uuid": "f7d41b5d-fb25-47a1-95b1-0ef1c02b29c1", "comment": "Malware payload (Gafgyt)", "value": "1552aa05cef5cf5c09b926b1c1975265", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009292, "uuid": "a7c15b09-1c78-4f58-afeb-032c7e3c03ce", "comment": "Malware payload (Gafgyt)", "value": "0875fb31ee20b92ae680917bd3e41ed262ac252e868ba9438780c040a3e6ba7b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009292, "uuid": "6fa6a24f-6746-45e2-b514-15c1cbfb57fd", "comment": "Malware payload (Gafgyt)", "value": "ff7fddd3f54eb4bffc80d7d830636c5a9ae591b9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009292, "uuid": "9e264191-e4fe-4e3d-8be1-3f7f97622578", "comment": "Malware payload (Gafgyt)", "value": "65a7eb42551877ef6bbe4affd8eec44b4bef3dc4f839b0e60156c4df85a376482a314ee44340fd2cae329a381cf9b866", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009292, "uuid": "0e9762c1-81c0-4eff-865e-c43c813f638c", "value": "T1D4B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009292, "uuid": "14c0ee79-0321-4135-92a2-b37a9ff7cfe9", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aPvJmDk1c8xF6KjW:jfO8IBeJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009292, "uuid": "98f9f346-7c30-41ed-bd8c-01ead05efd26", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009292, "uuid": "fc89ce19-2f16-482e-ac23-c6c32a1be117", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009292, "uuid": "4059e137-c940-4457-9ff1-3c7a37985c45", "value": "1552aa05cef5cf5c09b926b1c1975265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27dcdde-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690014895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014895, "uuid": "4b7fadaa-c5b3-43d5-b952-4b6023fb48ae", "comment": "Malware payload (AsyncRAT)", "value": "ea971e3b958466f0b14b9a0b8f752a04", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014895, "uuid": "19be058a-c87b-4104-b56b-18cfce084658", "comment": "Malware payload (AsyncRAT)", "value": "0b4652f096693f203cc8cec1a127dca3f07f8226a370d04d59f8f8cd42fb6a6e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014895, "uuid": "ba46d570-543d-4355-ba37-48b1784a31f1", "comment": "Malware payload (AsyncRAT)", "value": "602d42d166faa27e7c7c10d6ab61c87e34a20b45", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014895, "uuid": "24503356-97d8-4871-bfb5-deed17e413ab", "comment": "Malware payload (AsyncRAT)", "value": "a3aa4e60cc31b66271a4f75a5d09ddaaa99be0865503ab8e79f42c1d2db826cadf96e5aae65b777f28849186c52d830b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014895, "uuid": "0063f133-624c-4420-b9fa-1e61bedbd853", "value": "T1DE350201BF8147B2E5B2C6315939F941F13EBC253F369A4E329CB2188736051D2BEA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014895, "uuid": "26a941f4-70bf-46e1-bc62-0b22b507f9db", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014895, "uuid": "ab46a9a7-0cc0-4691-adb1-342cd1bf522a", "value": "24576:wNA3R5drX1Dq0OFpE0i/jsrjRiwKq+S3LfK7h+y56t:p5pSWvArN+S3UV5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014895, "uuid": "a3f8718d-dba6-41bf-84dc-a7640aad33de", "value": 1144376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014895, "uuid": "5a8702cc-6fd2-4247-974d-dda1ee14ca8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014895, "uuid": "8c2a9183-d10f-4157-ae65-327440172513", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2996813-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014949, "uuid": "8b56a45e-d44c-4542-9fad-3f19662efe2b", "comment": "Malware payload (AgentTesla)", "value": "2308afb29349e08b76bcf859df53b090", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014949, "uuid": "5cdcbd13-d332-4303-95b2-b0cd2dee8c0a", "comment": "Malware payload (AgentTesla)", "value": "0bfdb30b85547479156f90746ad6218d4d246db35506b2362bdff2850c277046", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014949, "uuid": "c3c1d050-3f4f-45f1-86f6-ccfe334504ad", "comment": "Malware payload (AgentTesla)", "value": "2aabd93125fbd8b1479b47a540ef1afa4a8b03af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014949, "uuid": "2117c001-6bde-4543-ad9f-c44b8ef6a9b2", "comment": "Malware payload (AgentTesla)", "value": "e12c563d935f5fa5650c164ffd9214fa069914c5b7da3fc085447f512af924e9cd649f626852aba5c8de04240f874d1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014949, "uuid": "7ef80cb3-63e3-41db-9f59-e259a25f2c6e", "value": "T14005273818B81727C1B4DFF58AD09427B2D0A96F7214ED38ADD357D64216B06E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014949, "uuid": "9caadd3d-e1ff-4848-824c-d618bd991e9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014949, "uuid": "c67a7721-d621-41c8-a440-f0cefc5ea564", "value": "12288:SASwoDCPvD2oW51oAshGsGvb/BGGL+/+PdIF+UB3ydhy7TZ:SA5oDKLhW51UYvLZO+iF+U8u7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014949, "uuid": "e57ecf1e-c312-449f-884a-3295268e9e7e", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014949, "uuid": "7059100a-3b98-4b7c-9bab-c21658991dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014949, "uuid": "ebb6fb61-8deb-41e6-9586-26fe0808dddf", "value": "New Purchase inquiry-Harman, Tijuana Plant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851d11bc-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014845, "uuid": "c918c636-11a2-4eaf-af47-6c565ece5628", "comment": "Malware payload (AgentTesla)", "value": "38fac24186205e7e454668f493ee4be8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014845, "uuid": "9b53d8ac-71eb-42fa-8675-8e5accaa411a", "comment": "Malware payload (AgentTesla)", "value": "10278cf5ab1c5f5546dfb1304bbda18ca675a0e8e1349dcb0ef31ed6194faf8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014845, "uuid": "efa9cca7-c11e-4b1e-90c8-5f884f278321", "comment": "Malware payload (AgentTesla)", "value": "0c0b6cf267e9ce8bee16231bd1de791cd19cbb0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014845, "uuid": "c844c626-1451-4574-9016-74a3c95b306b", "comment": "Malware payload (AgentTesla)", "value": "4ab43ebc33938f08203f1c433f37cbf83ba408dd9739796a954af1d9ca72a38368a298e86e33f14d700b3298d4eeca0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014845, "uuid": "41ec9cef-8025-44bf-9a70-2ee6ddc08a2c", "value": "T1C6F3286C9299BD09C33D0078C5B111181AB2E1B7926FE76D1DF19CFA3E167C3362A8B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014845, "uuid": "efebec73-3ad8-4ceb-83d6-34e123cfb210", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014845, "uuid": "c3a16cc7-c7c1-4b04-a8dc-229a2de3f8ea", "value": "3072:FgC0YbTjSGhw/W8wVz2lzfVpb9D1lH4zX/7rwwH/eGU2wVN2lPfT:FggTuGhKiz2lzf79bH67rwbHHWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014845, "uuid": "65199216-18d0-4be0-ba66-7b30021d3387", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014845, "uuid": "bedab012-2cfb-430d-8fed-e181926936d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014845, "uuid": "3397d72d-b16e-407d-8445-64bd86fd61df", "value": "1690014844c3742c1e27fb0ec507a0146e30c61b964e0a73d281b6ad7d5c87da1a2ed558a6215.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7dcdb3-28b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690048922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048922, "uuid": "a1b7cc62-91cd-4499-a10f-401da01e2ee3", "comment": "Malware payload (Mirai)", "value": "79312df8dceb1895e22840a6554aab05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048922, "uuid": "4b000a8c-00d7-45cc-af17-5fa2f75a125c", "comment": "Malware payload (Mirai)", "value": "120a22417e07b551a3f0dbf2269c0f251bbce8dd59b261051b3f6bb2aef1489b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048922, "uuid": "1b669a58-c173-4a5b-8315-35977ca0e007", "comment": "Malware payload (Mirai)", "value": "8ac98bd02cff66f84f31c5d65a3dc0dc1595d0c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048922, "uuid": "4834d334-0d75-4fbd-b0af-afd0733421ea", "comment": "Malware payload (Mirai)", "value": "f7a1843bfbaa717d741e8b221b6bf5922c8e0001b418301cad2b3d5b2b0da3d13840887c05538290e03a424cb698b635", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048922, "uuid": "30d2d40e-a815-4509-bc89-c7605193e677", "value": "T1DD630986F8818E12C5D41279B92E168E332367E8E3DEB2139E206F6037C796B0D77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048922, "uuid": "f16e9593-4025-4236-82b7-8c817d885d32", "value": "1536:DJnH1k8Au8CaAAJ58weQzl8cjzqIyiF14ikx4gsaCD:s5uDSn8wek14ii4gsaCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690048922, "uuid": "0c4fdbad-7ac4-4597-899f-79e6e269eb79", "value": 66868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690048922, "uuid": "39930001-b517-4055-8ead-5af22a8a9a86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048922, "uuid": "3ca1f8ce-3ed0-4a51-85de-8cf186dff666", "value": "79312df8dceb1895e22840a6554aab05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54714e8e-2865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690012616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012616, "uuid": "b1eaf50d-a4cf-42b3-801d-60ca903a6b59", "comment": "Malware payload (Mirai)", "value": "def5309c9636a26ae5f1d0e5f45ef1bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012616, "uuid": "cad401e8-4062-43e7-8a1c-6f457aee52d4", "comment": "Malware payload (Mirai)", "value": "1270f6c5612c0290136f39dddacb05e8c566a7b4d5c89a0543535560a73bdafc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012616, "uuid": "3665aa5f-0fe3-4d7c-85a8-09f0e72ff317", "comment": "Malware payload (Mirai)", "value": "d4b30a2944992d9262a9dde4fc27012e0202f122", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012616, "uuid": "690fe46f-8843-4a80-9bd4-f91f288fec85", "comment": "Malware payload (Mirai)", "value": "c22bb63e228e1313f520504ea546cefc203dac0315514e54c404630d4280a5992815b3418540cf91acb189b750c26f53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012616, "uuid": "c59fe2e2-f7b9-4441-9233-c3eb4b0f2a2c", "value": "T165142A46EA418B13C0D62BBAFA9F424533239B58D3E773059528AFB43F8779E4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012616, "uuid": "16a7e409-1472-4dfe-9a86-c730ea25d9d1", "value": "6144:nvenI4kiharnsWJ1M9yY88ZWzVG7M/RLz:nveLkiharnsWJ1RLOIGw/Bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012616, "uuid": "e4a56d08-72ed-4393-a3f3-8ad32ce03bcb", "value": 198618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012616, "uuid": "669e58a9-71f6-4e3c-822e-15bb491c1b56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012616, "uuid": "43440d07-e34f-4311-9d01-9b1e7f24c8e1", "value": "arm7-20230722-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32df16e-2877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020533, "uuid": "b3cc9f80-cbbf-48ed-8428-e9f37bf6c725", "comment": "Malware payload (Mirai)", "value": "87ad5df65877911752f0695502a2fad0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020533, "uuid": "e876a8a8-ac01-4793-9fe5-832e99cacbb0", "comment": "Malware payload (Mirai)", "value": "14ea2153d259e32b9d984669f384d9283646bb2c0cb8aab5af3e36a8a572c019", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020533, "uuid": "4e9fb185-22be-4745-9783-7ea4d063b256", "comment": "Malware payload (Mirai)", "value": "6aacc4036211805e74240350037b3b292e9729fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020533, "uuid": "b8247049-a386-4957-a077-2d46e3bf9665", "comment": "Malware payload (Mirai)", "value": "2819afe7bd6d07679fb5da2dbdb455debe579bbb9fed95de4980d765a330535a548e37c772e247786ac84c7e8a5be571", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020533, "uuid": "f829a573-d151-47bb-be39-5f06ac4da26f", "value": "T1BA93D51A6E158FBCFB5D873147B78E21965833D626E1C101E15CEA01AE7434E782FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020533, "uuid": "1ff33866-1606-4689-b6b3-ede0be4a5e48", "value": "1536:/KjR523x3NlGlwOqbqtgxJpnWe2jj0bdatc6bveZ9EQofLh:e0h3DGlwOqbqtg3piSdn6bveZyQALh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020533, "uuid": "a0a52667-3a95-4175-b6e0-420ee4906a2f", "value": 97588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020533, "uuid": "4ce108db-3a91-40cc-8d19-9ed9d7296eac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020533, "uuid": "f61886d6-c4e5-4534-ae5d-7d17194882a2", "value": "87ad5df65877911752f0695502a2fad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a568f2e-2869-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690014237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014237, "uuid": "90d8340c-413e-4aef-810e-8a27fa0d9e58", "comment": "Malware payload", "value": "2ed373afafd4b253ab056d3d0cbaded0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014237, "uuid": "8ac1eeca-582f-40ee-a11a-83d1ce8148ff", "comment": "Malware payload", "value": "1682b6e3f9770c0c176675b486558a833a6ec18fede20fcdf19a3fffc0254e26", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014237, "uuid": "19bf5cee-3bf0-4cbd-9528-29f610e55964", "comment": "Malware payload", "value": "627c27e53c97899b2f72e252057a7c63959a61f6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014237, "uuid": "4feb3540-d821-4d48-afa6-52f5e263b9c2", "comment": "Malware payload", "value": "6d996ad86ff937fc68ef4a12694b23b0690b13e3bc71b02f92bdab27460e5218e5db338c1bd85393b65fe8f40235cf90", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014237, "uuid": "10620f1a-6c94-485e-987e-feaa3cc14d6a", "value": "T17CC49F1176CAC933C57A06B0261EC7975629BE644BF2C4EB23CC6E1E1D739C05276EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014237, "uuid": "68c0e1a2-3004-446d-81fa-b2ec09fca5f2", "value": "6144:6jm1dXY5AJCirDow+ZsrLg3bmfKlGzIqSqYf+SAOfVKE/M5TiyXCvCYgPLC:6jm1lY5Alowv43bqKlRHJVa9iyXnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014237, "uuid": "5cbad924-8205-41d8-a54a-7b217d8dacb5", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014237, "uuid": "73416e2c-267e-4fbc-ab3f-f8b5e1e07e92", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014237, "uuid": "46885ae0-3bac-4a3b-a4fd-00a4e1a900b2", "value": "DOC7186723912\u0370.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f75ca18-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689998005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689998005, "uuid": "8c82cd62-5e77-4f23-86a2-bcb08012fb9a", "comment": "Malware payload (Mirai)", "value": "429ff363364575d9c5d36be36e44b394", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689998005, "uuid": "ebed9918-71cc-4dcf-b4c7-7a6e826c8c33", "comment": "Malware payload (Mirai)", "value": "185393bd3da49d3414dfa291d1932bdfb50f077b7f70383549c6589e6f0d33c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689998005, "uuid": "23639cff-f080-4787-928b-94a7d0992332", "comment": "Malware payload (Mirai)", "value": "8269762fa80c7a2a6170ed27254c38ac346a4844", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689998005, "uuid": "93cc15d5-d2bd-4bcd-a8e6-424a87dd78d1", "comment": "Malware payload (Mirai)", "value": "1a87978b1dfed4ebce31cd264d8ff0888cca6cfb431ab8f426204982889ff681768a115c44cdd86189891bec3976ddbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689998005, "uuid": "1481d903-6812-4cfe-9cdd-4aee371e8a6e", "value": "T1AB633A46EA97F9F0CD4506B8206BAF74C436A8333130DFEBEBD8B9179D56742605226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689998005, "uuid": "041e00e8-8fd1-4055-8154-1e31bd22f672", "value": "1536:IeAolofbYYQsBehM1XcB3xmSOUd3dgb28SbmDuGr:IeyssLcBZk2Xb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689998005, "uuid": "3e65a0cd-695c-48cb-b51f-776064ce5211", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689998005, "uuid": "2af8ba54-6c97-4e13-83a8-267750516742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689998005, "uuid": "1252bb59-3979-43af-9945-2a987118ebbe", "value": "429ff363364575d9c5d36be36e44b394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56836f3-2848-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1690000431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000431, "uuid": "2edacdd6-afae-4b8e-bbd1-54488ead93d0", "comment": "Malware payload (XWorm)", "value": "103746e75cc79da6379bc879dd58b17a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000431, "uuid": "8a7565a4-42b1-45af-ba5d-222e21f806e9", "comment": "Malware payload (XWorm)", "value": "18ff5c6d7aed24f4bfe05429a1e37df23de7a4e096e2667bf387b9ed392a5121", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000431, "uuid": "58670c70-008c-47db-bdec-e3fcad1e472f", "comment": "Malware payload (XWorm)", "value": "555ce45d76c0149d46832609e2f96c24b4ea28fb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000431, "uuid": "f9a763ca-76bf-4d4b-9f85-b06eab5f8dab", "comment": "Malware payload (XWorm)", "value": "ff474fab3ca33b179aa8fb65e99938b2310cba6d2e46d0c099005bb604fc2bd003ecba17c3ff107cea745f9d4695ac84", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000431, "uuid": "6eb3a99a-ccd0-45a6-b44c-c4aac4bda0a5", "value": "T157A4C15A0AEA3C10DC9FC52DA76F7D6C4392034E5A0274A906FF4C586B396CF21E5DCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000431, "uuid": "9e832451-ca26-4611-8171-953baedb2374", "value": "341ef3eec107cf8949a849080b1bfce0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000431, "uuid": "a9c1b4b6-43db-48e1-a823-53928738cbee", "value": "3072:5Jva8TO6HM4cRRk0fn3zpOuF7+Qr7skOY6Z1ueyqUTiDd+vvYLgsfF8bYThAK2AG:yLXntt1RK1ueJUeU0QYTCGDpWxdCrzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690000431, "uuid": "66ab6a2c-a4e3-4d4c-94db-d10db5c3ad22", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690000431, "uuid": "cdc6e685-dc9b-420d-b7ee-fe333edb9f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000431, "uuid": "31e02d68-59f2-4cf2-aae1-dd5862110821", "value": "103746e75cc79da6379bc879dd58b17a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22879dfb-2883-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Arechclient2)", "timestamp": 1690025418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690025418, "uuid": "4bf15d8c-a9b1-4b10-bf59-92eb9b28ee31", "comment": "Malware payload (Arechclient2)", "value": "1196284ac6cd3491888576d7094d7ea6", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690025418, "uuid": "aa9a2428-984e-42b4-8a72-c14d3c5fed69", "comment": "Malware payload (Arechclient2)", "value": "19fbb1ef1049ad18f52375ae9f7657e9f48f7e4a1bb5ce70627c771e3356744f", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690025418, "uuid": "2e55fd0c-6cb2-4ecd-88bd-4d44a2937d97", "comment": "Malware payload (Arechclient2)", "value": "c335ec45404a965d7c060f6d3862b7484d588256", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690025418, "uuid": "6813cf73-8fff-47f3-ae3a-7c82717bd9de", "comment": "Malware payload (Arechclient2)", "value": "1270e068b425074bc7cdaef10d1301d6e0b7215518bb8f8d894c922ce4914f3213f363d1061b0c47c0cae92c7424203d", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690025418, "uuid": "34a8918c-0809-49b9-b949-ac2d94a2c69b", "value": "T12677333FF2B8757DC49B1B3109B3825098BB2A50B9168C0B47FC754CCF72A611E7A65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690025418, "uuid": "089db271-ad7d-42a3-bdac-6a57d7258f1c", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690025418, "uuid": "ebe2c156-3b85-4aac-b408-4bc16da0f4bf", "value": "786432:2AE+r7SBgIHOD1EGjlPHADvVRlHuXsUorS/wYlh3s1wq7:22irHOD1EGhMdO7oreow6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690025418, "uuid": "774827c4-37ae-46b9-83cc-170b9083b385", "value": 33500958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690025418, "uuid": "c68ac9db-04a4-4ff2-8f33-d9afc40ce46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690025418, "uuid": "666e0b8a-fa59-4897-b942-2e650f2e75ca", "value": "1196284ac6cd3491888576d7094d7ea6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eec2cc-28cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690058083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690058083, "uuid": "4d07c918-18bd-4307-a489-a4486be99a97", "comment": "Malware payload", "value": "1d4d10e00c7c418aa1c6ce6e01610046", "object_relation": "md5", "Tag": [ { "name": "Bard", "colour": "#078A4B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690058083, "uuid": "d542a8b2-911c-449c-a408-61de3c897a9c", "comment": "Malware payload", "value": "1bfcbd2a866aa2d221d07f4f70a80f215fe6954b41538e63fab30d7a9e2d8a3f", "object_relation": "sha256", "Tag": [ { "name": "Bard", "colour": "#078A4B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690058083, "uuid": "6a4f8f5a-0bd2-47f6-8768-33ced0a088a4", "comment": "Malware payload", "value": "79ab6a5eaf27543e86c8cbf73d67c5bac4adbb90", "object_relation": "sha1", "Tag": [ { "name": "Bard", "colour": "#078A4B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690058083, "uuid": "9d265655-0fd9-4b48-bca3-d0b24585d048", "comment": "Malware payload", "value": "f2f0509d02191cbb5d0b5327d97b1dfcbb6c83a4af4545dfa8b506cb4e0730737a49ba2826ec829cfbea15ec0496e9c1", "object_relation": "sha3-384", "Tag": [ { "name": "Bard", "colour": "#078A4B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690058083, "uuid": "1d83418f-f330-43b4-b795-9df87135a313", "value": "T12446334BB8CB1F32D12A47B5709F53CA9E694E040B47162763FB738438F27147AB859A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690058083, "uuid": "1e48ade3-d41a-4740-b01d-0d642ad13d60", "value": "98304:ZNWMy2eOSmUNQiveS0nGRehMc6zEmktLFt7s365qqXxHw+v+y3hfHDdu7gQDb:ZNWMyLOiv4GRemc6zEVtBt7Q65qqXxQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690058083, "uuid": "172346df-723a-4e76-8308-2d1a942c84dd", "value": 5881344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690058083, "uuid": "3f7c223d-d2ca-4a3f-809e-05b5881693e5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690058083, "uuid": "5100c712-a41a-4289-9aa2-aa4b49e7c6e0", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af76076-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014855, "uuid": "2a4467e8-c341-4fdd-8b99-f3acfa33a1b8", "comment": "Malware payload (AgentTesla)", "value": "9f56fd088faafafcc8746b1374718629", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014855, "uuid": "fbb7a6aa-ec83-45fe-8eaa-3ee27c57732a", "comment": "Malware payload (AgentTesla)", "value": "1ecc0f1cbcf7576078ecef752a046ffb0e74036ec376aba57cb0e2e9d713fbc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014855, "uuid": "0887b046-4a67-40f3-a0a1-6c165e4e6147", "comment": "Malware payload (AgentTesla)", "value": "d5f63b8df546974f792c4f6746a196eb6fe0de4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014855, "uuid": "9eea9197-f4e6-48d6-9290-a450bf7a641b", "comment": "Malware payload (AgentTesla)", "value": "17359bb9faca0f71380f61e5e9d68dd2d50ea40dfa478868e09a4a6d39f70b6b860795e0f7cf891b5ac015dd3a30d08b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014855, "uuid": "91fb6321-7c17-4864-8c14-20a1c9981d5a", "value": "T12B256A3818BC116BC179DFB58BD9846BF0D49C6F7121AC3DA0A63B564332A46E8C763D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014855, "uuid": "0f9ebcd0-063a-4fbd-9a5f-8197085b1e20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014855, "uuid": "9c8f753e-525a-463f-a94d-3b0424d1607f", "value": "12288:BH38Xqlx+VCZTbqsaOVTQsW4aUVTi2e4LN5cxbZy4TjrawZc1sSgWiE9Y:zlx+V+vaOVEliTiMR52NYn9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014855, "uuid": "88e17146-30d6-4dd5-ba4f-4c81142bed6a", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014855, "uuid": "ebfa243e-900e-4591-b164-8a7b851bfff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014855, "uuid": "5da2c9af-d8a8-4775-99fc-25f2aaf66348", "value": "Hesap hareketleriniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3405cf64-286c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690015568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015568, "uuid": "f3ab5775-501c-4b95-8305-b939eb0dffa2", "comment": "Malware payload (AgentTesla)", "value": "93eb22aefe5000ac0fa0b37308c8e99f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015568, "uuid": "f37212e7-6c34-4395-a14b-f03e812871f9", "comment": "Malware payload (AgentTesla)", "value": "1feb15724d833535b02c0850a01f91e8c905559be740ef4b3d80fa0d50139a4b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015568, "uuid": "752d1637-cde7-4ba7-87c5-e805cf853571", "comment": "Malware payload (AgentTesla)", "value": "1e2ab759952347cb172141fbb0974b4d76b4d97d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015568, "uuid": "36681645-50ac-4661-99f9-5b6a4946380e", "comment": "Malware payload (AgentTesla)", "value": "a0a664b8f7af53e76085bfd45f273808fa3414bb1940842ad31d53899a349e605f7b4e633767402d4bfe8defb4bf6d1d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015568, "uuid": "d10bbf56-e39d-411b-83a4-a6c5e730b925", "value": "T185B423F7825F9C8965A99D97B28DB433CF26EDA95716D0D9630FD0CC0AC1B402D82DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015568, "uuid": "adc74518-3a74-4b0b-9661-daf457bf2ab2", "value": "12288:YWSqLyQh8C7Pg5rqSlC4XqNMU+6VFC3rs7mXfsiY1:YWSuJrotlC34Frot1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690015568, "uuid": "3795b2d9-9c3f-41cb-8345-d014a78cd881", "value": 525849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690015568, "uuid": "0e45b30b-7311-4f60-829a-0c8d2e15f1d4", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015568, "uuid": "826b52a1-6aea-4de1-88fc-2d311b9c0d20", "value": "Invoice_Ningbo.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0251fa65-288a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690028370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028370, "uuid": "610fce7c-4ade-4190-b47d-894c79f6f806", "comment": "Malware payload", "value": "60052342b32beeb4a5c8245b2ea694f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028370, "uuid": "8330cafa-12f5-46b6-978d-8cde291f4e9c", "comment": "Malware payload", "value": "26d7222f388489a3b762386fe0e1b23a8904e2bc3f009054a4d874c957778000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028370, "uuid": "a45c8ca4-e34b-46d1-bbec-33ff3f9a8c39", "comment": "Malware payload", "value": "17c5455178763cb275377254d9b6f11615002119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028370, "uuid": "e59fb48c-3471-4323-8a0a-16ed8cec1165", "comment": "Malware payload", "value": "11ead7bc3f3499ef7449c34d9b492b60ef240bd17e1271bc4898aa90863264c01d211dd97e60cc42716b0d51c82736f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028370, "uuid": "3de8f313-fb2a-40cf-8dc4-e19b10f058fa", "value": "T119C4120536645AD1C4EB1D723DE07C8CE2B6EAB56D0ADB2A397C109C59F2F32491335B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028370, "uuid": "81be41e7-be48-41f0-baf3-d92da0cd3aa6", "value": "12288:jLVPh6LOMfyXnXaVQKGkyN1Fijh8PCXD3OLAwMCoPQCRU03:jRZ6LVw9kyNuh8P8CyUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690028370, "uuid": "4209da5c-53fe-4965-8d28-0cc00677d9a8", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690028370, "uuid": "b9001020-313e-4e2f-8143-b4fa53932806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028370, "uuid": "85d40843-45a7-4147-ac35-97babfa2c93f", "value": "Payment receipt MT103_tt 9630 print.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b45b36-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014880, "uuid": "a069414c-eb27-433e-99b4-e871ce4f22e4", "comment": "Malware payload (Mirai)", "value": "94d99580317f2b719afd6e1d21dba624", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014880, "uuid": "1462c950-b581-44d4-ab1b-72669f0459f2", "comment": "Malware payload (Mirai)", "value": "2ae6459c45def58cde36088cc319149975d3dd64f391d03d0a39eb1b2a3f8d6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014880, "uuid": "cc2e7101-0458-4331-931b-98612f92f6b2", "comment": "Malware payload (Mirai)", "value": "dbc394cd068258ae9d7886b7a01eb70cc0fa802f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014880, "uuid": "2646bbd1-e6b1-4b89-935b-89be94743fc3", "comment": "Malware payload (Mirai)", "value": "1777fc336582824059acb1946e3ddda4caa2933a21cebbb86fe1c36f15f8dc8c8dff2602d2f3cab4383a5e841cd58411", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014880, "uuid": "ef326553-7f6e-4746-bcc1-5d031b334a51", "value": "T183A34B37BB130A23C0CA547212E70731BBB5D3D928FA5247BAA16DEC6F166803526FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014880, "uuid": "16a56cfc-2fca-4603-bd5e-487b3d68898e", "value": "1536:xfRuqNM5h7t/RiRt4nCphaQoX81UFkKzO6F6OXj6ufeRTe:OqN8jRiRlphaQoXFFkKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014880, "uuid": "6b6358a0-b875-449b-9cb2-9502f7ab3670", "value": 102445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014880, "uuid": "dd4d391b-7799-4407-bd2a-7c9603fc243a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014880, "uuid": "ff617721-8e59-4321-8178-a528d735c73a", "value": "94d99580317f2b719afd6e1d21dba624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54fc1df-282c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CustomerLoader)", "timestamp": 1689988298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689988298, "uuid": "1e2f3a54-700f-4534-8c7e-77f580de81ca", "comment": "Malware payload (CustomerLoader)", "value": "871cd7088672b28dddc2c9b539c96a6c", "object_relation": "md5", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689988298, "uuid": "93efbebd-0e9d-424e-8325-e642b8996492", "comment": "Malware payload (CustomerLoader)", "value": "2b8cd7175430c7efadb5156b883b63cbbd179579ee58dccb27efc68c22cdc819", "object_relation": "sha256", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689988298, "uuid": "5e2f9a41-92ac-4133-a0ba-fd79b803d524", "comment": "Malware payload (CustomerLoader)", "value": "749ad9c8a8615535711590f483e43e3863118e5b", "object_relation": "sha1", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689988298, "uuid": "bc5d882f-7d6c-4dec-8e31-850a1aeae5af", "comment": "Malware payload (CustomerLoader)", "value": "13007d7f4485dffa98797a183e27de4ec473d59af445f2033d15afbb63b8e906d14edf057c1898aea4e7dff5581391c2", "object_relation": "sha3-384", "Tag": [ { "name": "CustomerLoader", "colour": "#57A5C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689988298, "uuid": "f0cfcabf-454a-4e3c-8d8b-59cc43aeb922", "value": "T13603CF0863EC01B3C5260FBE9D640281537B5B6BF42BDF9FEAC5158A0C537B8A612B35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689988298, "uuid": "a45eb4df-abb9-442e-bdb0-354f64d0f58d", "value": "768:7CP/V7dXgOhYYmu24Ra2DovIieNhIPVQPaFXGXT:Kgaj92m7ov0oWqXGXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689988298, "uuid": "704899c1-10d0-4dfc-9552-055a5357cfde", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689988298, "uuid": "9f244a61-543c-474b-9aff-e6556f7342f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689988298, "uuid": "76643100-c1b1-47f7-8b07-666796529558", "value": "Payment Slip\u00b7XLS.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93263205-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690014869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014869, "uuid": "3ab40ad5-324b-4fe2-bb01-08a1d6f1f376", "comment": "Malware payload (Formbook)", "value": "f9a4e776cb720d51ed1344fa5b810762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014869, "uuid": "c1c4579b-217f-42f1-a926-1b482eadff36", "comment": "Malware payload (Formbook)", "value": "2c6612fb5cf51ee3dbcf0916466f4d0f0997f7bb00cab94c107f1cbc0c870037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014869, "uuid": "debd84ea-0a47-4c91-bb36-9c369f2c6253", "comment": "Malware payload (Formbook)", "value": "a118840fd5b490b9b85c996a5d4fb7c2450fb700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014869, "uuid": "4c5207c9-5010-4e6f-96e0-f677f76a6a3f", "comment": "Malware payload (Formbook)", "value": "bb49ecedf4394b25502c825925a2b627f1a11ddb66dc33d408d59dab391595c69cdfd9fe61cd4b03277029fd05ec132e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014869, "uuid": "9f57e471-087e-4b56-97be-4a984cd49b76", "value": "T1D515393858B8162BC1B5EFF58BD08517B2E0A97F7114D934ADE257CA8205B05F9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014869, "uuid": "e72fc110-33ce-4dda-9dd6-5c93b09912ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014869, "uuid": "f31beaa3-7cf7-4883-9a44-66a0e6e41291", "value": "12288:rqpWLfwObPb8NR/faCrWHPh3Pg1+x5oEeZDcxf+np:rqoL4qPbihrAh/g1OZOS+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014869, "uuid": "ca66b7c7-0a55-4883-9581-143a2e3409d8", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014869, "uuid": "ca479b04-8494-48a4-8d87-c003de4c8ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014869, "uuid": "7b14179b-16af-41fb-a5b2-d2c66e2650f7", "value": "Sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e988b9d8-2848-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1690000411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000411, "uuid": "59d60412-b68b-4e95-8d77-e36812a4ef78", "comment": "Malware payload (DCRat)", "value": "3e151d85fc806f162ecbd4fa54518149", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000411, "uuid": "5f6f709b-0f46-4756-8a6f-fec312aa41a5", "comment": "Malware payload (DCRat)", "value": "2de17fe785af187845aac7bc0e6ad4158912f1edd5ef58af87f45d49bebff089", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000411, "uuid": "681a596f-8292-40d1-ba7a-377af42fe88a", "comment": "Malware payload (DCRat)", "value": "20050a513d76835db73cdcd6469670ece78cce0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000411, "uuid": "a0cd4f59-7c0f-4f2e-ac25-6f22b22887d4", "comment": "Malware payload (DCRat)", "value": "955d96f628f0ef594939f3e1bcdd338545a7f5d53ea108039253bc6533017d7de1695808405ff44af379e15f2e1474a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000411, "uuid": "32495cb4-3003-4fbb-9276-4fe1a72457bf", "value": "T1EA95BE03B7978EF2E2491BB3E5AB1C08E360D983772BD70B798A23555913FAE9D05503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000411, "uuid": "ca29b965-4e4f-46c3-a716-14de19ac19b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000411, "uuid": "54f7bc06-fe5d-4d96-85be-5ec827d3529e", "value": "24576:8miboFDt6r3/jJBYOAvEwS9B0fBhEopns1kVzdP0o6cLe+9vJF1Ws3Nr0nmxG455:8mizlBqXlsCxdPq4vJFp4mxG45Y4TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690000411, "uuid": "478b23d4-5e01-4e80-9dc6-3b1e9b8207b5", "value": 1887472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690000411, "uuid": "f242b530-c029-40d7-bac9-45087c48793e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000411, "uuid": "aacd654f-c33b-415f-b8e2-bbe5281a538b", "value": "3e151d85fc806f162ecbd4fa54518149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4641ac7-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014925, "uuid": "5b75a915-ba34-4986-b5f2-facf9845196e", "comment": "Malware payload (AgentTesla)", "value": "9c23381c2a5470f2d025fc1add1c8d03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014925, "uuid": "b0459288-6f7d-4aa4-b960-2f046753dcb4", "comment": "Malware payload (AgentTesla)", "value": "2deb6ee58cf11a940854730c33d0af2c0e36f5f1ab8d25e6a28961464eababbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014925, "uuid": "6c7413a2-5470-4eaa-a586-ff5c49a6896c", "comment": "Malware payload (AgentTesla)", "value": "fef77e0e1c8b5695b23c14b713f65f70e315a19f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014925, "uuid": "545a6b59-e7fc-4c43-b64e-a5b0819e618f", "comment": "Malware payload (AgentTesla)", "value": "cb2b41f76a98a60a1951438553fa2b7964b639214caa70721fef8a18204afa5b38eccdd1c28981f8171e638ac51d7733", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014925, "uuid": "3c117e7d-5b42-4199-ab6e-78d96d0cc38e", "value": "T1E80501116BA49552C36B69B64C60D1350370AF377C26EE898CE13DC33CF9B44AAD7A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014925, "uuid": "49c5cadf-6620-4714-97b3-d41a95c9362b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014925, "uuid": "a52a7fdb-a737-4e82-b30d-e8d0f79b48a7", "value": "12288:iWc/bUYIsYolnOBr1GzgzHJfSjPAHaq3i9hwFwbdppG2HVfx0:xiXrYowfGmJfS8H1ADpsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014925, "uuid": "dc9973df-4124-4a52-bbd3-cb97a1524617", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014925, "uuid": "7388ca33-6d4c-49a5-bc19-5a563fd8c2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014925, "uuid": "74179333-35b8-40e5-8fe4-97d92213ab3a", "value": "Inquiry_EC8112KW3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75bb3e7-2868-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690014124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014124, "uuid": "f31cd47b-f01d-483a-b182-2634fcc3a6aa", "comment": "Malware payload (SnakeKeylogger)", "value": "160181fd36d0f70df3c26869f9e13a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014124, "uuid": "56a6bd6f-727b-44a6-8b71-5f079a6f71c2", "comment": "Malware payload (SnakeKeylogger)", "value": "2e78012d035442cebd8d05497d70e0e6e5cb6d82ac033aa4b150b444197669a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014124, "uuid": "cba3ebc3-c55b-46b2-96b3-9780e3a87ebc", "comment": "Malware payload (SnakeKeylogger)", "value": "53d4e314a2beefd67959c74dbe476b2f136b0635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014124, "uuid": "86b0eb97-b155-4370-a146-23b22b28abcb", "comment": "Malware payload (SnakeKeylogger)", "value": "fea9da4b951df434dac48dc21fa4c59441eab76f154155ee76e9a4ca14b8987051ead78c613ae63babfaf6f9416b7a4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014124, "uuid": "46b8af3a-f911-4c0e-98fb-d5a3415472e4", "value": "T11BF4163818B91727C1B4DFF68AD48417B2E0AA6F7115ED34ADD257D64206B02E9C3A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014124, "uuid": "622c95c3-96f2-49f7-8e14-b71bed6a1482", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014124, "uuid": "4973bf31-f6f0-44f6-a6bc-5f2fddcf0b1e", "value": "12288:nIhmFEbcwFXWFHjlyuCLx5ayYvIxLbZHyuw3sjMgtz:nIhjbFXqDDejayfZHO3sjBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014124, "uuid": "72239a47-5f0b-43be-860c-65710d0ed3ae", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014124, "uuid": "5cec31f7-1da7-4fbc-9f69-5d4cde8e025d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014124, "uuid": "fb0ac50c-7a7d-4f2f-8392-a40fd894c7eb", "value": "FT 20237 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824b27fc-2842-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1689997661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997661, "uuid": "ef6b74a1-640c-4d92-92cc-df50ba5ace9c", "comment": "Malware payload (RedLineStealer)", "value": "9b52e97ef9a8fd351fd878ebf36f8377", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997661, "uuid": "2466a402-7704-4465-86f7-24cf1575d162", "comment": "Malware payload (RedLineStealer)", "value": "2f94e4ce7f8ee0d584b776988ac0dd80df820f5a44d866271efce73c6ad84fc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997661, "uuid": "bc54b9a7-a59e-4761-8963-a635b8e783ca", "comment": "Malware payload (RedLineStealer)", "value": "8931188c8ae85bc39a0bb7bfe4249d6098533954", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997661, "uuid": "850fedbd-6e97-435e-be50-fa808d0942d2", "comment": "Malware payload (RedLineStealer)", "value": "f134491d44a0c6926e5c53cdb60245cfadaa4c2a81f96f8669d55d973cd090c0cf7a7862a3e9352ae5eaf92ab1b12355", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997661, "uuid": "fe967319-aeff-4dfa-8fef-13cad06c6d44", "value": "T133E5014FE6C08F29EDFB9F77698165904834FE0C046995EBE29C842FBD9A94C0473627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997661, "uuid": "79c43b93-e879-431b-9601-3f9496fb576b", "value": "28f039ba63a716b696dd5058ca2bb671", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997661, "uuid": "74034bfe-35d5-463a-8dc4-fcf9d5a83dfe", "value": "49152:HNR10gLk3Fw7aitvQpBymUlb9vHMQmdFbL64FXm:HNR95yByvlJlcFbBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997661, "uuid": "0d40d533-0a4e-4776-a89d-e87baf874442", "value": 3284480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997661, "uuid": "3e3da36f-8031-4e3b-879d-c4aefddebe61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997661, "uuid": "def3b309-b024-40bd-bfe4-d692eb63dae5", "value": "9b52e97ef9a8fd351fd878ebf36f8377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29376df1-286d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690015980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015980, "uuid": "efa61fd1-423b-42d6-a1f9-5cd4a2a84f86", "comment": "Malware payload", "value": "2593839e8b27c34f5c2c5927628e107d", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015980, "uuid": "93694678-842b-4e04-b23d-a87ae985eb2b", "comment": "Malware payload", "value": "30809034bccaeb33c33d5ebcd9578cf51aa9847d5ba22d956b504327cc4f0c3d", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015980, "uuid": "b08141c0-8cbb-436f-868b-9392b8d3cd40", "comment": "Malware payload", "value": "2725ec8848dfde090f523bf5281ce0efe4b3dc0d", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015980, "uuid": "8ea98222-3ac8-4afb-8e2a-3059e1ca77a0", "comment": "Malware payload", "value": "0b475ad65ee61834d7a6733121c111c342a106e89cf4aaffffa2d59f8ccaccbcc0c2211d56ac6323eec154a5850d690f", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015980, "uuid": "19dcb606-52fd-4cc6-a0ae-896785db739e", "value": "T10B252BF476D077D70FB9290DB3CE41B23D54B857F0EDAD86228D0E1E928035999ABDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015980, "uuid": "7212c052-0a83-488a-9581-658f1e6b5a4d", "value": "24576:9B74hWOyFk6fJfppUekg65HOcWZ0BS/3tpMmjA0YKw:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690015980, "uuid": "075c9728-0b83-4d47-bdaf-6818af888efd", "value": 1011584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690015980, "uuid": "5f855ae8-183d-4283-9cc4-58d11a7baf25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015980, "uuid": "7b6db794-2e76-4847-9453-5ffebabdb76c", "value": "cjvidjixegpaoqhqkefeozdfedreagjrzqnedbijcrqcbryhje", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27a7b03-2877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020505, "uuid": "4e75ecb1-dbc3-4938-8b04-909a2e48d0a2", "comment": "Malware payload (Mirai)", "value": "35fdfefa06d291c922f975bcf44b0b26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020505, "uuid": "e3779060-5d12-4f1c-a41b-8d3357b594e5", "comment": "Malware payload (Mirai)", "value": "347276dafa9ef54c92af6fa03c407048670b1a644534d8e87a0d767058c1e4c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020505, "uuid": "87029464-53ca-4fc2-b739-ae3eda3f2cfa", "comment": "Malware payload (Mirai)", "value": "da876c59bccdf9a6a1d7a02fc6782e8906596b43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020505, "uuid": "78965c68-463c-4b7f-a235-f295d7d2c99e", "comment": "Malware payload (Mirai)", "value": "556b143f2b46da74509604cde873a66f9e2168068c430b7b16b986c74248dda16cace74e6559fb91cecae65d8687fa82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020505, "uuid": "30f4804b-44b4-430c-a1bb-9caeed6ac649", "value": "T10D633B0272280B17D4934AB42D3F5FE083BAE9D021E4F689695FD7658A35E371582FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020505, "uuid": "d24604ef-edfd-43fe-877b-d0879a556a21", "value": "1536:4veYWSuh89s35em7DDja9WkzWV3RF3XcSQw:OW7EmrjWzWVP3sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020505, "uuid": "8acb3a60-ea69-4df5-8d5d-d6e145ba3812", "value": 73072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020505, "uuid": "ae26adaa-b80e-43c5-976d-974b64816cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020505, "uuid": "463656aa-740e-4b9d-a01e-6e6c9c388d6f", "value": "35fdfefa06d291c922f975bcf44b0b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e9ddaf-2865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690012622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012622, "uuid": "d7d93387-c1a2-44fe-b4c3-72e4bf88bdd0", "comment": "Malware payload (Mirai)", "value": "35583701008e651d00b2240957df1916", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012622, "uuid": "84a65e84-b1d5-44eb-aae2-6dfaaddc7f77", "comment": "Malware payload (Mirai)", "value": "3656bbd28b65c6fb97450c191b64da9c31ccf3854f22913083c8aa35b6ca58cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012622, "uuid": "7c0a99d8-afe4-4d5a-8fd1-afb1e0381c96", "comment": "Malware payload (Mirai)", "value": "3357fc15bafe6698d63d46dfa084e548223c927c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012622, "uuid": "cf1140a1-fe24-4183-ae9c-701b94afd334", "comment": "Malware payload (Mirai)", "value": "5834949c72431b6bd7b6959d3eb7eae34941d83a55e8f3a0b4ca757e0c8bd6167a26f744a26eb82bf69c94750545f010", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012622, "uuid": "63fb42bc-7a12-4472-a4d9-ca372941ce72", "value": "T13C133A85FC829A7BC6D0277ABB2E168C336763E8C2DF3313C81027546686A5F4D27B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012622, "uuid": "9ec06e9d-a206-44b6-9ceb-4e80202fa87a", "value": "768:Oi2eOf6/vGIVQOGgG5Gf+IqrO3x+hJ54LPO/zEGOsIWyb2oetKxJkMPbgz5i3sVi:X2ZlIVQOFG5GeR4LO/9OgyblLk8bgM3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012622, "uuid": "258f2cef-c1da-4140-90d7-0220e4896162", "value": 42292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012622, "uuid": "f8e13b81-f7e5-4806-98e3-8076832eff66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012622, "uuid": "7f57b8ef-6da0-46e2-9cfe-21fd6e126fbd", "value": "arm5-20230722-0757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99779592-2889-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690028194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028194, "uuid": "7d572f45-474e-4a0a-bd43-c6cd9398afda", "comment": "Malware payload (Formbook)", "value": "7594e6535ed9faad2ac4bc45f1933011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028194, "uuid": "6a2d2a8d-bafc-4880-b4f9-57323ef0a1be", "comment": "Malware payload (Formbook)", "value": "367222a9425367058f93676221ff6d2dae4418d9656c57cd7b72b73b49f1ab89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028194, "uuid": "80264c0f-f6ca-4de8-a944-6a9a0e3b89e9", "comment": "Malware payload (Formbook)", "value": "2f2923a9edc78448ada0e73c51972a02c690ac65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028194, "uuid": "0a6f7fbc-0b03-4ea6-bce1-d253167f5157", "comment": "Malware payload (Formbook)", "value": "6436f56ea6eb87be2c0144ac8173b03402510250e87ffeff639e7abb2d8db441cd75d53285df53d070ce240aff025962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028194, "uuid": "b3668c87-994c-434b-892a-78fab2327205", "value": "T1DE15DE31F7EBC702C78B4BBCA97D7E7B038A52C5A8D5924B58179D89A995F38040323D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028194, "uuid": "93a47bd1-b495-4e4e-806a-b35aba3f914b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028194, "uuid": "6dc8423f-776c-4b14-b0e9-7df9441a2959", "value": "24576:xC426I5+p4+vGTHLKCFL+fJZLe5gfroAsPXDVfBVfBVf:sx6I5W4+qKC8fJZLugroAYxfLfLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690028194, "uuid": "e6a0b216-99d8-4ff2-838a-d1274625e8e8", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690028194, "uuid": "5c89f673-3b09-4857-aeb3-c2a8b605cc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028194, "uuid": "52d9d830-cebb-41bb-b5b7-19cff64d3984", "value": "PURCHASE ORDER 091020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f4f018-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014844, "uuid": "cb20117f-fd02-4b61-b9a2-4f22c5d7f036", "comment": "Malware payload (AgentTesla)", "value": "04bc0900cb5496072fc72cdb19e11852", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014844, "uuid": "203ae734-a88a-47a1-92c9-9a24850cd1a1", "comment": "Malware payload (AgentTesla)", "value": "37862b04beaaaf7007d5f3095ba345034ccaf5ce574edb01a76f97e895ecbb2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014844, "uuid": "92cd9757-4992-4cf7-9afc-8c59542063df", "comment": "Malware payload (AgentTesla)", "value": "8b2d95549a7c41f710a0ecfa0cab27585e15c941", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014844, "uuid": "05c5ef4b-b583-46d8-9cc9-9d0b6c0f042d", "comment": "Malware payload (AgentTesla)", "value": "565a2fd955718cabb552fc68663a08035a705ef2418d733831759439892a01a02e8dd89a543fd99537638c717aba790c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014844, "uuid": "f05358c1-52b8-40ed-9188-df418edd2dbb", "value": "T13515383858BC1727C1B4EFF68AD48417B2E0A96F7114ED386CD257D64206B46E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014844, "uuid": "f1566999-6ba0-42c3-a14b-6988fc089259", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014844, "uuid": "869767b4-a53a-4db0-8713-f862754d4ce8", "value": "12288:tMrxAT+zDVoQj07JIyg7KplwPZyECeIes0Kql/3J0dPG:tMrx4+36QCLgGXVECeW0plfJ0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014844, "uuid": "31bf56ff-678c-436a-9e66-a5a8d1f426e1", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014844, "uuid": "8e99d2d9-6471-4daa-88f0-edf7b41e1f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014844, "uuid": "4621b34e-4683-4b1e-a8d3-e8f7d622970b", "value": "DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d883c3a-287b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Vjw0rm)", "timestamp": 1690022107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690022107, "uuid": "94a5a9a0-df56-4e73-ad6f-2d88c03764f0", "comment": "Malware payload (Vjw0rm)", "value": "4272d76e2efed7d323e14bccef987913", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690022107, "uuid": "4c0f6f2e-cc7c-4c9a-b63e-9d3c6b5bb3da", "comment": "Malware payload (Vjw0rm)", "value": "39372ec10b2720511f8ca94e8aed43273c507637ec03f9a1eac279aadeb22c55", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690022107, "uuid": "5d3f1231-77de-46f8-8ef7-abe2b8b6bfd8", "comment": "Malware payload (Vjw0rm)", "value": "a8cde379b41cfafb036896484844620a7fcc11c6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690022107, "uuid": "e94a7ceb-5ea4-4602-aea9-4bd49c534438", "comment": "Malware payload (Vjw0rm)", "value": "43d5eabd70dfa1af7b287ea910931bed9f1330e2ef49e4934b352face510f7891c030ee8f54b77d4e24296435b029ea6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690022107, "uuid": "54d536e3-431b-4a7e-9648-6f43674005aa", "value": "T1BAB2CF74473BADD563CF2D271E320B557E1C6C61311B29F8C82AD8A26361C351BB2CB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690022107, "uuid": "b4bdff3f-9bcc-4f58-aa47-fb281c2742b3", "value": "384:0B+UO8kwlbBtHS0ihYvG3bMZcCOQHp4aIX6xEzWZNxFlumanjjjIYNFLD5zvOJ:09ewl7tGr+Oy4aPOL13IoFLdzGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690022107, "uuid": "6bf39be2-d02b-4e5e-ae67-2f50c79458f8", "value": 24698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690022107, "uuid": "ce176b7c-013e-4b7c-996d-5f9507f0cd4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690022107, "uuid": "967c66af-7c02-4a49-9bde-a1ce6d444be0", "value": "Specifikace objedn\u00e1vky.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df5561e-2872-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690018216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018216, "uuid": "3dfb02a8-d567-4da5-8b3c-6fc3e2d18087", "comment": "Malware payload (njrat)", "value": "066f0a61b8ceb0dae6ee3835ffec50ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018216, "uuid": "5a0e74fb-2088-43fc-9394-e57c6692f6bb", "comment": "Malware payload (njrat)", "value": "3a5ff4bd63b123534c8530042cbe88612a96be4f46e37b3eb39069c3d8dbe2a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018216, "uuid": "edea5533-00b2-4c83-b00f-bcde61252e26", "comment": "Malware payload (njrat)", "value": "48df2faab311f23976893f282a8f2a4a7e4d7f06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018216, "uuid": "7d226f45-b29e-4bd4-8315-74f7b634c6f8", "comment": "Malware payload (njrat)", "value": "e31fdd3c393e816477cf7f31c673c544d79f71e08fc2d8cf96af9dd189844e16d2f61a92bdbea40de7ab54d2ec19aa22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018216, "uuid": "abef4140-e81d-4bd5-813b-d29770ab6860", "value": "T1B193E84977E52524E5BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018216, "uuid": "b9ca3354-5528-401d-8d6e-a01b6eb24a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018216, "uuid": "224835a0-7698-45e9-9e14-14616cb12cb2", "value": "768:wY3/ypD9O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk31sGV:XyLOx6baIa9RPj00ljEwzGi1dDlD5gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690018216, "uuid": "4d4ec67a-afdc-4188-8e47-f06b9a1a1ed4", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690018216, "uuid": "7227395e-b3f9-4e96-9b9b-f18f0c3e0199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018216, "uuid": "6464f74b-8de9-4a64-8bce-f89204300c0e", "value": "066f0a61b8ceb0dae6ee3835ffec50ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d9edaf-288e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690030196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690030196, "uuid": "425da4fc-07df-45c9-a57c-a7d4eee0f978", "comment": "Malware payload (Formbook)", "value": "05b70d50e84d2f0e3d2f345a5a5652f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690030196, "uuid": "7cbcacdd-1649-4939-97eb-93682220f3af", "comment": "Malware payload (Formbook)", "value": "3becd96b73bd64deced370cd1249192900f57ce956d99beb8cfdeb073d811863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690030196, "uuid": "af3872b0-523c-4587-8537-afc49e527c83", "comment": "Malware payload (Formbook)", "value": "764c0f27af292a764e7a5f2fea18e39c075c3488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690030196, "uuid": "e2d0e9d9-ff1c-4c9c-ad54-5129a66aa1f7", "comment": "Malware payload (Formbook)", "value": "db7e6c9bad6341fbf185461f7abb2b101871f2d46d8fc1b70f32baa3873e867d94aee3e204782b23fa129372d267a97a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690030196, "uuid": "17e18671-ad75-4956-8ca2-bbb27c5bb23f", "value": "T17EF46B3C08BD223B81B5EFA58FD48427F1D0A96FB211AD35A5E75B554702A12F8C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690030196, "uuid": "1fdb1f72-f05e-4d49-af51-17936f786211", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690030196, "uuid": "9c5728e2-bae9-440c-b801-f1ab10be25eb", "value": "12288:Ex6kjeGbjfnT1+CzOAELsc/tLePpIIHqZqZguU9xjgMyX7Mm:giGnfnxfCbFL2p8xjgzLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690030196, "uuid": "8d3552b7-913d-456b-a4e3-5ea0bf9085c9", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690030196, "uuid": "66f66ff4-7b2f-42a5-8c49-763a35072361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690030196, "uuid": "80e259e1-a44f-4849-b51f-d6e59158fde9", "value": "DEC-TT-PM-#TRTT5344748999MGDMCRTT.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a95cde9-286b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690015311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015311, "uuid": "15fd6ca6-c1df-4130-913e-2498b57a952d", "comment": "Malware payload (AgentTesla)", "value": "29f4a9b774e5d766f15ce000d9c9e919", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015311, "uuid": "9d3e8740-8676-4421-99c6-27cc5db11b08", "comment": "Malware payload (AgentTesla)", "value": "3e6bbe38e8e9e781e0354485ee68334d4b81ae0077a280d2b4c42fc747cec650", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015311, "uuid": "ecda7e3b-56a9-4e40-b5a5-dac096398046", "comment": "Malware payload (AgentTesla)", "value": "cb05bdce70fe285bf23f231e685013617de0d7bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015311, "uuid": "9f59d421-36c6-416e-8772-bcbd4bcac08a", "comment": "Malware payload (AgentTesla)", "value": "41c6eb7134cc6d0d365bfe20f06ce1cad341b83c902e1e3595b8665887f100414d3377974bf0bfd300f9ac5b6398a7a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015311, "uuid": "dd0140e8-2ed5-4ac7-ab80-f1980de2c1fb", "value": "T16205273818B82727C1B4DFF58AD18427B2D0A96F7214EE34ADD357D64205B06E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015311, "uuid": "52e84a15-a9cc-459c-bc89-d363165ae694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015311, "uuid": "cf7fcac4-2d92-4fc9-acfe-4590222d7455", "value": "12288:4RWpWpOhMU/+HJaVBtkosUpALNnQstgC8O+HXiUYVf1T5UA:4RWp/Z/ewVB/sUWdtv9OE9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690015311, "uuid": "c6c63345-c993-4e0a-9ece-5d43ad55ea42", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690015311, "uuid": "13bc0f9d-1fce-4839-af86-316cd110c24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015311, "uuid": "d42a4641-e974-42f3-be0b-4622aa1c9944", "value": "GcCE76hjL8UkxbX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbcb22d-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014858, "uuid": "af0904d9-96f7-42b3-ac7b-f7fc774d9fc6", "comment": "Malware payload (Mirai)", "value": "c3425a2839883dbec80af2c4dde02e98", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014858, "uuid": "13a80b79-ab4a-4e45-a959-7d770c5f21b4", "comment": "Malware payload (Mirai)", "value": "40cea0fd6a719373eeeaecb444ff7b7c93f096d868e22d867a34e4824e9dcb16", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014858, "uuid": "2889bdd9-6ff9-49eb-90c5-eda90b9213f5", "comment": "Malware payload (Mirai)", "value": "f8300adce76adcd7c011c9ac7f191538cc0a64b4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014858, "uuid": "1f047269-ea35-47bb-9ac3-d449a92b8a8f", "comment": "Malware payload (Mirai)", "value": "5d7b5a4463a15826edbd9230322931ccf3d3bf55208623c4ceb4fba516bfa1ead5a86eb39830fd67135a58afadfbf51c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014858, "uuid": "da6d2633-10f6-4963-9d32-72664e8440a0", "value": "T1A2934B17B653C6BAC08747F51BDB9A314923B9BD0B227206B3D4BCE63F129E61D19E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014858, "uuid": "2a8bbf3c-9fc4-4ed3-84bb-b27c6fc52d2c", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3tphauH/njvyig6I9um2Xj5YZb0e:pcCPOkfQfNipGdtphaE/njvLg99um2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014858, "uuid": "6848581d-a92b-488d-8cb4-c0ffea4d2b66", "value": 94015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014858, "uuid": "ec3fd4e9-5ec6-4ada-82f6-2da5f3480f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014858, "uuid": "1dcb9584-6fd1-4a3c-9df2-249b666666d7", "value": "c3425a2839883dbec80af2c4dde02e98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8177fb29-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690014839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014839, "uuid": "5ee4f5cb-118e-466c-9714-9532129e778e", "comment": "Malware payload (ModiLoader)", "value": "345c506c98f0db06efced50956ddc515", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014839, "uuid": "6f484c3d-69a7-4b7f-90b8-42563c4b857f", "comment": "Malware payload (ModiLoader)", "value": "4152ea859c2de1e5aec3aab1d1172a22421c70f9a557a10ffbfc15f523555709", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014839, "uuid": "0e9eba7f-3268-45ff-83d2-b598312ff50a", "comment": "Malware payload (ModiLoader)", "value": "96029a7540ece6f71b9fc016ff37b632f47099aa", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014839, "uuid": "14368c05-0d2d-44c5-af86-b1ea999ebfad", "comment": "Malware payload (ModiLoader)", "value": "605118a68b0be867bf4ffe7fcbea1b4c9dd7908b2f674a515ae665db68de42b750862bcbd308ab77a2880ba1b1ea2f5c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014839, "uuid": "936dbfcf-27ea-4069-a4e7-6fe565a4cb8b", "value": "T17AF49E30F1E18433F12369749D0793A9682A7EF3296899467EE93D6CAF3D7C03925193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014839, "uuid": "728a2527-6ab3-4f55-8ceb-f03d8dc6ca84", "value": "72020b86bbe734c2ed3417572bff8faf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014839, "uuid": "0ae02934-222c-4f3c-b43f-529a266183bc", "value": "12288:3Ouy3CoGtRq54TIhnIvT7SEzI8h4COdzu2bbNYcqE:3lmGtRq5PI6EzI8BOdzu2bbNYcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014839, "uuid": "cbf0c9e4-c3ed-4441-99cb-9c75829cee46", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014839, "uuid": "219dba95-a351-4f69-9b37-77de4f73705e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014839, "uuid": "516c3e71-87a4-4c79-820f-2747091783e9", "value": "DHL Shipping invoice _621407408,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99f7ad3-2848-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meduza)", "timestamp": 1690000438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000438, "uuid": "9964fc01-919e-4def-9754-8e233adb3c11", "comment": "Malware payload (Meduza)", "value": "8a09a2de89ad9237b2befeb40c9d9898", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000438, "uuid": "d176a9e9-6382-4b41-99b2-3b6dc78dd4cd", "comment": "Malware payload (Meduza)", "value": "417f12d6cab86330733d0f575ebcdfa48ec47856bbaf42778a9307ad94c76576", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000438, "uuid": "9d562887-8b87-498d-83cb-f50fcd5a2568", "comment": "Malware payload (Meduza)", "value": "18aae1742dadd167fa56269c31551b87aa57b94f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000438, "uuid": "21708e63-34bf-4ee2-8a2d-ca1e5272da91", "comment": "Malware payload (Meduza)", "value": "4139867cca3d5dc24f10aaa7e45f5457b5c5bb0efceadf541dc8e0e19ac055931067777391b5fce8d06f40305c3e6ead", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meduza", "colour": "#6D96F8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000438, "uuid": "27e1bf37-2dd1-4230-b5b8-29484327b835", "value": "T168F41831E69C32A9D06B9079FD0B5C02E536789E1320BFAB12D55E621F66EE01F3D760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000438, "uuid": "bb851174-a1bf-4e11-b4ea-15a009c35151", "value": "108e18be559cec71db1f519ae1ab24ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000438, "uuid": "37dd05a4-727f-4e61-ab5b-abf2346140eb", "value": "12288:cXU7HmLxa9A35KMRvZLgVALw2/qoBqcoUh5F:cXqGLs9SZLlLdioBqcN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690000438, "uuid": "46044036-4761-4631-8d6f-1d8fbfcaf5bf", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690000438, "uuid": "3c681f2c-525c-4261-a7c6-0b037f504d4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000438, "uuid": "0aff9f9e-30bb-4c31-9d83-be11657ec876", "value": "8a09a2de89ad9237b2befeb40c9d9898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9672d1-2848-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RustyStealer)", "timestamp": 1690000446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000446, "uuid": "b4a51d89-760d-4757-9353-5a61eaec4bac", "comment": "Malware payload (RustyStealer)", "value": "5f6c86ec159f2b0d99f88bc3c3c6a641", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000446, "uuid": "d73327f1-4db3-4848-a695-f5ba3a025dc8", "comment": "Malware payload (RustyStealer)", "value": "4348d0d550e739807bfdd89524fbeb7f4300193f4cb9aa5a62dc219640be59a2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000446, "uuid": "c200d9a9-b7e2-4914-8f58-67586262fbd7", "comment": "Malware payload (RustyStealer)", "value": "124f5dd109c6cf03e07e2d2dc908fc43817e7b17", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000446, "uuid": "81c45019-aa3d-4038-969e-6231c9c7906b", "comment": "Malware payload (RustyStealer)", "value": "8f2c33ee75c5ba3a2570adc0c29ab8a254a086dfb4bce8d9bf18929eac4bd97ebaa92bb0401eb7074854e67db906b59c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000446, "uuid": "cc27e3ee-14d3-4902-ab16-d1c9a9081d51", "value": "T105644B16FB4520F8C05AC5B4C69645627772B8CA0B35B6EF1794623E3D7A7F0AF38284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000446, "uuid": "c2f3a5b2-be0c-43b1-9645-3bc6f3bd289c", "value": "7cd0bbb42d4b316f99f5cabd76b4bcaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000446, "uuid": "6fbd41c4-5c04-4f62-92c8-14f8305d0988", "value": "3072:9+bwPB64+8ZFjwMVuG74CHy/8c77uv6tvkNN0P3ohdeaEK8aTVcZIaKW:9+bwp64JjtVuG7Hy/7uv6tvNPVs+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690000446, "uuid": "09eccb96-d89f-4007-9987-a01f96c42113", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690000446, "uuid": "ad2cc2da-3401-4d45-8147-4deebe57ebdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000446, "uuid": "028e4fc4-dd5f-449c-b8a8-17e043cd805d", "value": "5f6c86ec159f2b0d99f88bc3c3c6a641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd1434e-285f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690010079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010079, "uuid": "52850839-da3a-433b-8c26-d2533cb5967b", "comment": "Malware payload", "value": "0d6b669b7c12f34b7aa393ec6b2fdad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010079, "uuid": "e7466d45-19c4-426f-890c-e03b8c1ec73d", "comment": "Malware payload", "value": "4421965bd3ccdf5f6fe33fea7e98a6ff2879562687b8c045149366b4a33fdb00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010079, "uuid": "72f8a09c-b92d-4f8b-8d82-34b6cd9ae843", "comment": "Malware payload", "value": "9ef744431ba335c6b8ebe53b579ba621236781d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010079, "uuid": "b5ba418b-e00c-4e0c-8ca6-88f14aeb2e39", "comment": "Malware payload", "value": "84f929e7ea8f515c4ff7ba91a1446fee0d473fee74f828bc302b930078032bd01015da1cafd879043997580bc2bb9c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010079, "uuid": "bcbfb0b0-03ae-4ce9-81a0-bfc2c8909b06", "value": "T1AA4523CA3AE5C0F7EC95D57E09BA2B212DA9A77CCF05C2C7CE80150095A1BCC5678D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010079, "uuid": "c04bf2ca-66e7-4150-8eef-7ad67e621734", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010079, "uuid": "30268046-bb2a-4d5b-a825-7ec06ade893c", "value": "24576:U/l5B9ZgPJa6BzO0dBuo/n5VFHyU/wwSiPRMhKxCQ15NWZNzI1WW:UN5dggyvdBuCn5VuUxZDI1I1WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690010079, "uuid": "c20ebc8c-24a0-4c14-8a77-dbbdbbfe73af", "value": 1276704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690010079, "uuid": "a8c41019-132a-40e4-abb4-53c241205219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010079, "uuid": "fd1c63af-17b4-45bf-adcf-58c2ca273808", "value": "0d6b669b7c12f34b7aa393ec6b2fdad0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a062395-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997969, "uuid": "7633704e-fa77-43e6-8614-ee832531b04a", "comment": "Malware payload (Mirai)", "value": "7de681608255ebdaf1e39fa3d5eb8a10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997969, "uuid": "82eaccc2-3925-49b1-9bdc-121206e52a7b", "comment": "Malware payload (Mirai)", "value": "45980c7d2337156b29fdcc651a148beadc30e23a4ccbf96af6c691a5112aa2a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997969, "uuid": "aa1d2941-7a50-4d9c-b1f5-5ef9b4de4ab5", "comment": "Malware payload (Mirai)", "value": "0fe54a0196c5c5c8c5db590ae9f5ab8ac406aba8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997969, "uuid": "f650725a-fba5-4595-9015-a0f0a4545f46", "comment": "Malware payload (Mirai)", "value": "2954e9e8ea29a53a8212a2e58eac83b214189e0ccaf54483b4d77c6ff73b9b3086dc13f201fee5e356a3524418d4a9d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997969, "uuid": "24ee39fe-dce5-492d-9d46-384a90d88556", "value": "T1C8534BC8A5C3E4F5EC001D79307AABB1AA77F53F2035ED9BD39E25639942203E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997969, "uuid": "623898dc-099b-43f1-98c1-8a2ee442e585", "value": "1536:b5VYYpXIqVkxmxRvXMFnKia3jGKO18Hq6PW9m1Tb0+j/KUAm9x:diYpROxmxhXMFnKlzGHCHqshb5/eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997969, "uuid": "2653d3c7-4f85-4762-abac-da7975eec731", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997969, "uuid": "f6d3ef10-a5a4-45fd-beb6-3957d76657e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997969, "uuid": "02bc8b5b-1de2-4c89-92c3-052c772558ab", "value": "7de681608255ebdaf1e39fa3d5eb8a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b441f5b8-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetSupport)", "timestamp": 1690009341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009341, "uuid": "9ddd49eb-c647-4e87-b02d-ff6c8ecf61d4", "comment": "Malware payload (NetSupport)", "value": "bee129f1cc4bccacd607f73735564d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009341, "uuid": "aeb5b11f-d9a9-47b5-bd87-05cfc9d97519", "comment": "Malware payload (NetSupport)", "value": "463e3a3781754963ddd5b65b237ed60d56dd58182abf25e3a3093fadfb68349f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009341, "uuid": "bdd44f28-a058-4533-8f4f-98bf5c4093ec", "comment": "Malware payload (NetSupport)", "value": "868f5d1e1d60b00178679dd6b006aac2a7d8eca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009341, "uuid": "511c4136-7a2b-4d45-8361-657aaee42a10", "comment": "Malware payload (NetSupport)", "value": "688dc041c9786fe1fa20234ac6af40b75c9b3b1d20412860fe5e24403bca9167577c728670a5683e748d93a6f9be4abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009341, "uuid": "358ddc7d-09d2-4aa0-931e-ebe4d653a5fa", "value": "T1ADF5058221CC0181DF6A7134B6AD3AD4D936E4E80F1889EB3FB491D99ADFDE217F5214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009341, "uuid": "ec63c8be-f241-4b78-9d3e-3ebb196baad2", "value": "17271304419eb299ee7ef7a9bddb90d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009341, "uuid": "60ff728e-55fd-4f7a-816e-d210d57b60c6", "value": "24576:bsv556Cux3LfT3AwCXSzww19rehwcwNvs/21CPf/VqlOBh9paD4z17iY6zUzby5g:y5GcaehwJN4f/QlOBhGCY4e59z4xg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009341, "uuid": "c14ca981-e264-4b13-ab5d-2187e7230b0a", "value": 3604616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009341, "uuid": "0ef79ab7-6a9c-40c4-9d67-b9a44bcde340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009341, "uuid": "da11caab-13d0-4709-bfdb-3e5d0660a983", "value": "bee129f1cc4bccacd607f73735564d77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3de34d-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690014862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014862, "uuid": "ced5797b-33e4-44cd-a389-3372fafe18d1", "comment": "Malware payload (Formbook)", "value": "947dbfc5ef8d4e97bf4c1ab1c38a77d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014862, "uuid": "adc9bce5-4e73-43ef-adc4-f663367ff03b", "comment": "Malware payload (Formbook)", "value": "47c4195b8dd140e14dc9284692685c07b4a54c9ca77fcef6d69c7cabd368af31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014862, "uuid": "b36471a0-b81b-4278-baf3-d9d2a570b528", "comment": "Malware payload (Formbook)", "value": "3c517a3fb8bc82a0dde90c4369925f5c4ab20a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014862, "uuid": "32fb6761-4865-4910-94b0-8055bf354ad4", "comment": "Malware payload (Formbook)", "value": "7d4f027dd753f3bc37197922e14bc85da42a060283848b860b3cdf3184e73fcb56c06f9b4c784a61e0b7ab9a9f60c841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014862, "uuid": "6034c222-b5f3-4e04-8047-2bece94f93e7", "value": "T1F005393858B8172BC5B4DFF18AE0A427B2D0A96F7114ED346DD257D64306B09E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014862, "uuid": "fcd69081-890d-44a8-a57f-c0dfad68100e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014862, "uuid": "0c1634d8-ce68-4d76-b920-ce0c54ecb376", "value": "12288:9CUn9z+0cA7sWgXc7JI0kmvn9N++clQsjpLAy5W9WgJJWA8r1D0A:9Ce+01IWgs7iacrFLAyoRMfV0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014862, "uuid": "a47a47bd-2b0f-46c8-8f3a-c63dbe8cdd94", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014862, "uuid": "d80ce60c-b105-4615-827d-636f112ac8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014862, "uuid": "484ba552-2b26-49f0-8493-03e6ffcd4c03", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c15b024-282e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689988873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689988873, "uuid": "0b8a49cf-7405-45a9-a7ce-8468448543f9", "comment": "Malware payload", "value": "97d3a663cc0fed2b60274a302657ccf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689988873, "uuid": "f46ee430-94e4-4f02-9e1b-5901d92fd0d0", "comment": "Malware payload", "value": "481ecd41bef2a33076729680747eb92e4e2964bed89c58825d80f602de19f214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689988873, "uuid": "6e6fee45-7d65-4988-b282-349b8d2b90d3", "comment": "Malware payload", "value": "4d6c53401d4c12c3b1e367797af93e05fe53edd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689988873, "uuid": "ac002da7-9167-41d9-9252-68195014da0a", "comment": "Malware payload", "value": "68a06c044c645acf805b574c0cfbd1fdb6c3a8cf82a71437616aa2383724369ae86dbb0e5b1adf133a26bd0bf14814e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689988873, "uuid": "8a97f458-e9a4-4a96-afc5-729cc2b9ad2b", "value": "T1D01633186F929600D373E3B499D1B3175DA6E3989E89B8F07EEE6875030F9320993537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689988873, "uuid": "5b0a0009-d3c7-4579-a830-71effe3be44d", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689988873, "uuid": "d926b1d0-4dca-47c0-8dad-8b29d0e4687e", "value": "98304:zojXXzpUliP58cZYBGQ4G8aaq4nTCGOZdjxR9CurgD5:zazpUkP6cZEGJZq4nTQZ/LCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689988873, "uuid": "3f655a03-3b24-4bde-9625-c67e21eee0f6", "value": 4159512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689988873, "uuid": "ad24b45d-1a40-4cd8-b3cc-bd4526337912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689988873, "uuid": "7667cf30-165e-4b5b-8a81-5c69c6118a31", "value": "ScreenWings - Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df80c39-288e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690030188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690030188, "uuid": "dd13d812-7de1-408f-a1ed-97a3a53e26e0", "comment": "Malware payload (Formbook)", "value": "fc93f7ef4717f26c19817a8afa8302c9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690030188, "uuid": "0b702a04-8646-486c-9cdb-6e053bdfe481", "comment": "Malware payload (Formbook)", "value": "48d3cb813122f5738d00ebd953fccff30206b81007733ba769fc84ea96f30416", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690030188, "uuid": "8d56eaf2-1b5e-44e6-9ccf-c9168bf29747", "comment": "Malware payload (Formbook)", "value": "88581313267ae17aadddba484980d803e84f161a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690030188, "uuid": "66926de1-d14c-4969-a1dd-e16be76fa5ae", "comment": "Malware payload (Formbook)", "value": "4f00e979905ea24915feb5ab82e01523b4e9b9158a46f6cee68032a17ba4959aa6ee3f8dbd89e8c75b885cb0d60abba4", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690030188, "uuid": "14d2d9b2-ee8b-46d5-8b3e-326d0c49303c", "value": "T1C5D42347C56AB09E6ACD939DEB94E8730BA37FADFC11D4C98350B4488657B7024A13CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690030188, "uuid": "2cbe9d68-422c-46f2-bce6-881e9ac8163b", "value": "12288:r7sDj/p/ISqQeKT9ppUvij54XMGSSarYJicopNkXfOUOGtP:v8lBqMTeqHHcwStP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690030188, "uuid": "917097d3-0f07-4ce2-98a6-a96f669fe71e", "value": 601354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690030188, "uuid": "8d627fda-c1e2-4a07-9fad-9b73c2141bbc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690030188, "uuid": "a70e186e-57c7-44ea-a4bb-133a60f47f5a", "value": "DEC-TT-PM-#TRTT5344748999MGDMCRTT.PDF.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932fce98-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009286, "uuid": "7b69d50b-88b8-468d-a103-ee2cf74b162f", "comment": "Malware payload (Gafgyt)", "value": "6c429a42c0c75141b1b071e6e026bf01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009286, "uuid": "7ecaed50-4a36-4e60-ba2f-d6363c886925", "comment": "Malware payload (Gafgyt)", "value": "4ceb68f8c13e1c7cf081942bcb30bd8132bd807f5c1eaa55d4a7b03780fc2900", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009286, "uuid": "da51adcb-ac6f-450e-b344-6f8bcbeb916a", "comment": "Malware payload (Gafgyt)", "value": "435e81fb332f82a7b17c9fa81fec04dca47fa520", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009286, "uuid": "675cac9e-d355-4c95-9565-e212a751f85b", "comment": "Malware payload (Gafgyt)", "value": "0c36bfb56a1eeb31bdcd5798505467641407818cd0469df2e6be5b5fef0e690ece6f3fd7e9b842cdf4716f98d21be03c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009286, "uuid": "028e9164-4e6f-4347-a4ef-7a4930c2e3db", "value": "T1F5C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009286, "uuid": "588fa249-ab69-4916-8d69-39ff39eaf1e2", "value": "3072:hQrFRNfuLrGhEPOD0ng3gNlmBoHQuQekQnYW:IFzuaEGQng3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009286, "uuid": "0f92973a-b89d-4a08-bf99-459273f9aa8e", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009286, "uuid": "992286ee-509b-420c-8f6a-a373fd96096b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009286, "uuid": "2ce22a3e-ce5a-4128-9a3a-b6225b5a8284", "value": "6c429a42c0c75141b1b071e6e026bf01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e16e443-289f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690037651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690037651, "uuid": "6982f9eb-ad16-4b41-953e-fb923ec78a58", "comment": "Malware payload", "value": "b4ffa97543d4a53601790104821992be", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690037651, "uuid": "d9c4a0d6-3038-4b9b-b4aa-4d9fb69f89ed", "comment": "Malware payload", "value": "4de38de9500f85360d9cfaec46d0d83a117e54a1ac2aaae81df1a8b60411ef5b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690037651, "uuid": "5257c1ef-5ee9-4382-9e82-883f3bc937d4", "comment": "Malware payload", "value": "b06a65fe9aa0784336941f062176ba578ec0a01e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690037651, "uuid": "e92c1553-51bd-4c88-bbea-76741c7863b4", "comment": "Malware payload", "value": "cea140275b12b9e6b1f75631061d5f879f6109947462b1ff5af0f9fd6d47a9c68c0efaf329b3c38353708855d0629b6b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690037651, "uuid": "e7ba1f46-0e35-44ab-9ed2-ed65008e7830", "value": "T1243533AF51A8801EE072CBBC46DD06B1B36771A14B60A7F7BB93C81CEC4C865365C5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690037651, "uuid": "81c21ae4-4a26-4850-8fbc-e89517b97266", "value": "24576:tg/rTBO1MSecon7FZUTo5pHwTTl/SeQD2z25vvemYNt:mMecg7wT3pF/zqeFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690037651, "uuid": "743dabb4-da7a-40c8-9212-0736c007a95e", "value": 1106167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690037651, "uuid": "5cd4798b-1cce-43ba-87a7-99d767d893e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690037651, "uuid": "8aeb948e-2ece-43bf-9637-fdb873350ae9", "value": "com.jdga.gyb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e8b606-2865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690012614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012614, "uuid": "64c7fa47-e3a7-4e97-bf1d-5b55013c63b6", "comment": "Malware payload (Mirai)", "value": "4137e23501f6a2d675913a2c7b7c58ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012614, "uuid": "57673991-e455-4639-aabd-4da441835925", "comment": "Malware payload (Mirai)", "value": "52947a45b4356ea39400dae52788d5ef95e888e318639b0391e38e03d5029ed9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012614, "uuid": "22bad69c-6fe9-47e9-b436-a54db293aaa0", "comment": "Malware payload (Mirai)", "value": "eab529c2e3bc4c7a8588cf6991590a21bd2404dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012614, "uuid": "335425ec-a351-4e2a-8011-2ca6aab5dc72", "comment": "Malware payload (Mirai)", "value": "d3117dc8feb19dc67bb2d79852a9d2999fac07d27a1239074565e5ad6e1e2659ef29a790cfcd490cb42a69c39fa7bdeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012614, "uuid": "a66b42dc-d682-440c-8354-efbbdfb2c5da", "value": "T149E30856E8819B12D5D152BAFE1E028E37131B7CE2DE72029D246F647B8B87F0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012614, "uuid": "c200003b-c032-4c74-818b-5c143762f91a", "value": "3072:rGEw9zOZ6UZehJrXQbWVrP+auDR7/W4Ny5ACYsBtQ:KEwB36ErXKW9maeS4NrVsrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012614, "uuid": "341bb83a-7d3c-4730-a8cd-f9f19c078fea", "value": 156336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012614, "uuid": "5d600a32-03c8-4923-a619-8eb323287a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012614, "uuid": "816c032c-1017-4ebe-b6a4-fdd6e2006287", "value": "arm6-20230722-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44004456-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997986, "uuid": "86e7010d-941c-4da5-8dcc-9e23d232ecba", "comment": "Malware payload (Mirai)", "value": "9449ce5ad282006812d82279a11cd799", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997986, "uuid": "4fa69039-0811-4362-99f7-26034eaa14f8", "comment": "Malware payload (Mirai)", "value": "541595c2d9b2a3a7558934d7261a569742c8770e0c0e43cb28c8fbe5e84b70c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997986, "uuid": "61ac3057-9803-4008-a8ab-845d38a7f082", "comment": "Malware payload (Mirai)", "value": "e3bc4c1520b1d7471072977e4d0cc7e1de48e529", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997986, "uuid": "1e66e798-186b-4d09-9d4b-2b9c8464015b", "comment": "Malware payload (Mirai)", "value": "c3674764114f864e3175a67ac26544731dcba808fa529a5a3fb3761ed0997227cd5b0f10ba9945ab57bab522978981b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997986, "uuid": "f6c865dd-5edf-40b3-8730-49a23c4fefda", "value": "T12C63F6753945F2ACD6E94078F4436EE91E5209283EDCD1E36083143BFF71B88A62DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997986, "uuid": "fdae2615-1aa2-43f1-97b7-60b75a2a1cf7", "value": "1536:RWq4mXBnUM+mxqIKMHIZVBIVCCfy0K9UwE:tUM+/IAun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997986, "uuid": "68a090e2-b706-4387-88d0-716c340d0265", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997986, "uuid": "b5679162-886a-4950-a84c-818cfd9779e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997986, "uuid": "a1d451cd-ed5b-4923-be2e-32e3e73ce692", "value": "9449ce5ad282006812d82279a11cd799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af746be3-286d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690016205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690016205, "uuid": "7a75a98e-9568-4d27-a232-e462e569994d", "comment": "Malware payload", "value": "5312e9199f47a39bc9e0cb9c16179040", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690016205, "uuid": "11e0b31b-4a9c-4466-9cbb-0575dbede63f", "comment": "Malware payload", "value": "54834d1b73182bb6b0546f63f95d0d6a7419552bd64334695ca173ad0776e977", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690016205, "uuid": "a4dee5cc-132d-4bf2-b673-ee1f7ee168aa", "comment": "Malware payload", "value": "0d082e5b4e24b9029df0721a717b80e2bb8517df", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690016205, "uuid": "854938e4-08d3-461e-812b-f29418f15bd8", "comment": "Malware payload", "value": "4f29c025e85dd6fb0db65862ae8f11cf35762f1002ec5a52066803c900365932439b7bc558590642e46fb247a1d5ad94", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690016205, "uuid": "e326a210-59e1-47eb-9b22-9c6f3b088892", "value": "T174352AF476E077D30FB5290DB7CE41B23D54B857F0EDAD8622890E1E928435899EBDA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690016205, "uuid": "c5f33aad-a095-4acf-a92f-b055419bc4fd", "value": "24576:IWDXIu0mwcenrl4860gMFyN36oNLwQEVeXSPhzw25kHGDvx:2DamF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690016205, "uuid": "8139f644-8678-4f31-b248-5c37eaf84722", "value": 1134058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690016205, "uuid": "1c1a4a69-47d4-4aae-886f-636ffb94e9d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690016205, "uuid": "241689e2-d917-44c3-8343-b61fbe680466", "value": "clzncfybqzjxpofwrauxqlfttvvuhgvhbwwhfbfobvyezkdile", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fe0097-28c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690054272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690054272, "uuid": "f94c6c35-9161-48bb-82b1-83a957808539", "comment": "Malware payload", "value": "608521a573ca80a1ba6e08a79dd9b899", "object_relation": "md5", "Tag": [ { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yakes", "colour": "#D5E68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690054272, "uuid": "916c1d31-098d-4938-98a2-06e08ccf29b8", "comment": "Malware payload", "value": "54f52ef506f6649c09838b9935aed223f0f320798e13fdb9541ffd1db3e08816", "object_relation": "sha256", "Tag": [ { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yakes", "colour": "#D5E68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690054272, "uuid": "32b53551-1e4b-4d86-aa6d-81035e9429cf", "comment": "Malware payload", "value": "29b6a8ae869cdc1a95bae83dd97874e5efa79613", "object_relation": "sha1", "Tag": [ { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yakes", "colour": "#D5E68C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690054272, "uuid": "909d3846-df73-42e9-ab5e-ae51261f4f55", "comment": "Malware payload", "value": "1ea063ef4198de7ec936494aa534cff449052deb791062ce79d80bdf3f8ef9a72568078561b58b5f76b337b281f52807", "object_relation": "sha3-384", "Tag": [ { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Yakes", "colour": "#D5E68C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690054272, "uuid": "60bfe773-a14a-4acc-93e4-e401576b8c49", "value": "T14F95BF0333848125FF9B6DB38A5AA35786743C293223715F4F983E6D99B0173677A632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690054272, "uuid": "47ac469e-f59f-4b03-a5f3-0a8461f9d916", "value": "49152:HpUP99FBJZEH1X1arF0EK/2ZIL/8up2yb:Hp82H1X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690054272, "uuid": "5f484ee0-f500-4e0d-97f7-9c445fc5c23e", "value": 1921024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690054272, "uuid": "69a662de-24d0-4ba9-9e84-dab9b92bc14c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690054272, "uuid": "9189ec21-cfc1-4982-bdf1-4c130fa12db2", "value": "no_halt_opts_enabled.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95877cee-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014873, "uuid": "c3151c7f-aeab-4946-862f-4c5cd832e882", "comment": "Malware payload (Mirai)", "value": "632064c827b449d509818a30f87907b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014873, "uuid": "b3fa42ad-3bbc-4a72-a345-9ed2e4697a7d", "comment": "Malware payload (Mirai)", "value": "550b0b4c340384a6d559a9e9cddc48ed67466812a0ab24e881e3c2ce9d7c306d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014873, "uuid": "da1fcaaf-b1dd-4770-bf14-d7a67ceeeb28", "comment": "Malware payload (Mirai)", "value": "82bb65385d261242752da70b963d359e1fd1b568", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014873, "uuid": "822a2bbc-c7aa-4220-91b6-e9548b97016b", "comment": "Malware payload (Mirai)", "value": "d3971a6f9a5bba3825a7c340f5ed224b5abf6be6041e299db889d07c33a474c2032ca9658f66575544bba91750f54101", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014873, "uuid": "054d8c30-0a4e-4102-b061-26e7a643194c", "value": "T1D8A32905F9018767C1D327B6F78F47493B3167B997DB33026A347EB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014873, "uuid": "2f36678a-86b8-4147-ba54-49e7f9f2f2a0", "value": "3072:7e9h9oZD5hvFfKs97Cwnwxj0+rQ0Knm4XATe:y9wZD5hNfKSNMj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014873, "uuid": "d448bc74-a515-4243-8f65-b48e02615216", "value": 103865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014873, "uuid": "bd59d123-5001-4add-9296-ef0f937f8857", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014873, "uuid": "d7b8943d-aefd-4044-8aae-d89b843a7c40", "value": "632064c827b449d509818a30f87907b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db807b3c-28a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690038183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038183, "uuid": "c4db1b25-74cd-4618-a85b-a48263a239a5", "comment": "Malware payload (AgentTesla)", "value": "0bfd0be112294967b5d89483a86e2a34", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038183, "uuid": "70914731-25e2-4f2f-9449-1c9d31ffb18c", "comment": "Malware payload (AgentTesla)", "value": "55d5910cc64b554cccf805c62f50e9a9c2b54c0654570cfd3f73d531aa84718b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038183, "uuid": "c1e0eefa-962e-4f1b-b708-d97d6e05cbcb", "comment": "Malware payload (AgentTesla)", "value": "1fea1de0689ca00227879872fc11b09e4d9ce27a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038183, "uuid": "7105bb31-def3-4078-a0a8-699b625fbd5d", "comment": "Malware payload (AgentTesla)", "value": "3d7f413b921c5fcb11c6fd945d20a04ac7ed1326c6a2bc1886de88c82f76dbfad0dbf01a4d66e6b6a4ee69f89db4891f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038183, "uuid": "41bff9b1-70d4-43ce-851a-e9ea43de1daa", "value": "T1C7D423176CD3BC7DE517E29CCE2922E98A3E2CC7A49E134D15F1071386BDA8428D9D39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038183, "uuid": "b3b1bc65-54b4-4a03-ad99-e79126260d66", "value": "12288:t4hT2obs8ytz3BUHqMTnsSkpItPIJxy+KooMELKY8WmIs9rsbPLyiUb1iopp4Zje:kqB8iBUH8ygJxGopE2zILbLy71iopp4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690038183, "uuid": "6962684c-cc52-4bdb-8622-8bdde07b8668", "value": 602049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690038183, "uuid": "c4b51599-6636-4e20-bd55-a09eecb9f46c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038183, "uuid": "704f1d8c-d50f-4ad6-951f-0dc38e8bc354", "value": "DOCUMENTS.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ce4e27-286d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690016182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690016182, "uuid": "c17b59a1-2d1f-494c-a195-ee39041248fd", "comment": "Malware payload", "value": "dd7482e59078a1a10388f463a0dbadf6", "object_relation": "md5", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690016182, "uuid": "1c3b5492-b0b3-4697-b26b-65f29963fc84", "comment": "Malware payload", "value": "5a29cbe8c384ed27d2ab726467eb98e3526bb32dc075e9b43e5bcf6476b7c971", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690016182, "uuid": "328d5a59-6cf4-4db9-a508-17e6482717aa", "comment": "Malware payload", "value": "b9be728606dc95791f157a5abf093665021797d1", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690016182, "uuid": "578b34ad-fcab-4ef9-94cb-6334e4396ea1", "comment": "Malware payload", "value": "128790399a97bc0a8aefa3b5b1c63a989c36070f9796babe75025bc492019ec9785454fe1e79140c8668f8ad70152d00", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-209", "colour": "#7A8506", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690016182, "uuid": "c69260d2-99d3-4181-9740-eaa3aadb1f91", "value": "T18D05EBBD65DB654AFEA19C302FFCBBA4D77754B9C69BC6F044E9A03024204A7DC02927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690016182, "uuid": "176ed50b-e5c3-4e7d-8b31-ecd29b25b087", "value": "fcfbe5457e76d2ac347d7db113c0ca3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690016182, "uuid": "c2a1c521-cc93-4434-b938-8106d0f795b5", "value": "6144:ihib3j4RhMhmHIAHXDw7sWargzl3yrSutwDWhFSoUS/Hd9uZSP4ruDfaNeTKjc:ih43j4ROmnSIgzl3yrSurHxdMA46vKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690016182, "uuid": "92f50cde-0293-4f4f-838b-7c22f0a68556", "value": 845035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690016182, "uuid": "ee2ed2df-590a-4809-986d-aa05e3e3411e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690016182, "uuid": "eb7e6659-5b26-44cd-ba1a-9695a1d1689d", "value": "eiaudscqruzzezydnmisvebetyizpfmvsvbauxchmwfcmdnzuv.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b6a5e6-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009260, "uuid": "48a3cb3d-9be0-4aea-9b60-da965a51e985", "comment": "Malware payload (Gafgyt)", "value": "d5c753cd63ab5a0272ee4f07b6dd330d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009260, "uuid": "4e1febb0-f4f6-4cde-940b-b7a7389f1dad", "comment": "Malware payload (Gafgyt)", "value": "5a64bf9ccc934b979e36583016cc482ccbf069fd9966a40bcd09472f7609008b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009260, "uuid": "07a45481-6b3b-48ed-9b55-c956491214c1", "comment": "Malware payload (Gafgyt)", "value": "eba40cf65cb2b3cb20aa693ef3cfdce4655ec12c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009260, "uuid": "bbaea18d-07bb-4e66-a1e5-cb9bc306f6b8", "comment": "Malware payload (Gafgyt)", "value": "61072ca12867ceab23441249f47c12924cfe9cbf071a2dfe991f8a677f4de496d7fb5356d51a233be330b5133f4d0711", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009260, "uuid": "48a66adc-d362-428c-8224-8d9c6ed3fd4f", "value": "T1C9E3866E3E21ABBEE16886310BF76F70C39529D636919342E16CF7185EB124C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009260, "uuid": "d9ea9df9-7724-44b3-8882-17479e9e1929", "value": "1536:mVNs7K797V+nv57gbj6l6T6B6v6N6/6AePe1ebeZe5bwClA2rKQA1dXAQTI/e0hY:vY01ZkXAQT4NN9//ImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009260, "uuid": "f1d7cd4e-8429-4d3e-9ce2-b8ca2b16f5e9", "value": 152121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009260, "uuid": "4f00c608-88bd-4888-9230-f55766e08498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009260, "uuid": "4aa9d5e8-cbf6-4498-b952-86747d348d2a", "value": "d5c753cd63ab5a0272ee4f07b6dd330d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb0a52f-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690014940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014940, "uuid": "3852f706-580c-4098-9309-202815496030", "comment": "Malware payload (Formbook)", "value": "01126e7f989d42f83f5b45557d56b718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014940, "uuid": "a6578a2b-42a4-4594-a56c-8860a4443b2c", "comment": "Malware payload (Formbook)", "value": "5a7776cc612624b1413ac2e4c7137dcc1b846878632708bf0ff536cd85bce3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014940, "uuid": "7af8eec0-dfb3-4dc4-bef1-de37153b9127", "comment": "Malware payload (Formbook)", "value": "bd240d3f0ec1fe07b721b3b439b5bc5d5c5c310e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014940, "uuid": "ae5c9e77-af0c-4487-bb77-7054039a9977", "comment": "Malware payload (Formbook)", "value": "f4598a198c5201ad415d55bb623625365d07e4ffcb49ef93e397d054f43afae4573a4ea47923ec7e57910c04a44e064c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014940, "uuid": "c9ccf7cf-8c75-43bf-bd4c-e0131cc9232f", "value": "T107F4493C08BD223786B4EFA58FD48457F0C0A96FB211AD35A5E74B654306A16F9C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014940, "uuid": "da2b8710-5609-452e-a89e-419d1c335cd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014940, "uuid": "1d9706ff-aa4a-4c10-89d8-f4e225eca713", "value": "12288:WsGmBDMDciwkb3lhOyX5N4HodJ4gi8gPgaSGEE8hIW:WBmiDciD3lhvXP+yJ4gi8gPpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014940, "uuid": "9d9d5d66-31b7-4385-bfc0-9e71536f72c9", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014940, "uuid": "96e07d98-6b82-4e7c-b2cd-26f0499f5971", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014940, "uuid": "64f556e6-f4b8-4239-984c-613d92596dfb", "value": "New purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeac833-2877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020526, "uuid": "060d0cbc-d8bc-4070-b228-baab81b35364", "comment": "Malware payload (Mirai)", "value": "6b959e29c5d5d1d701dcb6f68589509c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020526, "uuid": "8fde1b85-4de5-4b37-9213-7f2fa2414a9c", "comment": "Malware payload (Mirai)", "value": "5afd6f6de7025004d0d5fcf102b78171defb0180ce6b5536b7ceda9122c8fb97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020526, "uuid": "d331ff20-3d38-4767-9dfb-2663cb1c42d1", "comment": "Malware payload (Mirai)", "value": "a8c892c56b0d88acbe8d39b9bc1f8517550b6c2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020526, "uuid": "07c8d6f2-7a63-49d9-a303-01c9dbdbdc93", "comment": "Malware payload (Mirai)", "value": "fd849c0b969cb5c5387290674f1909732227d7a47332e219155bcaded94de2f503973b7f8d230341bb6ee6bdc4e193ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020526, "uuid": "a8103be9-3ed3-403e-b1d6-4f51113bc928", "value": "T127534BC0A643D8F4DC120571207BFF375E76E0F6122DEA97E3A69733AC82685A50769C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020526, "uuid": "4c2ec350-e358-4f46-ae89-535e63672b9f", "value": "1536:sdK4ikyIuabX3J1Zp3fVN14i7FLP5sr9ty+IN3omVxW9/DIE:0K4DQabX3J1Zp3fXjE9g+633VYBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020526, "uuid": "2643f435-f502-479a-a806-8b832e32d805", "value": 66416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020526, "uuid": "7272269c-ba31-4f45-9fdd-423fbe1a7bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020526, "uuid": "24e257e5-2939-4afe-92dd-dfa4dd410d38", "value": "6b959e29c5d5d1d701dcb6f68589509c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29c353a-2871-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690017982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690017982, "uuid": "abc0c44e-8296-4e6a-8863-28f459790ee3", "comment": "Malware payload", "value": "c4fe973e479a2af02dce5b9888e97917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690017982, "uuid": "550c88fd-fef1-480e-ab4b-05cdb617b514", "comment": "Malware payload", "value": "5c6e675359884a3f82edd6c3085ecc8a28b465b88e313e05915cb194aa17a0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690017982, "uuid": "c9db0362-1c4c-49bb-94d2-9d50fc693ee9", "comment": "Malware payload", "value": "4b83acbe8f078f08a2ff190ef5391d50484fa7e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690017982, "uuid": "bb5003d5-7bc4-43fb-be91-cac7f100de5e", "comment": "Malware payload", "value": "d1cac545cdf9e9fb3520a6de0e5595500e2f6b57afd321efee99d71a0d83f9c0fbd827250097d7d4dfe7626668596609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690017982, "uuid": "0fe41349-6a80-4633-a807-78d99cb7e508", "value": "T1CF26332CD7C4AE7CE6FCE836A34E9E6C86105DC15F87C2C13D502AE4AA2C5B5E70E152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690017982, "uuid": "301f8637-971d-48a7-95ca-41bfc36dcae0", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690017982, "uuid": "cef517de-6336-47c4-9b2f-1d5f8a8bca64", "value": "98304:4ICeQ7CGJQrDBC+00+IcXd4ZwynoDQkLoCR453:s37CTrV50NIS4Zj+Qkx4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690017982, "uuid": "9edf1598-08e3-42da-944c-03e5be511740", "value": 4508160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690017982, "uuid": "e52dca0d-2e2a-4974-b6ff-456929cf6c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690017982, "uuid": "03df0a52-6def-43b1-a6a7-a550d2831694", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2fb2ed-28cd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690057354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690057354, "uuid": "51bd5f35-6e06-4995-80b7-59153717f064", "comment": "Malware payload", "value": "c1c6070aa3fbca7937dd58081a60493b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690057354, "uuid": "d54b724d-b7c8-40b2-8abe-3060c466b7b8", "comment": "Malware payload", "value": "5fc3742d0cfa7687a674e7f209178ca2a50e08ba963f3d09d51550ca02b03d0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690057354, "uuid": "f1cea235-72ed-4540-b370-4576d5a087db", "comment": "Malware payload", "value": "94e33295639f263f0249be7c370d9ee81d1949a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690057354, "uuid": "5ca95758-75c1-4a3b-985c-127934e602be", "comment": "Malware payload", "value": "fe3787b32d070a00619737f3cdacb23d3f4f52c5a3def509a3f437b52f25bd059543212be4a5a9ffd8cdc3c00e92f5a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690057354, "uuid": "44c63c48-6c53-40a0-aa46-ea408743e47b", "value": "T10E74F12237E1C072D57386701971C6A05A3FBC625B7545CB27A86ABE2F707C09E783A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690057354, "uuid": "0c1c6c88-43da-41fb-83df-b7423bb4c7b5", "value": "af40374e4a24e91ac811a859f25f2877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690057354, "uuid": "74ff6fc7-cce9-4185-a16a-604dc2d7587c", "value": "6144:shl6oXbFH7mwiM6g2mQn9hDoYyBJdNt7BLPEFJM:KVXbdK5Nx19hDw3CJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690057354, "uuid": "30320cb9-a983-43f8-802c-fb9dd93f74fe", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690057354, "uuid": "5953a576-5e71-42c6-ba2b-7fb31d0b4d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690057354, "uuid": "ea22550b-fa61-456c-8d59-6efc95ae9e26", "value": "c1c6070aa3fbca7937dd58081a60493b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc36419-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690009355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009355, "uuid": "740a7c14-47e9-4140-aeea-f4a6ddc2c0b0", "comment": "Malware payload", "value": "38cd82236e6852831d53c706062caaa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009355, "uuid": "b4b787cd-8d94-4abc-9ae8-4f4a0d404f27", "comment": "Malware payload", "value": "60d0bd6a740c90ef2fe0891cc13c8b1a95331915541c0e9d6ab7667a8b36a83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009355, "uuid": "364f1751-4a48-458f-97f6-b3ad9d1581b0", "comment": "Malware payload", "value": "057def6d5ebf4c0fce784ef62274551e62f034ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009355, "uuid": "f883001e-8ec7-45b3-8158-4860fef1bc6e", "comment": "Malware payload", "value": "40e573128c7a94ecddbe20a6d71c30778bb9a0daa33b337745b07e2e2b759baf767c55587ac6acdd7d004cf4e3a60cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009355, "uuid": "e8bee64b-9c8f-40aa-b372-c53d35b3f5d8", "value": "T17B355B10F85F7271C9AEA0BB8BDDEB20539CE8A0331A05DF579847F9C6231F16A36645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009355, "uuid": "86db8ae5-fcb7-485b-a366-9105184b6b4e", "value": "57423b5afae18340d4d20251213d0ae8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009355, "uuid": "b0508fea-0ddc-4cce-8908-3e4aa50a58bb", "value": "12288:tSuBTTZDpCZ+6VPwEiuHcciBdu9B/uaetkQrPLV1:4wnEiHpO1Sx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009355, "uuid": "746dfea7-1369-4e82-a46a-e8c728910e6f", "value": 1066239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009355, "uuid": "88eb80e4-4375-4ae0-aabf-d71cd0890650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009355, "uuid": "11e1f860-9e27-4f33-a466-34b6ec6433c0", "value": "38cd82236e6852831d53c706062caaa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b67d177-28d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690060302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690060302, "uuid": "250509b5-c674-45c7-937a-5ff8719a520b", "comment": "Malware payload", "value": "e2d4ff2d0f79d3b26b1c33bc3d3e984f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690060302, "uuid": "a27c8979-05b6-4823-b156-f9ee513e04c2", "comment": "Malware payload", "value": "6105816824582f328f8f6b7a9ee5e55cb8af62a0a2e114467136ee5ea9c6f2d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690060302, "uuid": "7058dbe9-55d7-4bc0-9ff5-db1c097bae07", "comment": "Malware payload", "value": "8f9ae2d5b18688a81de969a2746e5d1e6bb0d9b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690060302, "uuid": "a70e6712-d49a-47c4-aeaa-61c9865a95a5", "comment": "Malware payload", "value": "42d34a7b74ef34e93b4540f1240e89a7a607262c8c7008cef0aa2c678d6e50b8f82e3b16a70319970aaacba170eea44a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690060302, "uuid": "dd8ee273-2cd9-4dfb-9c02-c2a7fecf57cd", "value": "T19B74E11173E0C077E5B355304970C3A02E7F7CA29B3599CB67982A3E2E716C1AEB9356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690060302, "uuid": "e9c031a9-e111-4d84-b242-458635ae232d", "value": "bda7163eeb2431f046ba687ba9a660d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690060302, "uuid": "cc52e96c-5800-4714-adbe-34dc23117758", "value": "6144:iKnMahrSLFys2O5h0xUfx0OxlM5b8RMSb7IUny0:5nFNSLPh5z504ab3mo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690060302, "uuid": "b2bf986c-5909-43de-a180-3c302172e034", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690060302, "uuid": "da2ebf22-1194-447e-8c3b-4d9872498cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690060302, "uuid": "91adc3f8-6af0-488d-b8ca-367864f4612e", "value": "e2d4ff2d0f79d3b26b1c33bc3d3e984f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64fc7d6-2877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020511, "uuid": "3624c7d3-ebb0-41ad-b867-774a7cce9339", "comment": "Malware payload (Mirai)", "value": "81744a9464c21f6cb9ba1192840ac615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020511, "uuid": "971e1966-45e4-4993-8f13-e21469c84d9e", "comment": "Malware payload (Mirai)", "value": "646cb28704fedfb34372b6b70f895d50d40d13fe5d4e5cff67c485020efbc9cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020511, "uuid": "4218a073-0a93-45f0-9291-9044dceca010", "comment": "Malware payload (Mirai)", "value": "bbab0bcad9a9917fa65cd7d599d79ad438276806", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020511, "uuid": "9ee8a326-b8ff-4f17-b438-249f7692c465", "comment": "Malware payload (Mirai)", "value": "4d27ac97b56458cbfd63a6ea926ee2f7e01a60d5a09cba19b76b2934b1a52c89f7c3d90767e10dad2c0d2bafcae15d36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020511, "uuid": "05a11ae9-2079-43d1-a3ae-a770a86308ee", "value": "T129638E3EE41BAA50C0834674A4E58E381F23B1C982632E7B5FC745B654839BCF615FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020511, "uuid": "6636a0af-49c5-45d6-93e5-1d40d2572980", "value": "768:naqwtxljPRVnqNYy58eJ1UDKCwQvZ4nDz8F+Ofyrag5r369q5bC2oUWa4TCi/wG/:naqwtxhQ/OI1cInvqfyb+IhGUwTCioA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020511, "uuid": "e4933ce6-78de-4ce2-9cbf-008e7d63bdec", "value": 68504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020511, "uuid": "50370b54-e0ff-4c28-9d87-097198825018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020511, "uuid": "abbfeeea-306a-46a9-b50a-b778b01d601b", "value": "81744a9464c21f6cb9ba1192840ac615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20e8091-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014921, "uuid": "0f425de5-6ee2-454c-90ce-9212359db918", "comment": "Malware payload (AgentTesla)", "value": "4b090953aa0d86ecba3f562e6f0eb8ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014921, "uuid": "3d48c218-5dfd-4b1e-aa73-65be35d92e6e", "comment": "Malware payload (AgentTesla)", "value": "672b3e40467ef31b1c70ce6b8f365677c52e728cc16c3fe901bb0bebb0554c82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014921, "uuid": "ea883049-c4bf-4cda-9e2d-51373884cff6", "comment": "Malware payload (AgentTesla)", "value": "62ca762f4a1ded8f27c0107fcdb370ebf0f340f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014921, "uuid": "7eb73f79-3391-4f73-940b-368c1a3bcb61", "comment": "Malware payload (AgentTesla)", "value": "ae5bea44a392433c92b54d1121463da13d73f0b2d21b0f4af3bb1ddfcebfc98d85e9fa257463bdeca81a160b4f86314c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014921, "uuid": "822723b8-a70a-48c5-a910-55b20cbc1c57", "value": "T1E7E4221232A85E17D4B6AEF709A6901013B1A6513167C3DDCC7231C62EEBBC2BE51ED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014921, "uuid": "338a8446-d1de-4c7e-8a4d-09fe654f770c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014921, "uuid": "d423a39b-4750-4d88-8733-7ff30b7bb6a0", "value": "12288:IWc/bUYIsYolnHKDCfCeJTTC99AN+10d80f8ylSnhN78SQcHsWyzcp:jiXrYo1NZCwNY05f8ylMZ8esWyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014921, "uuid": "d93fe67e-35a9-455a-ba7b-4af4bb207bfb", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014921, "uuid": "70c0f271-385b-46e3-b7c0-ad91312be76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014921, "uuid": "79663c65-b28a-4c15-a50e-a4be9452775c", "value": "factura firmada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc37eaa9-2868-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690014133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014133, "uuid": "210f3fb5-e931-4e9d-8c32-3f2e61ea13ee", "comment": "Malware payload (SnakeKeylogger)", "value": "0bad4547541e72660bd3c12321e7d1e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014133, "uuid": "ff4b6bd8-0a58-4f79-98fc-481fcc3a3c7f", "comment": "Malware payload (SnakeKeylogger)", "value": "67a03c34c684a2771205a064937b3d6ec088d751c46b6ca6f1b191c7143932cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014133, "uuid": "f7dc0e1f-8188-4380-bc5c-a97f53990481", "comment": "Malware payload (SnakeKeylogger)", "value": "0fd44ffc3a003dbaed7b8f1043da1a954346ac03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014133, "uuid": "869dc49d-8e8d-4ae8-9f2b-6a70466f855f", "comment": "Malware payload (SnakeKeylogger)", "value": "1551fb72df7c92c0c07c5eae2362375e53c900af0c4c2085e8f1de79157f35b7d2d8e2d0d3b0f8428825238f4da165d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014133, "uuid": "501c4936-07b3-43b9-accd-4bd8efc410ff", "value": "T13DF4CF50B1B90B31E57E2FF6208496480BF5B557B57ED2398DC270EE5AA8F700E8271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014133, "uuid": "4bc27398-5593-41de-be2a-9eb3c1400629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014133, "uuid": "3042f392-2c6b-420b-997d-1a3dcd05e9b0", "value": "12288:8SjXmmsQnGHAax3wBHDHaaZbtVc1kTF2jNrgQ7EzG6sV:D7mmoHmHakrqY25rI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014133, "uuid": "bba5d20f-18af-4984-a676-984aba99f287", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014133, "uuid": "5a28c3ad-93e9-49a7-b8b4-1434d80bad64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014133, "uuid": "81f86be1-0385-40f9-8d29-f1e97f64c532", "value": "EX895576850790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e378f0e-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014888, "uuid": "d55bf34a-05e8-41dd-9c22-63cf11afbe22", "comment": "Malware payload (Mirai)", "value": "7c6b21cb38e4c569a7882e863ffce1d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014888, "uuid": "2dfb8ddb-e3f5-46fa-b3d6-826fee2243c8", "comment": "Malware payload (Mirai)", "value": "6818f7c5a8cf4d2d94a4ef24caeb0dfecbf26d061b9cab9593dc145d8df2f8bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014888, "uuid": "7f541786-d766-4e10-b30f-cc2e0068ca01", "comment": "Malware payload (Mirai)", "value": "2130396b1a53524748c1db526d8e29424e278eb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014888, "uuid": "7061f29b-8156-4676-ae58-af4a55cc27a8", "comment": "Malware payload (Mirai)", "value": "f75f64543d9436c1c4ad439bf5741b1eedab483d5f0066e06834c540bd60f496ada28a5536b4d63e5baa44faef0de990", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014888, "uuid": "b466213c-3c6a-4c1f-8bb7-2ac4e94fec14", "value": "T171933A07B71D4F43C1DB59F029BB2BF15769BAE112A36181791BAEC05B33A782423F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014888, "uuid": "3d8fa4d5-6067-4c2f-8e0d-4ec2c25af424", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5Y5hLKRjOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/05hLQjOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014888, "uuid": "e684d18d-82fb-495a-825e-d3fd5649f02c", "value": 92723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014888, "uuid": "b227d66b-99a2-446a-8b02-5900d08a9f10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014888, "uuid": "efcbabd5-40fd-4aee-8449-cf94449fc0d7", "value": "7c6b21cb38e4c569a7882e863ffce1d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e15c9c-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690014899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014899, "uuid": "8664c163-f090-4e51-a780-82f44b0a9552", "comment": "Malware payload (RedLineStealer)", "value": "805f458c4e4cafdc121c09022e7065a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014899, "uuid": "8e6733ce-2b90-4030-8272-312e24036771", "comment": "Malware payload (RedLineStealer)", "value": "68c37c83076969c58d0363958646c7804b3b22fd50f04aa720bc28b07793816a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014899, "uuid": "3f8b0216-d702-44d9-a15f-4d472295e1a0", "comment": "Malware payload (RedLineStealer)", "value": "a7876edbb4b0df6770d9de1b3eec3d10b9341f0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014899, "uuid": "f1a82e4b-c3d5-4191-81f1-0eb808a28661", "comment": "Malware payload (RedLineStealer)", "value": "2966730dcec70102e3863529d0b3a1afc9403c6af7d7079993a12ac20e8e667b30d99c42b606f72fc35ae11a39946e21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014899, "uuid": "b62c6558-8c26-47bc-87c0-e858df0e5a1f", "value": "T120B41253BBE89072D8F617B098F703930A397C714979C29F3785589A0CB3A84963677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014899, "uuid": "23be86d9-5f90-4dd4-a6c8-a620c40fb198", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014899, "uuid": "de63a4ca-81db-4e15-ae36-258a2be01378", "value": "12288:6Mr+y90vfhcrO1YnhEibozGpgA5UcjKy+:8ykfOrcYloyaKKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014899, "uuid": "0f5606d4-7e5f-4fef-a686-9f30f4324ed4", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014899, "uuid": "1a12a2bb-ddcf-40fa-bcbe-47b292d88003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014899, "uuid": "ff68e329-1c65-438b-badb-d9e24441c70e", "value": "805f458c4e4cafdc121c09022e7065a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a87893-28b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690048913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048913, "uuid": "7a97852c-b48f-4101-bdf8-255a3b8440ba", "comment": "Malware payload (Mirai)", "value": "1c2f1f74e2a5180d38946f2ebfe4762c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048913, "uuid": "2080b0ed-1e42-4c8e-a94d-a26d7a9c0f63", "comment": "Malware payload (Mirai)", "value": "6a61a31263e08c41f15bbcf8aef0620472357a210419eba110c4493c07bc07a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048913, "uuid": "cd6e76ad-e396-4435-be1c-67a5221e81d5", "comment": "Malware payload (Mirai)", "value": "bfd116e8fbfa4c03b862dc244d040a6f556b6263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048913, "uuid": "77b0324c-b0a7-4630-aaa6-e6d5bc4adec4", "comment": "Malware payload (Mirai)", "value": "535536e7cbe6f68c580dee40043197a40d9a8a51a3883ce862adf5d3eda6f96669b0d322db01c8a09384d983f7b89740", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048913, "uuid": "c9fa5209-8933-4295-a593-2ddd0c1f2bf1", "value": "T187432A42B9818913C6D4233BB66E46CD3B3523E8E2DE72179E226F6037D681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048913, "uuid": "bfdee3e7-4afd-4ca4-b005-70338daa01c2", "value": "768:o+fMB/Ujg0ug8g2a0C4rq3uIvlGtmM/ozftc2TLoa+foBH/DzNOev2kytZPRweyr:VMBsk0z8gsC4zmpzlUa+KjvOCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690048913, "uuid": "6d2057cb-cf17-4047-a0b3-b1cc7de3ac4b", "value": 56344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690048913, "uuid": "a2766354-d8db-41e6-b3e9-7f42228c7693", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048913, "uuid": "8499d85f-62cb-4895-8950-535b322b8a75", "value": "1c2f1f74e2a5180d38946f2ebfe4762c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a58c8b4-2878-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690020867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020867, "uuid": "a54b8c1d-dd89-494e-a0d3-29311ce54b17", "comment": "Malware payload", "value": "91bd4876e1f42b9f3a051fef3f21ab45", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020867, "uuid": "25c2e635-dec9-48dd-9b70-f399c58c1525", "comment": "Malware payload", "value": "6a8b4c78c8d290039ada60264075aa41839bc75b1fe4d9c99cee66252c2292c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020867, "uuid": "36398ec6-154d-4ffd-a1e0-3bdaef015602", "comment": "Malware payload", "value": "50a4cc22a9bc89ccfd986efb18aeffee9df00847", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020867, "uuid": "f4dcced9-e082-4e2e-9bb1-f5a61a63bcfc", "comment": "Malware payload", "value": "b616526829c199df91d096f1df5376c01334d99e193aa37a8f065f71965e81a00747eaf953a0596bd7bc33e2cdb57c02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020867, "uuid": "64401582-5c2e-4e24-8a22-36b372c5a9b8", "value": "T1C483D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020867, "uuid": "c92dbf11-f33d-4d96-954a-833e2c390b17", "value": "1536:iVLyu95K5jkj752dCexuV/8UZlDwfkJ4MYfW4:iVLyMggFezxu5VD1eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020867, "uuid": "98d82229-79ab-4faa-8751-f4333b66f56b", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020867, "uuid": "d29b865a-c63e-462e-9334-b38606c34ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020867, "uuid": "ab0af70c-7980-4c41-97b1-49774f22f8c6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a3f04f-2868-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690014128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014128, "uuid": "ae0147fc-aaf2-42ff-95f4-61d394af243e", "comment": "Malware payload (SnakeKeylogger)", "value": "ba1709a3d54af0425c34b589d9b5d45e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014128, "uuid": "0877e741-b2ae-466d-b3de-fda02952c770", "comment": "Malware payload (SnakeKeylogger)", "value": "6bcf3454be579fca552338a3f5c192d5301ade9b8c7cb2ace0dc049e33ffa385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014128, "uuid": "81ac6e11-b5ae-4f26-a94b-35064fae88f2", "comment": "Malware payload (SnakeKeylogger)", "value": "d53c7553af2bd60222a942f477fd3234776a1e85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014128, "uuid": "cd01fa72-1e7c-484f-9e5b-92430b77bb08", "comment": "Malware payload (SnakeKeylogger)", "value": "49408c3c8107a9cb9120d8448fccfb5a953c53201d08be979e68fbea38f6b20f58a42dcebc777f656b6bb3f2cb0ac6af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014128, "uuid": "bfe0ffea-15f3-490f-b02a-b6d9a96d8976", "value": "T159634C21F387C589DAE54B38A92BED580A36CDDA1DB2DA1F317C322DEC737876445188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014128, "uuid": "be1edfeb-3e37-4e05-aea2-2cf3e50cd649", "value": "768:2FfuCQ0XZnC5Zw7P22jg3aur1k6IwVlj7ceKguXgcKmxDERgXl+28Be3:2FfunOg3zrRVcn7X4mJYtBe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014128, "uuid": "e73e86fe-e96f-4bc3-9e0e-81dd147641ee", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014128, "uuid": "9959fc00-a07d-4c10-8bfa-acea67ce8974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014128, "uuid": "30d9feec-a580-43c6-9b90-fbebb7e1bf50", "value": "Yyvxgqbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc6aa84-2889-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690028362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028362, "uuid": "40e044a2-271b-40bd-9d4e-48305a76e10e", "comment": "Malware payload", "value": "0e7f511d7a1ef9110b53652f81acf9ac", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028362, "uuid": "41536e1e-eefd-4d80-b2e9-c67152651972", "comment": "Malware payload", "value": "6c4e2874ab8481bf8756af4bfcd3848680829e119339fc635c1002838883a4e5", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028362, "uuid": "410e9525-a692-443d-b496-87fc018c3a9d", "comment": "Malware payload", "value": "7c1a50c69564b826fe3bf528a5c2612939d827f9", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028362, "uuid": "04d016fe-c93e-4d2e-80d7-07115f9e36ec", "comment": "Malware payload", "value": "489916fd2568f88d9a7baefd1cc66bafff0613d37e49a81b2f99f5d0435cdfa70ecab309bce80bed06f10d6342c7f740", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028362, "uuid": "ca081f1b-0c17-45cc-8754-9f939803ece0", "value": "T140C423942B4878C39D656DE0F42B84EE054C3639D700B63F3FBE9B7AF45432AA949076", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028362, "uuid": "31ed5b95-e526-4af3-97b5-23a77c6e1e72", "value": "12288:KJa9xIgGaWRxHi3Pdfn4CUvHAVq1o+Cq+Uh0kNG2lWp:NV8CZnpgHJCqIktI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690028362, "uuid": "c7e10769-f5a1-4936-8491-6342c49af6e6", "value": 549285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690028362, "uuid": "84ebc6eb-1328-4a66-a734-5fbeb54a86d2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028362, "uuid": "9d29ca07-21fd-4820-bdef-96d78520d43c", "value": "Payment receipt MT103_tt 9630 print.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1878457-28d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690061789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690061789, "uuid": "9e8c5e61-503c-4d29-a14d-230c298aa76d", "comment": "Malware payload", "value": "e3ada4aa642fc5cc92af2b303d6a0878", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690061789, "uuid": "4a22651e-090a-44ca-9d85-ddb8ec8acb25", "comment": "Malware payload", "value": "6d529201a41e66d6b47678f5c032153343b042141791103a9583e674b8e2321b", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690061789, "uuid": "d2ce08cb-a321-40bf-8309-82d4d4230ac7", "comment": "Malware payload", "value": "2b9d8a7aab422210f11239d1cb30366fb5baa45d", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690061789, "uuid": "eb7ff157-a280-4386-969c-84614cc0f11f", "comment": "Malware payload", "value": "fbf507bd7bf0d223081c906057641290e7ff420f6d1604ea7631bb5f6f9dc0a997b5764fbc777af672405755a641f587", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690061789, "uuid": "2a20edf0-d525-418a-aec9-b82899baf9f3", "value": "T186158C1373E18022FFABA1739B5EF31646BC6D290323A52F139C1E79A970171166E772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690061789, "uuid": "a013dc1a-0c14-4165-8e4e-fb65ed2e0c52", "value": "12288:6aVWgOo7MiIN/egB/Gsyt8lOqinvAfcN1b2+mZaA1tYevTdFigarJwM7:6I9FsEsyt8l+E+s1tB7parWM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690061789, "uuid": "03132bd0-debd-415d-b06b-3b4c19891481", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690061789, "uuid": "279d0a49-95ea-4b4e-acc6-d99b4fa46dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690061789, "uuid": "919e9eca-cc48-4fae-8949-9f9dd6a53060", "value": "sc0pe_carved-245869.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78150ac6-287a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690021696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690021696, "uuid": "3a876568-8d7c-404f-bbd7-3839507b70a6", "comment": "Malware payload", "value": "d1ecfb3fe25bd624e78f8fca6fa33b8c", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690021696, "uuid": "d4fed746-a459-405b-9bd3-fe93692d4a7b", "comment": "Malware payload", "value": "6e1ba899538ce5673e53f85507696dd08b2ce7f6977930003629b3fee05ba970", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690021696, "uuid": "90222ce6-c337-4846-a954-6f38eba98c3d", "comment": "Malware payload", "value": "cc6491da9957342cc73cc7f5c61f6a431586da42", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690021696, "uuid": "9501bdb9-c8e0-411f-9d92-5ee63e3336e2", "comment": "Malware payload", "value": "d62fd20ddb66e2c98b6ed3216edcb7098d9cbd0ed33b92b7d0a1b1216a32b06247d94f5085cd3e1c9bb6fda663c21b15", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690021696, "uuid": "41032395-ef8f-4123-b235-e08652c09088", "value": "T145D433B7D09DED31FAD92F68E108A3CA74B474CC65BF3029267A494007B858652FCFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690021696, "uuid": "ca803ee5-127e-4323-b451-e49616898049", "value": "12288:a3Fj9cVFVoe2GrKCrTSMq1IFjdeEJ/tMhDPF3dWCnTxnaV/ypTBI:aV+JnLfcsdrJVMECTxnaV/yp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690021696, "uuid": "55e7b2a3-d994-40d7-b85e-b065189330ec", "value": 652523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690021696, "uuid": "e95f1733-4a2d-465d-83bf-5d65412cd253", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690021696, "uuid": "47200f28-3b19-428c-a743-ba4bb33c42ce", "value": "Payment receipt MT103_tt 9630 copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b814a4c9-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014931, "uuid": "c9d86fed-e5e9-4057-828d-91124055b09b", "comment": "Malware payload (AgentTesla)", "value": "6aac6d592b696d249f9d9181d334c314", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014931, "uuid": "25d5b327-0644-45e5-baf3-283506f81122", "comment": "Malware payload (AgentTesla)", "value": "6e7cb379b1e49f7dd3b3d0a4512fa7542c02bffe3f367559862ec8d59e907b37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014931, "uuid": "db5008e2-c9af-415e-88fe-6bffcde01ea1", "comment": "Malware payload (AgentTesla)", "value": "c4a649e43bc339d9bf724afc19b95fabcdcbf680", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014931, "uuid": "aea45ba1-99a7-4f99-a711-d737621f1ab3", "comment": "Malware payload (AgentTesla)", "value": "bf1766234daf98ef925ff58886e628abe5564663a129858568a29674eb05e48c104dd42bf21a22b3edffd1a6ef3b24d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014931, "uuid": "07660280-f5f1-4339-9291-8029807a1179", "value": "T1C604BB919A02C42AD68F1AB44C1CFF7409E75FA6F672A1C544733C65BA32E871CB68D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014931, "uuid": "bf1517c3-0a61-44e3-b700-8deafb424991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014931, "uuid": "cb2b2409-3d41-4693-b5a3-78715b724cfb", "value": "1536:+uxyjFvOn/I4EyjghH5JUXK5+W7dLwwrny6RH:+k+U/IByjghH3UXK5+W7dLwwrny6RH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014931, "uuid": "a36f091d-5075-4fa0-af6c-12f005bdd523", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014931, "uuid": "6e2e7f73-6630-4d95-b822-434c4993b111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014931, "uuid": "73186b48-fdfe-406f-9c53-f313c6f7b1c4", "value": "\u62a5\u5173\u4fe1\u606f\u786e\u8ba4 DOC-COPY49884752001_PDF .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a5bb3e-286c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690015548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015548, "uuid": "c364e958-bf98-4ea2-9dd6-961e707b8196", "comment": "Malware payload (AgentTesla)", "value": "894ecc535d632670967537332bc56a28", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015548, "uuid": "9a6c53c9-b349-4b1b-9c90-7fcea7ced294", "comment": "Malware payload (AgentTesla)", "value": "6f06f13e919e09f43d1c3e8c3ece9fd6b14662c05b003f55db531d486a6829d5", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015548, "uuid": "7fabb615-d7a9-4243-a1cc-9b031b341cea", "comment": "Malware payload (AgentTesla)", "value": "81f21f5c587239712c4e08b0f60d7e50794da5ac", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015548, "uuid": "d66eabfc-0d32-4118-adf2-85b54404a8eb", "comment": "Malware payload (AgentTesla)", "value": "6920f0d32e07626858430efa70e6e8e5e5b4a3f0e19e21810c0b4e426f353651c8a0a0c4722cdb7b2ea2167122f527e0", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015548, "uuid": "120e3f5d-f6bc-49c8-98ca-5152bfaef9c9", "value": "T106B423F7825F9C8925A99D97B28DB433CF26EDA95716D0D9630FD0CC0AC1B502D82DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015548, "uuid": "09246ef0-e5c6-42f2-914c-dd1b7b7a4b7b", "value": "12288:RWSqLyQh8C7Pg5rqSlC4XqNMU+6VFC3rs7mXfsiYK:RWSuJrotlC34FrotK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690015548, "uuid": "f2b6aee6-280b-4dd8-8eee-6d7c06df19f8", "value": 525857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690015548, "uuid": "f3efc588-2b85-422c-a580-1f1f423571aa", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015548, "uuid": "8b294208-ee7f-4b75-9111-2fe39b1deac9", "value": "Delivery Note_Ningbo.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361bf593-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997963, "uuid": "5617971f-c954-40d9-9e90-2117b1dc5c0c", "comment": "Malware payload (Mirai)", "value": "bdb914a421a376f77f6f905c41b9996d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997963, "uuid": "ca2f0a72-1e6e-45d6-8498-7ebb7c5e2c3f", "comment": "Malware payload (Mirai)", "value": "71447d24d8a6f2d8ae60ce82db46c011257b106e9cddb873bed3c383e1d43e2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997963, "uuid": "e2ba68d8-36e0-4e95-9163-bf57618c1f27", "comment": "Malware payload (Mirai)", "value": "19ded4fc3e0882cfb7c445a97be0492a637a8b2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997963, "uuid": "0851e525-895e-4355-8882-6416179a7dc9", "comment": "Malware payload (Mirai)", "value": "e8f1bdcbfa8772c9de6e1c187993d0cde0f11b46c35ffbd43b173362078428dfcfc2dd37c1d30fc0edc616259da6d623", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997963, "uuid": "adb9e34e-a588-4c33-b814-63944dc04d75", "value": "T1D3633A99B401AFBCF99BEAF941120A0DF421A25560930F23B72BFE937D710E1DD06D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997963, "uuid": "14dd75f1-10f3-40bf-90c4-5cacb54bb265", "value": "1536:lTg9OuTO+YbAgXcp2rOZZRya1W2TDPt+KHz8np:ey+YbAeccrAz5wq+Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997963, "uuid": "790109c8-7d93-4f5b-a79f-0657d4b040c0", "value": 67216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997963, "uuid": "4d1fa292-3290-4eb0-b70f-f1c2f2e5ae75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997963, "uuid": "b45f0e03-5270-4f9a-8257-6d83977affd9", "value": "bdb914a421a376f77f6f905c41b9996d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d4ead0-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014843, "uuid": "c37b5f5b-fe5b-4150-9a75-872bc2814a92", "comment": "Malware payload (Mirai)", "value": "e05055f34a4654207d7a0fa059bbfb5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014843, "uuid": "7846b772-03dd-4bd8-b8a6-ea66549debd6", "comment": "Malware payload (Mirai)", "value": "7630288c3a2df493e51aed4a2a733910564b68a82f16f4c708ccc3a416a51587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014843, "uuid": "a40d3e32-2405-4732-a9f7-29a513b0dbad", "comment": "Malware payload (Mirai)", "value": "32240e484c7e00b56874d03afc91b466eb7d4c32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014843, "uuid": "ecb81820-d894-4330-95ef-4e081a6f3cdd", "comment": "Malware payload (Mirai)", "value": "a5c20b1eb6d592f4705de99f90068b124304595202d94efbe9f009b9ad6efb3894d3bd3548a32e60d9acf5030bc00221", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014843, "uuid": "9946613a-930e-4fbe-9aae-181bc4292cd3", "value": "T14DC33C06F5508753C1C3177AB79F561A77232BB897CB331296247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014843, "uuid": "29324907-c907-4f3a-8980-1a01d007a5a0", "value": "3072:idwracAAviNmLpMQ1xN5hKHKZt6lbYmyDQUJ1UX4Tn:SwraFgikxN5hKHKiYmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014843, "uuid": "92a78a97-d8bc-4fd5-81f5-6c7262f62b60", "value": 118935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014843, "uuid": "d0a829d7-4c00-4143-b846-88a52830d82c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014843, "uuid": "4f4ad7d1-6af7-4d31-b34b-88c474b9fb93", "value": "e05055f34a4654207d7a0fa059bbfb5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7782a601-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014823, "uuid": "ce6e4fef-92e3-4907-a09b-1b958a904a9d", "comment": "Malware payload (Mirai)", "value": "32b5ee9e5bca86ce633f71540258aa4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014823, "uuid": "0638c9f6-6744-4d53-a649-857796e8bcf7", "comment": "Malware payload (Mirai)", "value": "79dc4935bc41eb41d3950db4379c73805052db8a522823c2510a32ac8916ec8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014823, "uuid": "61a69d50-cbd3-4abd-afe3-f9e5350f2226", "comment": "Malware payload (Mirai)", "value": "8a760f8d4b5b0822b7f38f7290c32006be0c110e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014823, "uuid": "68b9e5b1-9326-49b8-9d6e-98aa6bbd6053", "comment": "Malware payload (Mirai)", "value": "69587ec35ef09e0d1f98b0cc5939dbefd33aa2f038f27ffcd23ded45f2dffe37467675e425dda488b140fc417eb86c70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014823, "uuid": "d9c954c5-bd0c-4566-84f9-178e00772bb7", "value": "T1FB934C06F8409753C1C327B6F7CF47093A3267B957EB33026A386FB02BC67991A25A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014823, "uuid": "a0be4795-c70c-49cc-8572-2039934278b2", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZy15hXNKf2ZuTlSlmjvVqQEqn/lJXCPe:tIHQjjp5hXNKfouTljvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014823, "uuid": "2a0add61-3155-4b72-8909-0c67abc095aa", "value": 96623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014823, "uuid": "9fd16955-b2fd-42c6-b1d2-1e567fdd27fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014823, "uuid": "f4e7643b-7858-41a9-9bda-0cb5ada53723", "value": "32b5ee9e5bca86ce633f71540258aa4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361e8fd1-288c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690029316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690029316, "uuid": "4e8bc84a-9cfd-4e04-80d3-9fa2e515cc5f", "comment": "Malware payload (RedLineStealer)", "value": "c9966d3b55a424cc510cd22af8015679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690029316, "uuid": "0755e5a3-90cb-4c1b-ba3d-0d81aa055646", "comment": "Malware payload (RedLineStealer)", "value": "7a73fa7ca8f7caf895aafab3d6d082259fd89601bd78c085b45754d35b034e33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690029316, "uuid": "2b87901d-285b-468d-a669-c4c9fe5e3b5a", "comment": "Malware payload (RedLineStealer)", "value": "40e70cecc5563bdada2a1bc067dd146fd488c75a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690029316, "uuid": "793c305d-83c9-4106-bb88-9cb23342996b", "comment": "Malware payload (RedLineStealer)", "value": "71e855a22bfb78564e292c69014909c74162035fdef85f88fe4bb0785010c22b51bde5448b8bae6dbbbeb5769dcc9d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690029316, "uuid": "fc324876-fd89-4f47-b4ea-76705a61a992", "value": "T15C952325B191C1BBC6BB487888D5CA366AB438201F9A51E373E506F92E343D1FB745CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690029316, "uuid": "05f1764d-233e-4c7f-8ae8-e048d99d4133", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690029316, "uuid": "ec45da43-ace2-4a24-aa67-d27955d5d0be", "value": "49152:SkQTAAdQDOTC0wakdJ+J5DGfwNMiKw6id2l9gqumWD2/+H:SaAdQckdJ+JBGfwSip659IDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690029316, "uuid": "cea38ad2-22ce-4faf-8549-ef5dd9d9ea14", "value": 1935272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690029316, "uuid": "ac5a5eae-b5d8-42af-9954-f8248d197172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690029316, "uuid": "8fe10c71-e391-4316-945b-fc02af45fea8", "value": "c9966d3b55a424cc510cd22af8015679.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ca26bd-287e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690023463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023463, "uuid": "f662afa9-5c7d-40fb-8488-0e3a23ac76b7", "comment": "Malware payload", "value": "0a66ad54de784bb3a660cc16edff9273", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023463, "uuid": "bcab2799-93e8-49b7-a7a4-35257cf80af7", "comment": "Malware payload", "value": "7c23083a446c275e1120c34d4e2706dc1dc7c57e713a15189cfcd08c3c49f9b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023463, "uuid": "f5b517f3-61d0-4a82-a17d-9699dc41e8ff", "comment": "Malware payload", "value": "58f0fa69b67208d45d47022ef469461199d39814", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023463, "uuid": "facf18af-eb0f-4301-bce6-8da12108d3ef", "comment": "Malware payload", "value": "48001c593e65b20662b23dc7adab9ebcf20fc15a9dd1726d49245352d4654c0dc2b83455909765280a438a590487bbe6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023463, "uuid": "f7533618-955b-4d83-8bea-550592143f9c", "value": "T1BA534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979996B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023463, "uuid": "beaf4032-ffa3-4b19-999f-ed7ce4021671", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG9UmtTy5EMc8/J9iSzEv2xRgN0L6FV+tg6wWi:+5HAdOmGyZtTAdniSgOxRgN+e+aTWTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690023463, "uuid": "3b74da31-0f2c-420b-a66c-7bc18fede385", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690023463, "uuid": "97cc7727-42be-4da9-83c3-411fbc40650b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023463, "uuid": "cbda3044-3a96-4237-bb7b-c2d26fdf3247", "value": "0a66ad54de784bb3a660cc16edff9273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e31c591-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997949, "uuid": "ecc43399-612e-4c0a-a7a0-b0bb7560e672", "comment": "Malware payload (Mirai)", "value": "9d0f173942825878a4d3e0ccc877fd47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997949, "uuid": "bae8b65e-0501-4d82-937a-35f4089ab19b", "comment": "Malware payload (Mirai)", "value": "7e308fe3cd3de58ec3647f17759cc2e35a13362c2278a172eb3ee149e70b1c04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997949, "uuid": "86ba4075-15fa-4c95-929f-9042c4b40427", "comment": "Malware payload (Mirai)", "value": "be0bfd8de6ee2944d28579963c966a13e1e3d37d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997949, "uuid": "5042c390-09c0-4c97-82d1-346d6249fa84", "comment": "Malware payload (Mirai)", "value": "502e9ebf50d2d9390eb143bcfb9e967e1e83a34d348239be1f339496337a4a113a2423b208e000a5d7abc2034ccf8f44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997949, "uuid": "164ae922-e77f-45cc-af1c-cf56d4fe2533", "value": "T1F6730A86BC409E10C6C50777FA2F218E33075799F2DE7252CE155B747B8B81B0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997949, "uuid": "f2f50f22-4476-4101-9dbc-3bc973e0de13", "value": "1536:Cynh7o8MhxiuZYTSuuKsEabMc74J70qNdi5EAzDIxiWKc3myR:V7oRSuZOSGFIIYqNM6Kc3my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997949, "uuid": "d9e1f91b-acbd-4f95-b861-421f63f5c171", "value": 80532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997949, "uuid": "cb2db154-bc9d-4489-88d5-9d65899e5847", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997949, "uuid": "f6c9be4f-8590-4c04-acf0-3cb66fa13f8d", "value": "9d0f173942825878a4d3e0ccc877fd47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1e2c1e-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690014913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014913, "uuid": "ed4e9767-9446-4836-b59c-46737eb78bde", "comment": "Malware payload (GuLoader)", "value": "27d77cf315465f45facc08bbfede5edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014913, "uuid": "8e5d8047-aa20-4601-ab1e-aacdf0cddee3", "comment": "Malware payload (GuLoader)", "value": "811034767a7927426039c1ec8f3698fa0107b7d7d90716f7a6fe32558d7857e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014913, "uuid": "7bcb19b4-62c1-4959-9b72-83c6c5700f56", "comment": "Malware payload (GuLoader)", "value": "fb60f5a4e4a7a52239645a2b0b9d8819c80e01c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014913, "uuid": "c2259aa8-a712-4c36-9bda-c9bce6ddc4ba", "comment": "Malware payload (GuLoader)", "value": "2c2b2204e55910de1068f1454b10e7754e6a25708b9aac683c01a0c8acec944fbfb2795603c35e1b40e53bd176e5c0a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014913, "uuid": "67f92f8e-1b96-4d00-8cd3-d708505c4109", "value": "T19254078462A2F64BD7410B70D9D0E77925BB6DF19902422E6EAE36F85C3FF250DB0172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014913, "uuid": "d585f1ef-73d7-4f12-9bca-c51b10d47896", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014913, "uuid": "3e845ada-3abe-4c2a-9093-327c35206c14", "value": "6144:ajC8w75wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww5w5wwwwwwn:z8w75wwwwwwwwwwwwwwwwwwwwwwwwwwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014913, "uuid": "d0bb97bc-5985-4250-9d8e-24fd953d283f", "value": 297696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014913, "uuid": "853259ee-07c4-4a27-9862-4ea0fc5697bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014913, "uuid": "ea9c99b0-2a8f-4c0e-a880-50ea9a45432e", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74bd67da-28a1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690038440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038440, "uuid": "207f1880-54ee-4860-83c0-f404fa93e5a0", "comment": "Malware payload", "value": "dbaf623dbb0b456ecc3c517d20028e94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038440, "uuid": "ff6e33dd-7231-4fdc-bfda-790d1642b511", "comment": "Malware payload", "value": "82bf98526028165b2b4700282a2a0e88f36015c1948ba4890aee7e53f14b2a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038440, "uuid": "71e93104-5c06-445e-b9d7-c08cb491dbb7", "comment": "Malware payload", "value": "1a5135f33d9825928b6ba01f5c6c990d54c0d493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038440, "uuid": "ee381efc-b716-45a2-93d2-43cdf6db3243", "comment": "Malware payload", "value": "f8b5e384710d629e554c0b8ed9c6309b34c66c7d5f7a668c081b9e6b13ee2d74db10601213798606a8a37d90ffa28661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038440, "uuid": "f5f6d69f-6ef8-4fb3-b7d1-a10cbdb70779", "value": "T17EE24A483BE58327D6FE2FF229B6A10102759507D923EF5F4CD885AB6F67A8142003E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038440, "uuid": "1f53991d-c560-4469-b50f-2f82931a11a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038440, "uuid": "58cb66cb-40fe-4c97-b57e-1bc39f3186ce", "value": "384:57wTA+5OfPgEBQqWvfcQLZe3s10hYACSqRDTnY2uRugtFuBLTIOZw/WVnvn9IkV7:5rgECfLH1MYAoRDTY2uBFE9R7OqhBbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690038440, "uuid": "b602dd76-672f-4bb3-ad90-c62a1eafde95", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690038440, "uuid": "67b3a7e7-3354-48ac-9743-f5f9a21de89c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038440, "uuid": "87399f00-6ac4-4cf6-9669-ad736e8568e9", "value": "bOyW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aece49fb-2877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020499, "uuid": "95f9def5-ace4-4bf4-bbc9-5e4fee4021d4", "comment": "Malware payload (Mirai)", "value": "b835c1738b114ca8b447f8bb7e1aad9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020499, "uuid": "69ffd4db-1f1e-4d63-8fe6-604613c8c739", "comment": "Malware payload (Mirai)", "value": "84132a79a8b0198ecf2a8fcbc4bac0b84f97d9ead4786501811522664bdfa9f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020499, "uuid": "f30c96ec-4519-4836-9290-832f48819873", "comment": "Malware payload (Mirai)", "value": "9ccbde64bef0cda042bfb84e5bb9b75d39383a35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020499, "uuid": "6008de18-0854-4e06-8460-3fa8181c7e3f", "comment": "Malware payload (Mirai)", "value": "494b6349f852a155890a6227bd2f8cc9a1684151a191fcd9becbe3ea0da893750cebe8c3a6a5d890d54af65fdb95b774", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020499, "uuid": "6aefcd64-8d7a-48db-9009-4935fb983510", "value": "T118733AD9B4028E2CFE4FE579941A0E09BD2423805FC30F27A6A6FDA36D731557D12D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020499, "uuid": "af38184d-ac95-47fb-b7d3-3b3017a50bef", "value": "1536:FS/tq4FuHkUg78JzR9ZK87KKWJvHEMZ2H1:FS/Mj7lTC/HnZa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020499, "uuid": "be0dad94-512c-471c-bde5-ae5b5155fc1c", "value": 73524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020499, "uuid": "5f87c453-a1c8-4502-8648-bc270256f068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020499, "uuid": "f699f5a9-2b78-4a96-9c31-bc1b98fa935b", "value": "b835c1738b114ca8b447f8bb7e1aad9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb8d42e-2865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690012608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012608, "uuid": "909c4036-8978-4767-8324-ca525e4f7dd3", "comment": "Malware payload (Mirai)", "value": "c3ce87452ccf55a01d078e34e1e8cd76", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012608, "uuid": "0569fa6e-dc76-4fba-a177-4025f4a5a5ef", "comment": "Malware payload (Mirai)", "value": "854b10b967dc46b96f14bbd183b06cff2442b1dc9c2861fd4cce5054e0c95146", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012608, "uuid": "e8f6d432-cd76-4e6f-999e-8960af28bec6", "comment": "Malware payload (Mirai)", "value": "37c149934d40839ac43535f5fe510b464ae21728", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012608, "uuid": "f6b7e6fa-0168-475d-b6a2-42607ba1b473", "comment": "Malware payload (Mirai)", "value": "68072ff41d7474542b60026cd95eb7b727edf7639cbaae7c7d3020ac19673305ab5a6f7b642a690183b1e4635017d21d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012608, "uuid": "f3d855b1-a84c-4809-95c0-5027fddd7c98", "value": "T103A37DC5F643D8F1EC5645B2543BAB729733E43A503ADB82D3689D32EC62910DA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012608, "uuid": "7e0faf99-5c1a-492c-a724-65fdbb58e674", "value": "3072:clzy8RxOu0XH9BocV7XXOrWD3ZOvterkWO:m2QIn3ZwQIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012608, "uuid": "6f2f7440-319e-4638-af48-60eb1d20dcbc", "value": 104396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012608, "uuid": "bd59ab9a-ad5f-40fc-bcce-57de3f561961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012608, "uuid": "4f0f729d-c5a2-4fb0-b2b8-88db2dd1a542", "value": "x86-20230722-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03b712d-285c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690008985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690008985, "uuid": "3ee87606-ad59-4c02-ac79-d9ae20fbedfc", "comment": "Malware payload (RedLineStealer)", "value": "47416d7f4a5624181edd47e0bd9821e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690008985, "uuid": "0810e71b-039a-4884-b185-fd9af24b287b", "comment": "Malware payload (RedLineStealer)", "value": "861cfaafee3a7a3a67bf5d707b193c7396811c8c7c22136886e2bb0513e4fd66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690008985, "uuid": "8404dccc-3a92-447a-a93c-c4ac060571b6", "comment": "Malware payload (RedLineStealer)", "value": "609e3ab6fbde6b906a91e40b50da377d9bd4e5ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690008985, "uuid": "e255f56d-e0f9-489b-b3a0-66145b1c4751", "comment": "Malware payload (RedLineStealer)", "value": "ce255db5db15b5a4078ff16604294a66e8e43b2696192274d638ae1b818bf4d8a61d5dddc8df14d1aa6cffb618bf0115", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690008985, "uuid": "5debe168-fae8-4d0a-aa88-3325f59a84f5", "value": "T1032612C57EC46771CB97FE310046813D9064683600478AD33AB6DA85B798E8F27E7FA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690008985, "uuid": "cf140b0d-8651-4d5c-a47c-c52a6b2eee4f", "value": "fbaa33c2c1f9ffecc1bcbd6a9ad09a45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690008985, "uuid": "bcd90db8-be43-4a3e-aac6-51a0f7870ffb", "value": "49152:FajBnYYC4aYkARMmsxyW3qTqfbthg1v5o62W+X02W+X8X:FyBnZC4aYkoMmW3sqf3Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690008985, "uuid": "6bef15b4-2798-42d8-a23c-d368f4394d43", "value": 4539392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690008985, "uuid": "c46304e1-e144-4081-9401-96a85fd95c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690008985, "uuid": "24b0b47b-9998-49e9-bfff-43dbc0351e19", "value": "47416d7f4a5624181edd47e0bd9821e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9078dd59-287e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690023454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023454, "uuid": "82c18f8f-b895-4935-96aa-e28b488eb417", "comment": "Malware payload", "value": "9dd2c87e250989d8c4aa8fa6421757b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023454, "uuid": "adcbb1e1-fcf4-4f8a-b0a9-a86dad02c180", "comment": "Malware payload", "value": "870444abec4ad178b7f7f29957865f588b41c8aae05fe56c0167f63f101c07c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023454, "uuid": "3a45b6a6-9e91-40bf-8093-90946cee3071", "comment": "Malware payload", "value": "5cfb6a0db732f9f66f089e4bc26c312c0610287d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023454, "uuid": "080f40c8-4db5-447e-993c-d8bffd882964", "comment": "Malware payload", "value": "9ed974b2d0d83ab4ac4ad8334a7aa2497bce360d55f8f9a454b836f3075f83b477d85ca35307cced7504d8be8f5bb867", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023454, "uuid": "a08560e7-0a18-4754-a5e8-f35dc83036a6", "value": "T141438D37E96E1E74C08641B074748EB56F23E5C883972EB61AA9C2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023454, "uuid": "061224ad-2789-44a1-a1d6-c2e66cb1865b", "value": "1536:Naa0brW/Od9hlCRbK6fxKwXQCcpvDCM12+W4:Nv0brWGd9X96fYwapvDM+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690023454, "uuid": "10718db3-dc33-4ae8-923b-2eeb9ede71a3", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690023454, "uuid": "c702baa1-0407-47ec-9054-a508d3a946df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023454, "uuid": "1442e20d-ce9b-4c7a-ad02-ade3ed0dd727", "value": "9dd2c87e250989d8c4aa8fa6421757b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bda81f3-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997999, "uuid": "52cdc609-a724-4612-b6f6-f98f42932adf", "comment": "Malware payload (Mirai)", "value": "cf8e12825c6474394e79e46b3cd401ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997999, "uuid": "71d933d4-93cb-4b7f-96f2-e8583e38915d", "comment": "Malware payload (Mirai)", "value": "87c92d99b9b685c012fdc106194b96b0abca26f43929171f10e393a61dd122f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997999, "uuid": "5b074392-ab00-475c-a616-f6a8034e54e4", "comment": "Malware payload (Mirai)", "value": "4c7099e063a60a79fb7a654adae3be4cd61c49b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997999, "uuid": "226a5b0e-629d-4f55-b007-72ae9fa0a441", "comment": "Malware payload (Mirai)", "value": "a6fc55f3774edaeb3cb0f0e9d35f6526fd5251795df5e429ea6561cbc7608142e90605852b1f6b241b0b509a24ef10fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997999, "uuid": "94639e70-9b56-4f24-99f4-5916cfd8e101", "value": "T18E53F682BC51A629C7C04777EE6F509E3311A7DDD0EA3742DC150BA47A8AD0F0D67B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997999, "uuid": "6168026e-cc44-4cd9-9fca-4f737168d0ad", "value": "768:+Iy0ZSX4ltGcqbf8i0Gnr7O2xrV+RDF+Vso15cy0uiDz701T1fj7NSqtUut65aQn:4uSXG2fqGnnRxrKIVXcB8t464qH+Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997999, "uuid": "3a6b67f9-a0d6-47fb-b533-1f40a7dd83a4", "value": 61200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997999, "uuid": "d55db4c4-07b1-4dfe-9cab-3998b88db5e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997999, "uuid": "9e21ed6b-fddb-4d9d-96bb-1759a1ef0769", "value": "cf8e12825c6474394e79e46b3cd401ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2152c33-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014894, "uuid": "494761f4-1b67-4187-a5b1-ac6a3a04bb6d", "comment": "Malware payload (Mirai)", "value": "9716550fe93cfb16b15b544eb56f11fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014894, "uuid": "28d4fea6-b2d0-4540-a93c-dc0ba4b7884d", "comment": "Malware payload (Mirai)", "value": "894846a6ae6fb0d880be977746a7fa4c0248cf2a6a5b2070a4d2a6d548bf4bf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014894, "uuid": "0063035c-a00f-41ad-815f-2d78255fb94d", "comment": "Malware payload (Mirai)", "value": "de22320d9b058a177b389fa6b8d0a656dae334ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014894, "uuid": "b7998a42-44a5-43ae-9f30-7cf1b80bdc50", "comment": "Malware payload (Mirai)", "value": "fa48aa037181f19176343b6494f8104638a364c97d97182825158a1f902ac65946be9a2129e14da0dc933504ce25a758", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014894, "uuid": "60d767bd-82fc-4ade-806d-3009b752fcfe", "value": "T1C8835C03A8664F77C043A9F925A759314B13FCA30B6B274A71399DF40A875CEB81AFD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014894, "uuid": "069eda50-8727-4b9b-add3-d5e849d32750", "value": "1536:cmbMTBvKFdlz53jhHJkyAlbCx5hQBlD8ykBfhdV6ZLzQfSP6:f4TByFNjhHUbc5hQBlXCfhdV6ZHQfSP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014894, "uuid": "951be362-86c6-48b9-b6bf-7a2c650ef14c", "value": 85548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014894, "uuid": "54a2c820-6e91-4f60-a4ed-f69794c4ddc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014894, "uuid": "88b9e96e-2bd6-474f-9d4d-5da60d569ca3", "value": "9716550fe93cfb16b15b544eb56f11fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac28c4d-286b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690015365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015365, "uuid": "257cb8e0-4dd8-49e1-a2c2-a4feefa59a28", "comment": "Malware payload (AgentTesla)", "value": "c0e4327c771fc41497ea04f6056b9170", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015365, "uuid": "8be4fa7b-af2b-4d99-b5ea-59b4825c3d4d", "comment": "Malware payload (AgentTesla)", "value": "8a8fcf3de73b26d11a9c41d8a999c6e41ebe29dbfebb572fb0a1f700416ccce7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015365, "uuid": "55aa0ca6-d11b-4186-bb84-9f96ce53c0e8", "comment": "Malware payload (AgentTesla)", "value": "1ad60e755e548de5884015ec5409efa92abea93a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015365, "uuid": "8de97e6b-cb95-4454-8dd5-c077b75156d3", "comment": "Malware payload (AgentTesla)", "value": "c62467771a48c76997cc626045de6211f31c03101ad289181bd0be76e7716de6dc50397b467c246fd47ea55afe03377e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015365, "uuid": "2e641b40-5591-43d0-a0f6-20c236fe4f73", "value": "T1B9D4237CDC66A7A6A5B9C0CAA981C8309053D77B178253C4EA903C72DF486F6DE6713C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015365, "uuid": "0ec4b1b5-acb6-4a4e-89b8-91462d74cfaa", "value": "12288:E7m1TPYCo3OeSdlvzplCIFbcj+ydhz8fwmlM1WhIfAtVG1pNmwEb:x1zQgTbQ+mEq1KHG1pNR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690015365, "uuid": "a207296f-bfa5-48b5-bff5-fc43021992ce", "value": 607873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690015365, "uuid": "dc9bab95-7b5c-4308-83ac-f82cf7171910", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015365, "uuid": "5a3d6ec7-348c-4016-bddf-7ca9017b7fdf", "value": "3433109056382544127859043648.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93963dce-2878-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690020883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020883, "uuid": "0c0810c0-fc9b-4f70-bb90-e2815463ec95", "comment": "Malware payload", "value": "ca16befe59645e3791ced682c5ff5c9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020883, "uuid": "f55c4430-b8e9-41f3-a840-5b1e28d785d4", "comment": "Malware payload", "value": "8d1dda69b38556b9655eb4ea41296b8d45b829fed7ec45b495e27a41c39dceb2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020883, "uuid": "bf7c6f6e-43cb-4f57-ba66-67b8a918e4d5", "comment": "Malware payload", "value": "a5c10d2fae726aa2ed2e6346e2edbeb9985f12ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020883, "uuid": "9dc3dfb5-6f55-4541-9b70-6fba8789c07c", "comment": "Malware payload", "value": "760e89fc8c4732a661e848a6acdce052e50c7b12ee4b645e71f348e08100850761d761d7dbb0305e5c983bdb39361a23", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020883, "uuid": "f54ca1fe-9bcd-43a0-b2ea-24f63f1bc3bb", "value": "T14EE33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020883, "uuid": "336eb133-0330-4a94-8b7a-2cde279e0516", "value": "3072:yJTc2PBSpmZ7Oabvzj4dlRsh8ZQIldPMXkkTM/9zY:yJTcGNOabvzj4dLsh8/PMXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020883, "uuid": "cf60549c-c66a-4a2e-9d55-e4e755ad6afd", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020883, "uuid": "cf7b6cb5-ca95-4f5b-ac3b-a2ee68cae3cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020883, "uuid": "f9473da4-38df-4240-9d6e-201f9c07965c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f85321-2851-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1690004195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690004195, "uuid": "ef52a844-2c84-4ad9-a265-34e40f164303", "comment": "Malware payload (Adware.Techsnab)", "value": "a5a7ab3f1e53a92bc27b256fb3104f69", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690004195, "uuid": "b2ced2d5-ca22-42b2-b159-8939d974c571", "comment": "Malware payload (Adware.Techsnab)", "value": "8ee7d7a663d55c5337c218f2c00262fc361ea7c5981ed38da26a7197d471d699", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690004195, "uuid": "bbe5c3bc-fa3a-4bde-bd3f-db0280ef074d", "comment": "Malware payload (Adware.Techsnab)", "value": "f9f0a08fbfa289932c0e9f4ef754f61cc6371d17", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690004195, "uuid": "7c314134-1855-47b4-bc4f-259d11bf3c54", "comment": "Malware payload (Adware.Techsnab)", "value": "92ed1f44b13e81f1f529b64ca95de5435a12e1ddb005d120130fe52f3cb7926cc9f52f299a850a98c326f1fc64bbaf9e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690004195, "uuid": "2fde0774-5ee2-49ec-8eb7-17763844c082", "value": "T108B533C1F69A325BCC43953457AB382439A6316E07CE88A1F75ED910D139B41BFC2A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690004195, "uuid": "3a98a902-a044-4f9f-a10d-d94810607538", "value": "d933c1385a97dd15aed8f873b3f8014a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690004195, "uuid": "076a25ca-6543-4df4-9179-9379fd9f2458", "value": "49152:3gM8gvLVW6ijYHkN+jMTX+20SdORi2SupM+AcNgw0AWaWBNfWwYK7vGc2R:N8gvLchavMXRLM9gcNV0AhWfhl7Gc2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690004195, "uuid": "203363da-6973-4d1c-a471-05a8735f4c4d", "value": 2360320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690004195, "uuid": "55d7ce29-d0c7-48d8-aedd-307cd1dcbca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690004195, "uuid": "130f6bb9-bc0c-4662-a9f4-d68b591e3c9c", "value": "desa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e561c9f6-28b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1690048937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048937, "uuid": "3a3e31fc-0ddb-431b-81fb-79146cfa5ba7", "comment": "Malware payload (Cobalt Strike)", "value": "6bafba4a43173045136e95abe78666e8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048937, "uuid": "abc341de-7493-4b14-82af-41b1e2e62c34", "comment": "Malware payload (Cobalt Strike)", "value": "922b4ec35337016f806c0d8d2b9ee75ce4f5db550f1fe1021b8836d13cbaf379", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048937, "uuid": "46b5f3e0-5701-491c-adf6-3ed96758b5ea", "comment": "Malware payload (Cobalt Strike)", "value": "1e65992e0f870fc2c2df52559160b3c094c8afaf", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048937, "uuid": "117485c5-f2af-4972-bd9e-500017fc2bb2", "comment": "Malware payload (Cobalt Strike)", "value": "02051acc17604d7adb6f541bb3ab1206123f257ce45bea66459d6847cc919092d56bee98ea8bfd17bb59e0caf9eec658", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048937, "uuid": "5805a248-982b-4adf-8213-e2e2091edd8f", "value": "T16467339FAAD00864F4B1E8338412B41483B1FC15461BEA1B8495B7F667F37E91E3B939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048937, "uuid": "dcd1b1b7-892e-4deb-bf3e-5c58c57749b4", "value": "809ea02d92fea89353f33279290e8c9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048937, "uuid": "f1028012-2d75-4582-be9e-60b842148f44", "value": "786432:YqGlsyofwykqk/ql57FQ24HPgIbsorr4YJcyT0RG:nG2oyk7ylfQJPTICbJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690048937, "uuid": "bffffbf8-65d8-4d94-a6d3-01667a3884a6", "value": 30153870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690048937, "uuid": "8e648683-418c-4bcb-b8f0-ddb14dced63d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048937, "uuid": "aad11eb4-1f2e-47ac-a250-86106b7fe57e", "value": "6bafba4a43173045136e95abe78666e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d79560-2860-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LaplasClipper)", "timestamp": 1690010714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010714, "uuid": "3093ca0c-4b10-49c2-bec4-398002188f26", "comment": "Malware payload (LaplasClipper)", "value": "5204e5160631e610268e2f9c37e0e0fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010714, "uuid": "0ce8389a-20e9-41e0-a360-45d5e8a733ce", "comment": "Malware payload (LaplasClipper)", "value": "977576b2524a137c9477d4ecbe5530a63c3b40e143dbf499f58cd1c5dfd5a2b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010714, "uuid": "0bf94d35-2279-466e-b1ee-43cf9d6d48d3", "comment": "Malware payload (LaplasClipper)", "value": "62894f9984688dfa89c107d87468299880a8423e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010714, "uuid": "1c641cc1-728a-48cb-83ef-4ee27fab0741", "comment": "Malware payload (LaplasClipper)", "value": "9bfc502d4c13f0ffdd26f0e4a4289a281dac23c05989b294fac1ba2b35b85415e03212a40153fba32661b0cc051b7f57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010714, "uuid": "6676e7d1-d38f-4776-8ad5-362ac3a9f523", "value": "T171447B2175E1C432D2B2113318B8DBF6593DB8320B6649EB73D45B7E9F206C2A770E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010714, "uuid": "5f494b56-6fd7-4ade-a9c9-4efa9e29b295", "value": "f8c12f7b1b7b68b646d178437ec9f983", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010714, "uuid": "084cd33f-b53c-4867-b597-9a166b1c65dc", "value": "6144:H3ZKOCO0aqqfzF3OPxX/HbAOtuP794/KM:H3lCO0Jbbujn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690010714, "uuid": "21729293-0250-43e0-9cc1-70b7412cd7bc", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690010714, "uuid": "303e3da4-f078-4dbd-b80b-4eb667203132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010714, "uuid": "d353bb1d-8414-4921-8141-5577b5bc0bac", "value": "DriverSuiteforwin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8082bd7-2877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020488, "uuid": "5f393a2c-aaa7-4ca7-ba6d-dba56d84bdad", "comment": "Malware payload (Mirai)", "value": "56fd2b7128eeef11c70e72c9100d21c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020488, "uuid": "203a05f4-f748-49a3-a7f2-d2932c9c9231", "comment": "Malware payload (Mirai)", "value": "98ae69f266eae9ca6b79e545442f58a0088621cb70c2cc24e1c611ed939a036e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020488, "uuid": "0922a1a5-a802-4029-bfd2-ec380034ab6d", "comment": "Malware payload (Mirai)", "value": "9cda694a2217bde9f2502dba391ffba65d167e49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020488, "uuid": "3f847b65-1078-4dc4-a1b3-298d1de24953", "comment": "Malware payload (Mirai)", "value": "3cb82a8820182fe395416bddb156d04355b6a7ad02eb8154a15b24bedefdb85e187b2609ac340ecb52622e9167872923", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020488, "uuid": "482b928a-9877-4fa6-8760-9950be8cea1e", "value": "T193734A25B97A2E27C0D1E8BE11F74721B6E257DE26E8C60E7D720E4EFF216405503AB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020488, "uuid": "73f1fc7f-6f65-4372-bebe-f091e1fda98b", "value": "1536:OHtSobQa99ETZzEEGxy8KsqUBN3vpPan12QO8PFUV6:s8s6Wn1an188tU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020488, "uuid": "9cb5de16-ffbe-42c0-924b-863e2b8cfdb2", "value": 77304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020488, "uuid": "ce1f9513-31a9-4f81-8936-8b0e7cf4bde0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020488, "uuid": "e9130c1b-a643-4634-af23-91368a7ac386", "value": "56fd2b7128eeef11c70e72c9100d21c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7334cb10-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690014815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014815, "uuid": "52009b0f-c6b9-4236-a18e-613859c4234f", "comment": "Malware payload (Gafgyt)", "value": "0aefc5e208480d49d3f593335d260d8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014815, "uuid": "1ab53ba3-200a-4ee1-9337-af2674c50a0a", "comment": "Malware payload (Gafgyt)", "value": "9c231d9fbf20074511355a11fb9737626560ea05842f01536a751235489de351", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014815, "uuid": "43b88d96-e255-4019-8530-3d6ae584beff", "comment": "Malware payload (Gafgyt)", "value": "7b02b87b838f44d6c5cb11130aaf60f4177037a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014815, "uuid": "99efd5b7-c8cb-41cf-85e8-c5cbdda273b0", "comment": "Malware payload (Gafgyt)", "value": "9e2a4500ae3bb8d265b97109d41deb71316258888518e6c9d0c3e46de767b7f4de5e3c0ee52407ed0aaf46897f8ad746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014815, "uuid": "8fab3353-9cea-462f-847e-f4ed3cfb6695", "value": "T113734DCBB681CB73C0830AB502AB5B110632F9BB1E57AF46F32C6DB49E121457267F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014815, "uuid": "9afe4304-d59a-4dd5-9a7f-66edce1fcea3", "value": "1536:6vbpnlUcUeUudgvmP8hVRZIkJbHe4VZvpm5hnDEeiSIvlj2NI5Vma6jtafbek:6vFlUcUeUEUmP2RZ31HtVW5hQI+2+5V/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014815, "uuid": "d9512cdc-c3dc-48d2-bf75-84e974f7e5af", "value": 80654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014815, "uuid": "834d1213-669a-4b9f-85d3-be259ad9f488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014815, "uuid": "353cf103-afeb-4998-9d25-976fd79096db", "value": "0aefc5e208480d49d3f593335d260d8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3584576-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009313, "uuid": "3f9882aa-c0bc-43cb-b602-0f33358ab404", "comment": "Malware payload (Gafgyt)", "value": "ffd9841cf5547af12c6aaac61516b7b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009313, "uuid": "c57b30fc-3de6-49b8-b126-608d97fec04a", "comment": "Malware payload (Gafgyt)", "value": "9e6844f4e9612922669600c13cf2378763d33466c7e5f75d34c19b1d7b6ba1a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009313, "uuid": "c0ea0707-c950-40d1-8cb1-ac5e08be7232", "comment": "Malware payload (Gafgyt)", "value": "1695bc1729773de0045661adcb781390a710e270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009313, "uuid": "5c0d5bec-09e7-4dfe-b652-a0514f6b46e5", "comment": "Malware payload (Gafgyt)", "value": "e8e9b6e3bd4b63eec6621f5b83c5b9823bdda8c8e00243ba44584fb45007602a0c90e0dfe91c909e6f0ec0592b202555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009313, "uuid": "851c644a-d540-4f10-a541-9aae13515d6c", "value": "T1A4C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009313, "uuid": "548a90de-97ae-4b2f-ada2-fd1a4fc961f0", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtANRdc0sfm7ypwYujl3IdnuW:ZP0DNPAk5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009313, "uuid": "98b93200-77a0-4c3f-8889-ace5bfb071af", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009313, "uuid": "5090731f-3bf5-469d-9a1e-022f24165c61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009313, "uuid": "5c10961d-49ca-41ff-99e8-dd96c01581de", "value": "ffd9841cf5547af12c6aaac61516b7b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5ea5a8-2865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690012604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012604, "uuid": "a5a61629-cd2c-4540-b33d-679bf92b10c9", "comment": "Malware payload (Mirai)", "value": "6b674b78ef71be8514fa0124593d5f07", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012604, "uuid": "0bf60d36-a234-4479-882f-6d9124af6fe2", "comment": "Malware payload (Mirai)", "value": "9fba36524dbf7f52b2a70dee9510715bed8d82d0273e14a024c75eff0365d330", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012604, "uuid": "432624e5-ebd2-4e97-9e44-df7db1d80033", "comment": "Malware payload (Mirai)", "value": "eb49fcd289c227182935bb8257da02c81839976b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012604, "uuid": "38d87452-4a3f-4ef9-b488-59a395432d4f", "comment": "Malware payload (Mirai)", "value": "ca970267e453535c4f3f1cc07ea5735ac6d948512290b003e3f2b7d89f5b7a89263720919f892fd0b4bb9bda72605063", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012604, "uuid": "be6210ca-9859-4efc-b864-f996eb3f0255", "value": "T1AAE30845FC518B63C6C612BBFB5E428C372A1768D2EE72039D256F24378B95B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012604, "uuid": "e949fd9f-b284-4349-a766-44ff71f3aa66", "value": "3072:AIwT7QT+HiqFGb4bEZkWWx4f9Mp8Wop6z:AI/TmAb4bgkWWCRp6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012604, "uuid": "15ac3921-1c45-459a-8cc0-28514f63c0db", "value": 145804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012604, "uuid": "73a27843-4b6a-42bd-8085-26f28851e64b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012604, "uuid": "94c23dc4-c802-4362-aa74-bc8a2de8db24", "value": "arm-20230722-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c05a8d-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997992, "uuid": "88de05fe-05a3-434f-a737-e3bd55407e7f", "comment": "Malware payload (Mirai)", "value": "3d88b6dac58e7493313355d444ccb3a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997992, "uuid": "48ebf4cb-8e47-47ea-8df7-6dd7a83179d1", "comment": "Malware payload (Mirai)", "value": "a5eef431371746928835252eca755be13a6d77e5768c02548149b64b2ae1000b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997992, "uuid": "abbce8ea-3347-4459-ab8f-bf6a6e64e71a", "comment": "Malware payload (Mirai)", "value": "2abbd10d2d388432de68840f863d44bf6ee938a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997992, "uuid": "ccdc1c25-c8b4-4d9e-b2ff-68ffee42e975", "comment": "Malware payload (Mirai)", "value": "8b949d386218c251bf5f1e7f7a0fb3ea8472f88778e73c4b6087b9d75135ccd739d84db3e8ae711d236b3304a841d371", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997992, "uuid": "55edd780-28a2-4eb4-94fb-fd1071a65a02", "value": "T169630A85F8C745F5C8074A3460BBF33FDA32D6BA40705A6DEF59AE32DA37A015212399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997992, "uuid": "27e63596-b009-4792-916f-f6e7e3333fec", "value": "768:HNlq/jqP7jqWYIlupudaHhOOvMLXmHeogHH3CvwetM2AVq3wWu7K29zlrRY3IWp7:HzrP7QIlOudSxvwCEXWwnY3JpazqOpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997992, "uuid": "a1f73910-24a4-44c3-bde6-4a09d0e29c84", "value": 71312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997992, "uuid": "9825b982-9c4c-428a-9b62-65edc13898a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997992, "uuid": "5c80b347-14a1-4291-b685-7cf2f1bfec02", "value": "3d88b6dac58e7493313355d444ccb3a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9173166e-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014866, "uuid": "0eba9eb7-6a28-4eeb-9fc0-977e96538416", "comment": "Malware payload (Mirai)", "value": "7901fd94c526521b9c22367025adc5bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014866, "uuid": "47f001e8-452d-4518-a990-97d0459285f9", "comment": "Malware payload (Mirai)", "value": "a748f92ce0fdb2af9607a772594a268af099ebba1b0a722a4f7232732c515dfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014866, "uuid": "0f7fd7f5-5856-4b8b-8e26-e2459a8e0bdd", "comment": "Malware payload (Mirai)", "value": "0e461e65532939da88b7c55814cf242b318a082b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014866, "uuid": "e6da4d9c-9159-4fa4-b863-93acc34c772a", "comment": "Malware payload (Mirai)", "value": "e7b6092aadf417f4bee2a87b5d6b1388cb3ffcbac3dc987e129a37944e46477222323f985f654d238d2d0b4c37fdca74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014866, "uuid": "a20f77a8-f559-4b0e-89c9-d678c93bc34d", "value": "T16CB3C86A7921AFEFE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014866, "uuid": "7111cdbb-cd8e-4851-b719-6ed0a4592d3f", "value": "1536:0Tr/trhFiuT4m+yuyHmb59Xw/r3KdRBej2/zF5hZO7xgqPUKdwwjF9GhCPR1Ae:C/4g3Kd1rF5hZmxg9KdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014866, "uuid": "ceb1e0d9-e0ce-4420-ad2e-3b13557d6218", "value": 116506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014866, "uuid": "89c16055-2cba-4242-b1a4-5e677e3cb179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014866, "uuid": "832014ff-3799-4845-b30d-683553a31e33", "value": "7901fd94c526521b9c22367025adc5bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae31a77-2877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020519, "uuid": "7e902f57-54c3-4a63-a7c5-b1ac0689ba2d", "comment": "Malware payload (Mirai)", "value": "f0d41fdb2f84e93012e9506b3216a41f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020519, "uuid": "0739471a-fc9c-4142-827b-f515156453b9", "comment": "Malware payload (Mirai)", "value": "a8012a4c1c981f96af1379565aa00705b2a0bff3458c9b92e78f5351a250e6e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020519, "uuid": "070f5939-f99c-483d-8ccd-5ef8ebb1f3ac", "comment": "Malware payload (Mirai)", "value": "cf0df6f3b2df7cef5f8d2fad3ab89b090a2f904a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020519, "uuid": "3073360a-062f-4b18-9923-8c5e00313330", "comment": "Malware payload (Mirai)", "value": "2beb8feec559d18e8a2068053786481caa86e111179b15dc0202b992f813ae37fec9aab4fa333a66eb23d9dc5074bc15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020519, "uuid": "abc95436-14f6-4983-a58f-e3bc973bce2d", "value": "T1A4A3D716BF210FF7EC5BCC3709A91B45298C554A21E97B367A34C818BA4B35B19E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020519, "uuid": "4fa1cf7d-86c8-4b0f-982c-7fed37054cd8", "value": "1536:OQUXqTeo88bLM3nyEhrxQhyQjbwywJZf4Z7MNFroqP:OXqTeo88b0yE5df4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020519, "uuid": "a37fb010-e92e-45b0-b379-5b0199ae9a53", "value": 97908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020519, "uuid": "9bd737c1-dd35-4ed6-a678-f5a14415dc03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020519, "uuid": "604edb41-c332-469d-a0a3-882102128b5e", "value": "f0d41fdb2f84e93012e9506b3216a41f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3e597a-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014829, "uuid": "0e36f4c1-9229-453e-aa1c-f07398e316dc", "comment": "Malware payload (Mirai)", "value": "368b8ddd62f91d534df14de5e860e9c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014829, "uuid": "b8da9206-a650-4495-8bfb-3413ab5e7de8", "comment": "Malware payload (Mirai)", "value": "a941c90c180a822180a428f2b58b2189ec3b3168368dc38a1e028d35ec62c1eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014829, "uuid": "dc640629-0969-4308-9347-818f7320a292", "comment": "Malware payload (Mirai)", "value": "52fffc77addbe7ad0007bd241d2cd3f3d2ea65e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014829, "uuid": "4178ec35-31a8-4738-9f11-e6e0ea51879b", "comment": "Malware payload (Mirai)", "value": "c1446c15c953445ddbabfe4370d919c2ee28e4065c3e79a69050403f044781c88daabeece156783f5cf427f6a66f54cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014829, "uuid": "1543929a-efe5-48b0-a43d-ca577fdde3bb", "value": "T15AB3F857FB11CEB3C85FDD7306A68A01108EA59746D97B6BB3B4DA5CE70694B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014829, "uuid": "f1f0f370-7669-469e-8947-ccc03a6f2f8a", "value": "3072:Tgz/5f5g8utgN5hVw7eEKdwwjF9GhsR1Ae:E/g8kgN5hVmeEKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014829, "uuid": "26108981-cb8b-4f75-9050-b83cd0567307", "value": 116650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014829, "uuid": "70184b66-e853-4e39-92c7-a69e3469717f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014829, "uuid": "778d06c8-42dd-4f2d-88f0-60fcc32095a7", "value": "368b8ddd62f91d534df14de5e860e9c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df2c516-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ModiLoader)", "timestamp": 1690014807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014807, "uuid": "2c1e86c9-33b3-4074-8ad5-178d5410d6b2", "comment": "Malware payload (ModiLoader)", "value": "33780c0b1e1e947eb65ed5a3edb607de", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014807, "uuid": "78feb9ee-3c90-48e3-ab87-26bb9aecb87a", "comment": "Malware payload (ModiLoader)", "value": "ab09c0ffd7bc126ae2c18376baf5150284030c9b34211722aa3bddc7e7a09df7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014807, "uuid": "3475eaf4-307b-4ded-93b8-835b2e34271b", "comment": "Malware payload (ModiLoader)", "value": "3a8232371bb5f2225bda4478919b26c23e3d30cb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014807, "uuid": "bfbb9f3c-d39c-4a46-b47d-059c4f3fbe14", "comment": "Malware payload (ModiLoader)", "value": "cf9bb76e9f9212ca4a574acd1ac2b519c196d9ce49272387b85d49a09688e21266fdc8d652349fcde1a5517abd64b02b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014807, "uuid": "60455d8c-5e00-4b23-8ce2-e390d6b74e58", "value": "T167F49F21F1B14473F22356789C1793A4682A7EF32D5CA947AFEA3D5C9F396C03828197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014807, "uuid": "620228a7-18db-466f-b7ba-60cd8c5e4259", "value": "72020b86bbe734c2ed3417572bff8faf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014807, "uuid": "0cf8b806-7c5d-4805-a075-31f8604863bb", "value": "12288:3Ouy3CoGtRq54TIhnIvT7SEzI8h4COdzuCYcqE:3lmGtRq5PI6EzI8BOdzuCYcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014807, "uuid": "2306e905-0f30-4f47-a57e-c3ab84018456", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014807, "uuid": "8b745e68-eb0a-4619-9fc5-da289d0531d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014807, "uuid": "a440017c-e28a-4efd-995e-639f6717f665", "value": "DHL_2017128 Documento de recibo,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd6937c-2868-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690014189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014189, "uuid": "41c15d5d-e09e-49d5-a22d-a84c2cb919e8", "comment": "Malware payload", "value": "fa278a0145ec82c72d8914bff3b393c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014189, "uuid": "dac517d9-9ada-406f-a10e-707b32253e2f", "comment": "Malware payload", "value": "ab77c0f5e0b1863f8d45212d306c50504d1d3881c7f5295021fd8bb30d20c87b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014189, "uuid": "32748eec-f680-4c74-9915-01564102597e", "comment": "Malware payload", "value": "7dfda46e8496191bee3fc556d821dca0399ec206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014189, "uuid": "34ecb564-2d42-4512-8984-a6723cd7a5f7", "comment": "Malware payload", "value": "1c2158eed1623214a7ead64140366c54aec0eac8a16fa5859e00b901a18514b04f0e054717dfd3d2e8eede22da829f4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014189, "uuid": "38346b57-6eff-4ffa-9922-1471aca45ae5", "value": "T1ED85234177C18AB1E0631A336E299F21A73DBD301F3A8ECB6390741D9E615C19B37B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014189, "uuid": "8edafd85-6ec8-4f42-a4f2-40ee45d60d1a", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014189, "uuid": "75fbdf8b-b67e-477c-a9bf-961a2808f9bc", "value": "24576:PgZXoZUTVdt7K7UbU2Rw3DyYIq/+MaVZperbYYpk5x/8L1H017nv93WETi9ntvPX:u5hwz7/+tz//8hH0pnF3WETi9tdtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014189, "uuid": "70429d4e-2f7f-4d67-b550-a8d794c28a6c", "value": 1752504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014189, "uuid": "a514b2b8-cdae-449f-9ca6-8ab3b2c0673d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014189, "uuid": "669d97b0-f3ac-4599-afb1-8ee2e65042dd", "value": "fa278a0145ec82c72d8914bff3b393c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041e4a13-2869-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690014200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014200, "uuid": "40c7fec7-a67c-402e-b9c4-a2b80f4d5a68", "comment": "Malware payload (GCleaner)", "value": "8414d6c375ed4b07a120d968724c18ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014200, "uuid": "3afad4e6-570a-4969-ac0d-7c4e008d528b", "comment": "Malware payload (GCleaner)", "value": "abe8560ce8d8afd581f90ae960d17ce57ed6c138a7c5d5502aad95450804dc1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014200, "uuid": "9a2b1b94-40be-4ad7-8075-6f952bf3eaa7", "comment": "Malware payload (GCleaner)", "value": "e8a00e5374fbe9893a7ec2dfc4e7256290414017", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014200, "uuid": "ec992da7-2264-4463-886a-555e141173a7", "comment": "Malware payload (GCleaner)", "value": "68036a7775c95dbf6e97dd48d523afb91f7708b27a7146c610b7dcfe997ca6f5e2f26207b07c479449305761a215327d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014200, "uuid": "2980dea6-46ca-4033-a2e0-a6068199ea29", "value": "T12974E06175E08032E873653049B0D6951EBAFD629B7465CB33E83A3E6E703D06A387D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014200, "uuid": "5af03c0f-4d2e-4376-a028-449e6bed70b6", "value": "5b111959cafa672ed9ebce470542d073", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014200, "uuid": "873fcd48-ff6c-4d16-abc7-9a588844805c", "value": "6144:pAvrtIL8O86/17Mw2ib3d1XiOMMjI6CCCXetPezN9Us3n:pMILRtN78C3dsGs6GetPeR9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014200, "uuid": "22b662ea-588f-4d04-8131-30cb53e62672", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014200, "uuid": "a9d2563f-356b-499f-bcab-483e3189601a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014200, "uuid": "48400d77-bb02-4cb8-9256-7b59844ecd96", "value": "8414d6c375ed4b07a120d968724c18ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31b499e-2872-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1690018359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018359, "uuid": "7d533bfc-7252-44a5-a2db-ebd13a38da10", "comment": "Malware payload (ArkeiStealer)", "value": "ed3809d571d4d52fa5bf9339b9750b27", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018359, "uuid": "d485cbbb-d8fc-4d41-8773-c16fc7621a76", "comment": "Malware payload (ArkeiStealer)", "value": "ac3e72d085e062564ec329377615d7188683c24e4e6744c75eb5be82eb91e132", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018359, "uuid": "617105fd-5944-48a1-9a0e-02027a2df600", "comment": "Malware payload (ArkeiStealer)", "value": "f728c9e1bf9ab25a57fff6e85b55265360ed0221", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018359, "uuid": "8867df65-db9d-45ab-a99f-c2cabbc4c1d5", "comment": "Malware payload (ArkeiStealer)", "value": "a08df2491d7b6b41de4dd4d895fb2b55625cc4cd767a56b98a2bd0dc50f700cad7854b410425bf1e9187b96b203bae85", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018359, "uuid": "9142f5be-a9c5-4c7a-98d8-89796166b64d", "value": "T169268CFF9204146282536CBE45397C9A93D4EB174CF18E423E2B3997C6BF6E18172762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018359, "uuid": "5441ebd7-56b9-4b30-a5cc-9d4b92756cb3", "value": "055ea1090d6cc01b13403afd6132861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018359, "uuid": "14204819-b3ab-46b5-903f-c6a591f68145", "value": "98304:yqL5M17FDIAh1sbMIwFGvcJFfh3csYKH2SVlEZgxYvG+7brIFZIIffmyEiD0n48T:yqL5M1dI06bMIgGUP+KHx0exyG+7br4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690018359, "uuid": "79745928-e1e1-4c25-8a7c-4211b3e0f863", "value": 4441264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690018359, "uuid": "6c28b644-39f0-471c-a1b3-8bd8e9c66353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018359, "uuid": "d7086ce3-ef11-41f1-9c61-57c58b0fcb5d", "value": "SecuriteInfo.com.Win32.PWSX-gen.31392.13529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed7e90d-28d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690061865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690061865, "uuid": "28aa835a-d95b-4f6d-b2d8-85cf326ec894", "comment": "Malware payload", "value": "a3e05e92302d306106dd935c92b412dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690061865, "uuid": "1160098e-d9df-45cb-9171-c8825b9be9da", "comment": "Malware payload", "value": "aca424e5ca9197b864cc7b8406ee4c1a47125101c0887ea74413e09d15126d5d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690061865, "uuid": "f89d21a2-056e-4e98-9691-b67f84c8566b", "comment": "Malware payload", "value": "4f699da9193e7c9efcdaec9ffeb252af97cdf7fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690061865, "uuid": "f47d3550-3ae9-4d34-bf76-8c7659df30f1", "comment": "Malware payload", "value": "b5bb0498499cee97a4f06d819590dc827bd5dafa70baf90f92085f3af2895f842d1cef70eb1f22c5f69d5ddf7a0a4c91", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690061865, "uuid": "943e4801-8aca-4f66-91ee-e1f2de3d590b", "value": "T131246CA13AC9C13AD2AE153785BA9776367A79711B30D0CF7B901C6C9A307D3E939312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690061865, "uuid": "d814f569-ea30-483c-a74b-bc9c994f8d87", "value": "3072:emXwCGjtYNKbYO2gjpcm8rRuqpjCLf2loHUvULyGxr5lqM2a8:eiRQYpgjpjew5GAyGxjqo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690061865, "uuid": "0ea5b31b-4137-4210-b5e6-6e0b335ad85d", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690061865, "uuid": "db858f55-7b2d-4a19-ac1e-dc41cbe1aa58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690061865, "uuid": "354d7cf6-3fa6-45aa-bd97-f99032c74cf6", "value": "sc0pe_carved-32768.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b4dc66-28cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690058090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690058090, "uuid": "5fe24c2e-688a-479f-8e4c-2c57bd2ac482", "comment": "Malware payload", "value": "6f83c6ef2b224f7c3710c7de61ea87b3", "object_relation": "md5", "Tag": [ { "name": "Bard", "colour": "#078A4B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690058090, "uuid": "5f7d8490-28d0-4097-96f1-9e88c2374145", "comment": "Malware payload", "value": "acc06e9f627dec62b345a6b1288947ce316c0e9ab799e0c58f1f334d1be1606c", "object_relation": "sha256", "Tag": [ { "name": "Bard", "colour": "#078A4B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690058090, "uuid": "72767039-5d34-49b7-8055-e451ba1985fe", "comment": "Malware payload", "value": "bfd10db350099fd68c61dea703a176a8d4866e1f", "object_relation": "sha1", "Tag": [ { "name": "Bard", "colour": "#078A4B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690058090, "uuid": "a711c7a0-a25c-4c17-b4e0-7e1742b2b478", "comment": "Malware payload", "value": "71f83bdba7705a27c6507a6d3d26d5bcc168b77243854984f7b7c9dd77c748a79c0e7a925bde120ada38a16610f93db2", "object_relation": "sha3-384", "Tag": [ { "name": "Bard", "colour": "#078A4B", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690058090, "uuid": "9118d0d3-e30b-4654-8fab-2f3da43c1d6f", "value": "T12A8247987E83D89B5BCDD8439A635AFA2D32A0664FC4358383D9B85C85DF1A3C14C7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690058090, "uuid": "4a67a6d7-dc53-43a2-b62e-12dec0726f8b", "value": "384:KGhP8R2SQGmd/AeXzRkPPK1pwmlWwGwjtdn46V1QZZ6zk0R:KG82XGCldkupwmjptMZZ6zkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690058090, "uuid": "71d534aa-9055-4a30-88db-af7fa1b337ac", "value": 19151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690058090, "uuid": "d4048f10-cf0e-4e75-b5be-37376dfd4051", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690058090, "uuid": "63132b9a-eec4-44ca-a070-c69b42c99a27", "value": "background_JC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ee66ca-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014852, "uuid": "841948f9-4f8e-4edf-9324-c4a6cef0cc3c", "comment": "Malware payload (AgentTesla)", "value": "f2a47167f6de0e8c3993d81f2871f0c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014852, "uuid": "fa3a8c50-7095-4226-8b2f-1d80d1bbec90", "comment": "Malware payload (AgentTesla)", "value": "ae9099be0608cb2dea5b267620f7e0089bd21a51b0fcf25175a458a1f6f9b113", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014852, "uuid": "a8ea996b-30d5-4f98-b6b9-c457c5efa0fe", "comment": "Malware payload (AgentTesla)", "value": "5bcadb4bc928881bf54c7aff89865a80e03e3455", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014852, "uuid": "d70f8a9f-96bc-4205-840d-66b65886b398", "comment": "Malware payload (AgentTesla)", "value": "df2376a29502192c40def8ebbb4969225f9879b634d962582289b63cc937a0c87b5fbc591b66a1c2e89fb2b1b2efaeb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014852, "uuid": "f4b2b62b-6238-4a2d-9556-4c3651f0ee07", "value": "T195F439A33099FB89F03DA734711EE50063EAE812D313D5DDAD4A1CCA474AD89F99B907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014852, "uuid": "e3a9b920-4dec-41d1-ab5f-3e71e4a4f73f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014852, "uuid": "59225217-82c6-4333-b743-d5af293bab8e", "value": "12288:WYKo887Drw25EL/7SjfAGjT2aTNKX35wpuIJ2gPiWODJm:cNGjXTkHqP5kJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014852, "uuid": "c700d97b-3a9e-4032-b34b-4c61504b7447", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014852, "uuid": "39a1cc02-a94c-4b7a-a024-cfa9fc8f60f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014852, "uuid": "d9ed72f8-ba83-4bb2-9433-a5b317777a47", "value": "DHL waybill-5952-00117 balance (item 3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9e23c1-2878-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690020869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020869, "uuid": "57d42b6e-9732-473b-929c-3a84580ddb3c", "comment": "Malware payload", "value": "9123bc567dce84149bb5445887fc7c24", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020869, "uuid": "394f4506-35e0-4060-81c9-9cbd5f6e7bb9", "comment": "Malware payload", "value": "af5a57bfa07d2c3656b310f206ed923549b23f96d0b3823a1a50790c7561d776", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020869, "uuid": "95466193-5425-4b10-94d8-0318615b8f6a", "comment": "Malware payload", "value": "3bad7db2ae8b3e59df3937a844e2eff233d025e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020869, "uuid": "0abac684-17ba-496a-af38-dc07caaf4fbe", "comment": "Malware payload", "value": "b1729a303379790312d439a91e38e2d84d38b8bd482a118d9d32ac5463ea5b1c3dbd05c9f74909cce4ca12c2f398beea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020869, "uuid": "0fed5246-15fa-4d8b-9110-d6c833a6caf2", "value": "T11D83A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020869, "uuid": "42ecf635-7da2-4b4f-92c4-91bcd77fcecb", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTC7ZDYovZ73x/nL8y8QT:Rakdn2Eo3ePu5GTCRYo99Be037WM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020869, "uuid": "47a6f608-7285-4919-a77f-a322861d4b14", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020869, "uuid": "b3ee4f88-776c-49fe-b426-4b4e61671bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020869, "uuid": "46acf434-ee75-4848-a5e5-9022768a980b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5c32fe-2864-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690012071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012071, "uuid": "1310fe2e-e086-4740-a5bb-4c684e874f62", "comment": "Malware payload (RedLineStealer)", "value": "618d0151f7e86c984f9e6820d01cc180", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012071, "uuid": "ccdada36-e50e-4e1a-8261-0cf5760bc0a2", "comment": "Malware payload (RedLineStealer)", "value": "b26d89b1faad48a9f8c9d02a17fe70f000a43d98a5152afb05eef5daebb937bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012071, "uuid": "5d3e1152-67ea-43f8-91ea-f295fe48f49b", "comment": "Malware payload (RedLineStealer)", "value": "ebf894e7a3653ef18ddc17c5e4907693916353f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012071, "uuid": "6c0fbe82-af85-4688-96a9-ea7e5ef4036c", "comment": "Malware payload (RedLineStealer)", "value": "aabe667044bc471c82484aebb9837b4dd1c5005a74abe1c9f34ae36eda1d0bd154c2d8806208ebf39f1b6b3754fedc83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012071, "uuid": "7ef58562-08d5-4731-9507-e9683eab5d2f", "value": "T14DB40213B7D88872D9B6277068F612930B757CB19C24476B375A7D4E0DB2B80A83277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012071, "uuid": "c2a7ba62-8a71-4417-bcaa-e4068766f410", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012071, "uuid": "83e79692-407b-4bcc-ae25-16b8ac4246c3", "value": "12288:IMr9y90Tv6cXVuqeq38gIv10ldnHwn/msEva:1ymycXVKq3VIvSc+Fa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012071, "uuid": "95d1eb05-7478-4173-8c66-49b1506e1f57", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012071, "uuid": "d191c6f5-3985-4ad4-bd03-6398b109c6a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012071, "uuid": "58b80b92-f332-46bf-a3c3-e8bf9b2fb5d9", "value": "618d0151f7e86c984f9e6820d01cc180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa0f548-2848-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690000421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000421, "uuid": "27692223-cc24-4c19-975d-bc079ca06f9a", "comment": "Malware payload (RedLineStealer)", "value": "b682780aa63ccca0db6db01da0763568", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000421, "uuid": "d4f3408d-b5a9-47f3-a69e-c77dde5a93f4", "comment": "Malware payload (RedLineStealer)", "value": "b2a4ea13b351447af3be84f9ec6825e685ab8ad2d45a290f14e3c2261c628627", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000421, "uuid": "362ff1c1-6654-4385-9326-7d1c2808d8c3", "comment": "Malware payload (RedLineStealer)", "value": "172c25d58b11309e8b858f9e75a6ba3cd7923bf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000421, "uuid": "cd76fc7f-97b8-4aa9-9854-c7c6ba1530b6", "comment": "Malware payload (RedLineStealer)", "value": "5466d89061a4466b306eea1b1760b718093300fbe63b009c0130419a9a22b6d34e0eabf9ac0e1c59fa7f7b246c996647", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000421, "uuid": "53a0252d-194f-43ea-82cb-d11097bfcbfe", "value": "T14945AE1139C1803AD67321320669F7B54ABFE4701B255AEF13E81A7EAF346C15B3626F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000421, "uuid": "9da33041-e989-4ceb-af9f-86f249b64dd9", "value": "ea2d297e3bd3b5b7def0556d0ff46651", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000421, "uuid": "c41c7b2f-2777-42b6-a793-beaa8a931fea", "value": "24576:LnK5UgNEpGO6pzUqGo4dul9sykVQv/een7YL:yNEpGO6pzcduX+cv7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690000421, "uuid": "75c4c7d9-cbc3-4271-a672-9b548a7280dc", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690000421, "uuid": "92214d0b-ff5f-420e-be29-2f9076512970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000421, "uuid": "c0c5b611-e354-489d-b2f4-3db462f98dee", "value": "b682780aa63ccca0db6db01da0763568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4db6b1-287a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690021704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690021704, "uuid": "8cdad531-73ef-44b4-b455-a4b867c2d5a3", "comment": "Malware payload", "value": "9d76deb0dafc8e6cc6f12c90b4e20790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690021704, "uuid": "e0f6b319-bfd0-4e00-9754-1a024b02ba8d", "comment": "Malware payload", "value": "b447ffbe7709d4a771530b8c624569874c5078eae065edcf29167b64b609f342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690021704, "uuid": "68a14873-7bdf-400a-99b9-6ea010b60f14", "comment": "Malware payload", "value": "f80c2dc664e01a217439b54f18a707d0cafa051b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690021704, "uuid": "d8aa9211-caa6-4c3c-bdd7-8e6b7fe98430", "comment": "Malware payload", "value": "75764eb099f96cd2d98a87956872482f8b660f4c337a2d7326a5f3534a168db7ab6498b6e6392f540b6c278c1c61f2fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690021704, "uuid": "87f9eb16-11e3-4508-b892-de83d1916a43", "value": "T16705E0473310AF8FD62A1EB7906D205193F24167E158F7D4EED1DAFA00E2B65FA9B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690021704, "uuid": "e94777ae-2c58-4f2e-88cc-4b65cb54d01e", "value": "12288:S+dgmXB+RxGB9uahZ1UTHG+qvU/lnHTNj9RkkMfhzDPlZRBVjp58r9hog1/ShCOg:SOSIua7aHGZU559R/0hzDdZAj3Q2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690021704, "uuid": "4e101d83-3cb3-4341-8d59-da472d0ca2f0", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690021704, "uuid": "caa9b17d-8a02-4a10-a741-885a40a55737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690021704, "uuid": "7977202b-8234-4059-aa7d-8d42c578b77e", "value": "Payment receipt MT103_tt 9630 copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a766705e-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009320, "uuid": "5599aaf0-21f4-491b-aa39-1c009f96def9", "comment": "Malware payload (Gafgyt)", "value": "5b2ca8b3aef8ce90fb33bcb917a6dbe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009320, "uuid": "55b6a505-9a02-4167-87a6-b81e537b690a", "comment": "Malware payload (Gafgyt)", "value": "b4e77f2547fbac54e69eca1a3b916a0dba2f5f9b4c176be654cfb5cfb6e23453", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009320, "uuid": "6c7d351f-49bd-4ab4-a2f9-ca38a75f32df", "comment": "Malware payload (Gafgyt)", "value": "b19fae6c26051b292b53503d51429808b9bcd6f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009320, "uuid": "1261437d-18b5-4a77-a04d-85114d406d7a", "comment": "Malware payload (Gafgyt)", "value": "19da1e4d84b72b447f89301faa66355f7e3e10f37af97a9e265d11ca7a9650ea68ebc95dbdc947524f9eeee623abca81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009320, "uuid": "9948a8f8-a0ed-40cb-91d0-54fa3cc78199", "value": "T1DEA34B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009320, "uuid": "e91dca4a-c68e-4fc3-83b2-f58cce0ff762", "value": "3072:YWCjQrLpnr85EdT9Oa8vqbVr7I/CEgmqAgcVyZIcBI:Yf5EdTbpr7IWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009320, "uuid": "a41f0af9-1b25-4dfc-9491-562f82de96da", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009320, "uuid": "581a1cee-c0e6-4bd3-a686-b965dd64ebbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009320, "uuid": "e65b4f0b-58b8-48cd-9bf7-205a3f884af4", "value": "5b2ca8b3aef8ce90fb33bcb917a6dbe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9a2064-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009280, "uuid": "e2d28dbe-bdf0-41c8-b5df-085c88589d2a", "comment": "Malware payload (Gafgyt)", "value": "9fa3b958ce6b1d189463297b3502fbe4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009280, "uuid": "4e118a03-ac91-49c0-8a84-66d8a8f607eb", "comment": "Malware payload (Gafgyt)", "value": "b640a82d988b28e8162a1222519998d5e668ee006d47511751ef077e9a35fe88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009280, "uuid": "38be524a-0985-472f-886b-8aea5b8bfddf", "comment": "Malware payload (Gafgyt)", "value": "fcbd14bac74ba45f0c455b10bb69044445ca6a59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009280, "uuid": "7f36cd25-79ba-4461-a83e-842fce6b89a4", "comment": "Malware payload (Gafgyt)", "value": "eae92fe01428f52e6e4460570c31d7f431aed5a665f1c28e5dedcb4e7ef5e63b92a1a424ec43d6d381c120b9ea2146ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009280, "uuid": "30d4d560-08c1-447e-86a6-e66b71bb8470", "value": "T19CB31792F900DFF2F00AE67608C34A257670BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009280, "uuid": "6b0e5461-0333-48b2-a95b-76bb3c869fbc", "value": "3072:DG+3MNBCpCTyRQpimmrytKds4OWlKhRm2pgYMx3IPtW:DHCTyRQuytEseuRm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009280, "uuid": "4cdf991c-cb91-4fb8-a419-8a1e5d60af1d", "value": 113755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009280, "uuid": "74e791af-0354-48e4-9f59-74f797c83ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009280, "uuid": "1bbf39ab-b331-46a2-a88a-87c7d31d0b58", "value": "9fa3b958ce6b1d189463297b3502fbe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cc2440-2865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690012620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012620, "uuid": "de86025d-69ec-4d4c-934c-aa74974d47db", "comment": "Malware payload (Mirai)", "value": "6a59d0283bb24bc63494f90adb443279", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012620, "uuid": "5d245166-0bb8-49e3-872b-a98dcbe0331c", "comment": "Malware payload (Mirai)", "value": "b8f47cd2f7be540e368d361c8ff09aa3c24552346d443e6621108cdf2e9e0286", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012620, "uuid": "ca11f9d6-d290-4e37-8502-ad489e20bf6d", "comment": "Malware payload (Mirai)", "value": "4b02535cea24f93cbed75f20b6f1bf7a311d3358", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012620, "uuid": "20aa64ac-2d6f-4458-a5b4-53de86b68648", "comment": "Malware payload (Mirai)", "value": "b803e204eae90158d033e0ff76badf8292c63ef750ba2962289c7d3f5bbfe0428e39980be2b6312cb3b388fbd2d0fdf5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012620, "uuid": "d9b80e16-707c-46bc-9d11-ca5c9ec4bca5", "value": "T1BE14C71AABA10FFBDCAFDE3706E9070625CC950722A43B393674D528F54A54B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012620, "uuid": "db4bdd21-a5eb-4764-bf43-815fea397cad", "value": "3072:ymneWJPX0oNj2OWIJb8YON7GrMvlJAKhZqq:ymnLX07OWi8Va8lJ7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012620, "uuid": "99864980-1a49-435d-bb71-70b0939dbeab", "value": 194440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012620, "uuid": "d27e74ae-4bfc-4295-af21-db62c6b672f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012620, "uuid": "3ec0328d-644a-4047-8700-631c35d17e1b", "value": "mpsl-20230722-0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6832d3-2849-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Neutrino)", "timestamp": 1690000708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000708, "uuid": "7743b3dd-abd6-46e0-8652-584308d8bc18", "comment": "Malware payload (Neutrino)", "value": "1dc2580260eb3d20bf700457ce0f235c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neutrino", "colour": "#F498A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000708, "uuid": "858ca36d-8f05-4580-b2b1-9a2c74993a09", "comment": "Malware payload (Neutrino)", "value": "b9a1bcaaa0067b1e242d7e56024590b579143c170280d136a588f1b60e4fd02a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neutrino", "colour": "#F498A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000708, "uuid": "f04d6236-e4c2-49ad-8941-a2b8f968298c", "comment": "Malware payload (Neutrino)", "value": "6aa9bf68ee2483cd2fc4278b6acacd6765293833", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neutrino", "colour": "#F498A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690000708, "uuid": "d0ae8ef9-fb73-4e7c-bc1c-9a25b0d6b5ca", "comment": "Malware payload (Neutrino)", "value": "41dc081f5dd2dc57295559a031db76ab3da9e6919f8cd075cdb83bda80beafdc27c03ccd0da69dafe30ab7f7666fb102", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neutrino", "colour": "#F498A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000708, "uuid": "9e6aa757-942c-4dc2-a44a-0bd974887fc1", "value": "T14CA3D03BA0A37D3AF08A48B3E616562B15B62F337D7204AB96534D3DF4391A15F26703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000708, "uuid": "297209cf-3fcc-4db2-a69d-740290a62abb", "value": "934381a85d55af4033da1a769f2cce1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000708, "uuid": "0dbca565-9c70-47e4-ae7b-0d4260af8a7d", "value": "3072:+Tnc3PcvClNcy5jUg8ov5ZsxTFEDk2b97:iogCV5ySkEDk2B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690000708, "uuid": "3211ae3d-d7ef-4af9-bfe1-b3207f76e4ba", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690000708, "uuid": "827b7e07-5159-4b4c-bd25-c895f8f9c6eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690000708, "uuid": "dea55802-17ca-4a24-9fcb-de988633bd6c", "value": "1dc2580260eb3d20bf700457ce0f235c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55f38ba-2868-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690014121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014121, "uuid": "13d5939a-3e5a-47a1-a1c8-491f0b46c2c3", "comment": "Malware payload (SnakeKeylogger)", "value": "e04d08769ebf74aadda9a5ccf0320a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014121, "uuid": "bc459461-33d9-4acc-92c8-ad71ba36741f", "comment": "Malware payload (SnakeKeylogger)", "value": "bb4db999018838a8f0945dd26c3b38081a75035764fa58b88ff4e189003e340c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014121, "uuid": "25a766af-5098-485e-877e-452720690c6c", "comment": "Malware payload (SnakeKeylogger)", "value": "388d60db3e07b5da6ae83174f11fd3e8db0bc615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014121, "uuid": "698f9111-fba9-44cf-8028-5aa6981f1bc8", "comment": "Malware payload (SnakeKeylogger)", "value": "61b18faba78ba19315bb50a488fb1a642de704d7ee87cd43f26bb19de14d3a401ccc058e954d95a6faa7d55e63a252a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014121, "uuid": "69c80565-c4d4-4841-87e0-b08bab3bc6a9", "value": "T194C4483C1CBC5E23C170D2B69FA5C461F158C5EB32A28F3667C7A695461E90229CBE3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014121, "uuid": "add68811-f1b9-4b52-baa8-d25ff8be42fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014121, "uuid": "2ceb3ce9-9634-42ad-b7ae-471230c09987", "value": "12288:Cmw47/vuhQeNsV/GORK2ZjAUgadhKSrkr81J8LLeni:LheNyWOA/aa+kLLQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014121, "uuid": "6e4b6324-a46e-42a6-851b-012dffb61aca", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014121, "uuid": "cb8f5768-5b24-4706-9510-343a182257ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014121, "uuid": "f77a2f6b-1654-4ffb-ac6e-8eb964b17e76", "value": "e04d08769ebf74aadda9a5ccf0320a06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ce1dea-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690014905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014905, "uuid": "1acdac06-a748-4c06-9e50-c0ce87882703", "comment": "Malware payload (GuLoader)", "value": "9700ef63a7ece87d0c5a31f5c8ce194b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014905, "uuid": "1495fcdb-c03a-4cc4-b6c9-2b3c4bee5daa", "comment": "Malware payload (GuLoader)", "value": "bc83afa7e3564443fe60cabef35c5107905f739a08bb8cacdbba54d12473104c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014905, "uuid": "fe0979f3-f56a-4275-9d0f-b2aea453c1f0", "comment": "Malware payload (GuLoader)", "value": "9fefd12db2ce125879e5ffaeb782fbec5c3462fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014905, "uuid": "7d84b441-0c2e-484b-b8fb-168323298cf2", "comment": "Malware payload (GuLoader)", "value": "193f215037070a72417b7ec51b41ea45bcab8f19be9f9d1bea0208427b6c6f4af56b587b5f3985bee3814541cb09b26f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014905, "uuid": "88113318-1d36-4bfe-aba5-4a375a615130", "value": "T1F854F78462A2F64BD7410B70D9D0E77925776DF5AA01422E6E9E3AF84C3FF290DB0172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014905, "uuid": "9a9c62e5-2356-4060-a2d2-354e6b0f1b9e", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014905, "uuid": "b985ab6e-6758-4613-8677-b3cefc4da6f8", "value": "6144:ajC8w75wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww5w5wwwwwwT:z8w75wwwwwwwwwwwwwwwwwwwwwwwwwwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014905, "uuid": "ee78b36c-807a-470f-b521-7305e7aa58d4", "value": 290728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014905, "uuid": "a3c042de-4686-4ad2-9ff8-b9ab75fc6cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014905, "uuid": "5e80ee04-7b2b-436e-a936-3de4156dff7f", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c140ec33-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690014946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014946, "uuid": "8db8bd63-5aeb-4c95-8459-40fedcd5f7a7", "comment": "Malware payload (Formbook)", "value": "643062ea861a7196b0df63d3e4255b49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014946, "uuid": "a7a37c8b-ce0c-4e55-a765-180231556259", "comment": "Malware payload (Formbook)", "value": "bdc8c2c8c2cf14b3189551124ff820c303a36139830b0ce299f2538ef9c2ff06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014946, "uuid": "52d7f16c-2382-42c9-8fdf-e26f985590ba", "comment": "Malware payload (Formbook)", "value": "3f68331238a454483ec074f496da2d86b2f62b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014946, "uuid": "93917083-9121-4487-b7fa-899def8f0726", "comment": "Malware payload (Formbook)", "value": "b7da3651fef72095f75a2368c0b5cd0d3f89e88f657cecef09990509d63396338fda5bc845f1f06f16ac4c539f0bf4b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014946, "uuid": "2dbee8cb-e3a5-4371-a28d-a6f81d231334", "value": "T1C7E41255712C3D43D9BE5EF18466A12523B1A7592127D7CCCDF122C23AE2783BE81ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014946, "uuid": "bcbcf680-ee17-4244-8217-9d0edc3cae5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014946, "uuid": "40ff74cb-fc47-48f5-af4e-a51e695a8fdf", "value": "12288:ZWc/bUYIsYoln7v3T4Fv9g1SCuTaei676+7r8iJcxivpckh+0xYQ71kn/U5g:MiXrYomF9gihx6Mr8i7mkhbGa2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014946, "uuid": "e9672980-46ca-4120-acb3-fba4f6744bf8", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014946, "uuid": "61538a6a-24b1-4f96-968a-74bca70aa4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014946, "uuid": "5706499f-0294-4457-8857-6be5e28a016a", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d863e272-2868-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1690014126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014126, "uuid": "ddbda606-e1ab-463a-956b-359112a2c190", "comment": "Malware payload (SnakeKeylogger)", "value": "a9c050ae19fcf43d9f35cca1f3ec4021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014126, "uuid": "f265ed2d-c34b-438c-af27-0479d5332ab9", "comment": "Malware payload (SnakeKeylogger)", "value": "bf5e0325eb6371cde268e2798df868725f430a77a61a796694ea1ae7f66dbd89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014126, "uuid": "14376dd3-e4a3-4464-a1e6-88dfb0b7a544", "comment": "Malware payload (SnakeKeylogger)", "value": "8c90121b330793aa5409ebfb56a47b2e6e0689ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014126, "uuid": "2344a5f5-2de2-4ba6-a433-05b2fa140738", "comment": "Malware payload (SnakeKeylogger)", "value": "09a4920f0062a2592c7f9f35fa3aac1734db21c235b6c6cac7835e6b2fd08118e3884e51d1c778afa74d4d231e84e249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014126, "uuid": "2a7c1c76-7f72-4c43-a3cf-cc3ab0d27658", "value": "T1E0F4063C18BC1727C1B8DFE68AD48427B2E0A96F7215E9346CD357D64216B05E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014126, "uuid": "a58ee5c6-971c-4f89-b36c-595227b421ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014126, "uuid": "cd11b77f-04fa-4315-a0b2-6a04aa2d068f", "value": "12288:hmigC31GkXEqjs0u1yrOnHcexDBuZaicSVLsTIaQ9ZOp53X3e0BRDkn:hmiBlGj06UucCDuJPxssSdVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014126, "uuid": "014bc85a-673b-4a81-88d2-60e8c901901c", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014126, "uuid": "63ac6cbb-bac9-41eb-988c-a7e824fd3c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014126, "uuid": "eb5e9e3f-ad10-4f71-b350-cde614a1c8fa", "value": "img_23721jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acbdcda-2865-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690012627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012627, "uuid": "35eef5a6-761f-4661-bdbc-45d2886ade21", "comment": "Malware payload (Mirai)", "value": "50de4dda053dadb1f8733b860a0030e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012627, "uuid": "43234df5-3bd3-4677-8318-42368eed5efb", "comment": "Malware payload (Mirai)", "value": "c058b0680716aadfb49fa7bca0b37046ca6ba28abd3db66315abc63f537466f2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012627, "uuid": "f7baeeb3-55ef-4cef-9d4b-d50972c98476", "comment": "Malware payload (Mirai)", "value": "39678f58a755f0f8656d4b45c54d665814e3e6ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690012627, "uuid": "2f8eb2ed-5a4a-4e7d-b544-7b7a4b2b7c33", "comment": "Malware payload (Mirai)", "value": "4b34910994ea4166b3b229d25d02f05207dcced5d254423daa6030e8c63f2a63f9543f85815eb0b6c60c3185a72b0a07", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012627, "uuid": "6add5bf8-90d7-4f65-a07c-d5e1cc58a340", "value": "T11314A71E6E228F7DF668C73047B74A25975C23D627E1D684E2ACC2105F6438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012627, "uuid": "b50406ee-616b-4726-85ce-1eb309b327a0", "value": "3072:YwFVc9SDn1skE73dG2N3bVfOnflNJIKh92jMygRc:YwFR/kJbBOflNDh92jLgRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690012627, "uuid": "95c01e64-37a7-4a9c-b00f-e5c63fde4ac2", "value": 194440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690012627, "uuid": "9f8a8ae5-4948-4014-a1f9-cbc1bef5355b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690012627, "uuid": "39944ca5-d8ea-40a3-9f87-c8efaee63c6a", "value": "mips-20230722-0757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb731a49-287d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690023178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023178, "uuid": "946c8061-51ff-479b-a392-c967cc865236", "comment": "Malware payload", "value": "f08f6c119e95a1de70f502b0d060b502", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023178, "uuid": "ebf53f24-cf75-4532-b7a1-9c5039041878", "comment": "Malware payload", "value": "c09dc7d9727de57ede8cb91b42637bbfa5dad67e63d6232ad8b0cd63d134adc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023178, "uuid": "a1125a0a-ca7d-4a67-8c41-f8e83ce505df", "comment": "Malware payload", "value": "0809cb367bd96d67c71a88fa7eaafadfccb57508", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023178, "uuid": "fb02fe57-3db9-4201-8a67-887d15a9af36", "comment": "Malware payload", "value": "05e79664b145d3c6a779bbd9d181ab26b10510a146a5fc048687ed4c0ac0b57b9488c82dae6598b39462045999cc7280", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023178, "uuid": "3363fd3f-d57c-4128-8566-e38c19e0319f", "value": "T147634BDAF801DDBDF81BD77A4453090AB630F3D512830B366397B9A7BC721A81D22E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023178, "uuid": "1e8f8035-23c3-4b1c-b302-47e0394cdf67", "value": "1536:XYwtvv1ws2DYvXD8V5f41Mx0S3VdJH7S1fYq5Qsp:XYwvvmPEvXq41m0SV/1q59p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690023178, "uuid": "f5b17dc8-0ebb-409e-8355-668d0ffc0d41", "value": 69640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690023178, "uuid": "dd9866c1-16fb-4010-bc19-94403cfc0998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023178, "uuid": "60a1971c-9a54-443d-b558-4cd900e66a45", "value": "f08f6c119e95a1de70f502b0d060b502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc0f0b7-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1690014860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014860, "uuid": "104bee5c-16ee-406f-840c-53c5a01031a1", "comment": "Malware payload (GuLoader)", "value": "6e342730efe1ac87f7de25dec38e34e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014860, "uuid": "426d084e-ebbe-4366-a515-28054f674603", "comment": "Malware payload (GuLoader)", "value": "c0c23f16dae769ddb46296c20c1db31aa99cd619caac9746e3aacd7583f6fe7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014860, "uuid": "898d4480-cf44-4b7d-a020-a5482403ea52", "comment": "Malware payload (GuLoader)", "value": "a20333aabadee7fa9ac60bd0f08dc3bd0562dfee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014860, "uuid": "8d70044e-4705-4c7c-b612-93e873cf6ebf", "comment": "Malware payload (GuLoader)", "value": "aa016ae07f1c9db7e6e0672eef86b00478522d65266df40a2a36f17e4c3c5d64adf20b13c0d0e238dd0fd44e92bf0b63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014860, "uuid": "e165b686-8718-443a-add9-bd6c76a0d28d", "value": "T19654F78461A2F64BD3410B70D9D0E7B925BB6DF5A901422E6D9E3AF85C3FF290DB0172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014860, "uuid": "74a136ec-9dd4-468d-b2dc-aa9752bd5d5d", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014860, "uuid": "37bf3042-4d31-4766-b498-3a1a6e23dea7", "value": "6144:ajC8w75wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww5w5wwwwwwJ:z8w75wwwwwwwwwwwwwwwwwwwwwwwwwwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014860, "uuid": "afbb09a1-4faa-4501-83d4-20422b2e12c8", "value": 289160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014860, "uuid": "549e01b6-cc0c-483e-b6fc-08d633d1a556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014860, "uuid": "999d3caa-9c3e-4689-b18f-bad1f864adab", "value": "Hesap_Hareketleri_10072023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f210fac-28a8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690041464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690041464, "uuid": "15ee78d6-8bb8-4c95-80d0-e94eee1bc2ab", "comment": "Malware payload", "value": "021b53abfc25a261077282498e5726a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690041464, "uuid": "2bb510f2-3103-41d9-8982-ad2dcc1477cc", "comment": "Malware payload", "value": "c3db9475c3ab6b53d8f6d711f587e5218c9b8d332229a208277bc0b27a24b620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690041464, "uuid": "430080d0-aedc-4a0f-b2b9-5ccf72d4c6e3", "comment": "Malware payload", "value": "ba7f38a28444504e6e8e1f995cc40ceb70ff6409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690041464, "uuid": "041b9c04-35a8-4e2d-8792-0179aabeec7e", "comment": "Malware payload", "value": "afb0a94e8dc46644d8003508d9c80fd106cd047d867fa754f38056515b6b346b73bf3515b7fb30d13c84bb63a0041ea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690041464, "uuid": "88a18278-4574-4630-aa9b-f4d98bce56ab", "value": "T10135F02367E9D0BDD83383B6559842E6FE3B13A8D00BD8B158A13BC3596AC0B9F5574C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690041464, "uuid": "2b4671ac-94e7-48c9-90ed-e05cbf12124e", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690041464, "uuid": "84fc0196-99c1-4ad0-ab82-0e74fd11eddb", "value": "24576:7h1tjL2uma7hLQKaikK21SHCJ3ny+SGiPsGSa7tLC+/e0cUEcnr:sghMKai1viny6iPH5hF/e0m2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690041464, "uuid": "1db2be45-09ca-4106-abfd-4b52c2d17c90", "value": 1135646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690041464, "uuid": "0ab97276-1ff1-4b38-a0c2-1fca09d29fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690041464, "uuid": "8e97afb1-76e3-4917-8e83-2812345908e8", "value": "SKlauncher-3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bc3d36-2877-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020539, "uuid": "193ecec6-924f-4048-b7e3-0dd9361830bb", "comment": "Malware payload (Mirai)", "value": "cf4261cce32c80773e92315fc754eaa1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020539, "uuid": "3913e5f6-e056-4459-9b9e-e8e19fc72929", "comment": "Malware payload (Mirai)", "value": "c668ac6a5d75b41a3d9b3f0d23290fe9c41690043fa3cd533ee1c44b30c250c8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020539, "uuid": "4068247a-0404-46cf-a8ed-321f45a9f11a", "comment": "Malware payload (Mirai)", "value": "ab0f31a66c0da8500e3e5a47aff9ff0291c79c6e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020539, "uuid": "b90fcc67-06e8-47bc-9cf2-3d148e3da877", "comment": "Malware payload (Mirai)", "value": "af8d149328c8c891a1bc573a934dca7700d92a5ebf463dee42fd0c17c51d0d9eaa92fe0215f81cee10e22345b21b2454", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020539, "uuid": "9b3636ea-a643-430a-8d51-6f796323719a", "value": "T10673F807B48181FDC149C134172BBA3ADC27B5BD0339B2E67BD4AB226C46D621E1EF59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020539, "uuid": "cd5ff0ab-31b0-400d-b0db-064f23b29ce5", "value": "1536:adObTH6V6vLoPzIgmRRG3daxhMpWhADv5o4W2UEGGFtRrbaiFhnh9lqP:xHyCLo7I/7G3WhMpWhAr5oMvVbFhnh94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020539, "uuid": "b4315285-fa4b-4e4d-8cd3-849f052da08d", "value": 75072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020539, "uuid": "9bb6805e-ee94-4aa1-9465-6f6d72b8bea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020539, "uuid": "39d6f660-32d7-4d87-b240-0f56891716f7", "value": "cf4261cce32c80773e92315fc754eaa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdacc2d-2878-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690020876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020876, "uuid": "7659c938-4a35-4b44-af22-20de7e9fe4aa", "comment": "Malware payload", "value": "91f24a1390fd8abdd8ea91614c773e51", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020876, "uuid": "6d460bfb-c136-453e-a92b-01a31afd8fa1", "comment": "Malware payload", "value": "c6d4448f5b4dd328c4127c34f6503787bab77ecb90b88b96ed3fd992d8d320f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020876, "uuid": "f5d5acc2-1b7d-4a8f-a5ff-6a2d691ef315", "comment": "Malware payload", "value": "9434d0143a7bc8bbe6ddba53b69ac3d4ef5ec4fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020876, "uuid": "9d57d291-a925-4964-84c4-9a332cc81409", "comment": "Malware payload", "value": "f46d7f1e3692ff5090d48c4e329586b1b9b2d76ce6dd41a5800d716a0cbad32b585e7e6a596cd67fd192f9845eee303d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020876, "uuid": "61859ab4-c5b9-485b-b24e-8df6c1e15c44", "value": "T1C5632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020876, "uuid": "eda87732-86e9-4f3d-aaba-f7e6717d8e64", "value": "1536:qNSlxYmii8N1U9uO//kWEjFIikg/QA83NRuxAvjW8:qNnK7kthIikg//29j9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020876, "uuid": "46c10ef7-5761-422c-b102-6477771913a8", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020876, "uuid": "d9ef28f0-e2ab-4d65-b7f3-efa3ad97edfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020876, "uuid": "7f6f2bac-039f-4555-bae2-05468f1ddfcf", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b41351e-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009299, "uuid": "7fcdfd25-ad34-45fb-bc63-4e49cbc7349c", "comment": "Malware payload (Gafgyt)", "value": "f4578df583a25a8d929459a69f5dc879", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009299, "uuid": "f63234be-6709-43ae-bddb-2b20337ccfd3", "comment": "Malware payload (Gafgyt)", "value": "c7490eb3e60c974e24ca49b6e75b79403ad1e421e102dbd95ad4e4256e9b5b3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009299, "uuid": "c89a22a2-da46-4b8e-9952-70198cd44009", "comment": "Malware payload (Gafgyt)", "value": "8c6c2ab74b66c0e132ec764e96c2fec87d7fbf95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009299, "uuid": "ec21e06d-9cc3-458f-a46c-de1a9b1cb8d0", "comment": "Malware payload (Gafgyt)", "value": "cd46a2e8096256ee1af5702262de1a8fc6b16982248be21bf03eefa327c85952cbb59060ae118ea49489ceaec29d27d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009299, "uuid": "ec1fa963-0cc5-477a-8c17-26e893add57f", "value": "T1ECC30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009299, "uuid": "76a11806-31c1-4874-9656-c87c06f870ab", "value": "3072:H63VpNeuWDGeQf8sRCQt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCQt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009299, "uuid": "40be280a-6b2d-4a71-9cd2-e159a6eaf013", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009299, "uuid": "4459125d-441f-464a-b93a-5a337bcc432c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009299, "uuid": "11b44b19-f3ba-4de6-8f27-a8d5a604a1b6", "value": "f4578df583a25a8d929459a69f5dc879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322cbdc9-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997956, "uuid": "a08cc46c-bd98-454e-8eda-8570d63500ba", "comment": "Malware payload (Mirai)", "value": "69a8453c84e0033b7ecc26d6feb5680d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997956, "uuid": "da816672-0977-4d25-96b2-e6b62c1c9093", "comment": "Malware payload (Mirai)", "value": "c7908f6a3613c410bd01360bca22684daeaba6c2e2210c7d2b0a198f1e772fb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997956, "uuid": "6de1c383-80a9-42f9-86c9-b62441849578", "comment": "Malware payload (Mirai)", "value": "5211dba0a196d9f97f14978149f080b5a9391561", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997956, "uuid": "688a468d-11e3-4cf5-9940-4a547a8e1835", "comment": "Malware payload (Mirai)", "value": "5cd66fb3157fd81087cb4a4d0e9fd5ae337adb8e58a49cd5dec700ac403ce50e639ffe234dacfd0665f11abe23e1e22c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997956, "uuid": "87a27679-8262-4ec6-8522-8eb134ce3fd2", "value": "T1DC535C0073948F07E4AA5EF5283F17E483BEEE5016E5F184660FE74A8235E33595AF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997956, "uuid": "eeb69dc7-a08e-43f8-b750-3157e3b2c25c", "value": "768:H3qgPVuEmAJZawkRS74xODerdz+AaWtMTPABaUxn69YCExIj2zGU5d+qenx56orV:tVuLLjOD/WOERTCExIj3qebk3ePVnXFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997956, "uuid": "156c6f7a-11aa-47ac-a06b-963079df0ef6", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997956, "uuid": "f3458a81-562b-4cac-84b6-293995c3aa37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997956, "uuid": "0cb9eb62-8e16-4116-bf89-c1e35d8c0c35", "value": "69a8453c84e0033b7ecc26d6feb5680d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2836ef7b-2856-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690006100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690006100, "uuid": "8c2c9fc5-78d4-448b-aa58-a220471e36e1", "comment": "Malware payload (Formbook)", "value": "09017a694e1d97667137d856b46ab586", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690006100, "uuid": "895f2659-5e01-4479-b383-d16313923680", "comment": "Malware payload (Formbook)", "value": "c7f690c33e83ce246c48b918864dae66b4b6964116046cfa34de6bd3a81c2964", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690006100, "uuid": "496f2741-cd0f-4808-8dfb-2859d0bc8c6c", "comment": "Malware payload (Formbook)", "value": "61277312e20b13f57fa5ea235c522cd930617e17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690006100, "uuid": "03b5fcc2-368b-4cc7-b7b7-5d5ae57ce98c", "comment": "Malware payload (Formbook)", "value": "a4837602d098d4efe9aef6bb3bf6be6fee81ed0d4f1b0a12d65d57b64f78b2157b8953c9ad26d2cbf819afb9b55e3d11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690006100, "uuid": "906ac2e8-fcdf-4d72-8433-5835576fc4b6", "value": "T17C05283C18BC1727C1B8DFE68AD08417B2E4A96F7154ED34ACD257D64216B06E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690006100, "uuid": "3f60208f-9ffe-46b1-820b-1092978a1ef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690006100, "uuid": "db7ac24a-d627-4a55-9f8a-11af89498b4c", "value": "12288:x6U/6tdNEYlpVPjIUpOBgPby6Yqdr5Ra7636RpMEFdg9BFh:x6U/6tIYlvr7hTyA6DxE9Bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690006100, "uuid": "42b5c25e-0cc7-4e83-a1a7-d13738e80384", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690006100, "uuid": "b6cc8d6c-bfc2-49d3-a1e4-02456079f09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690006100, "uuid": "15f18c0f-df44-4fa3-b824-f4c09bc60d4c", "value": "09017a694e1d97667137d856b46ab586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2d51ed-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690014836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014836, "uuid": "d4ad79e1-31cd-4a52-aac6-c1b079bcd602", "comment": "Malware payload (Mirai)", "value": "01c6e6dc23c0e0613575a56e218441fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014836, "uuid": "e89b5610-6567-4b95-bfb1-9099b1e183e2", "comment": "Malware payload (Mirai)", "value": "c97d7cd9dd821fc4b2d1fec073a093d0e180d9e6b36db3253e0b9bbe58f43bbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014836, "uuid": "2ead095f-e061-47df-b719-cb6acbe7a48c", "comment": "Malware payload (Mirai)", "value": "230b4e8c14c75daaafb3e03c92a3be938a951beb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014836, "uuid": "b97fede6-e216-4674-9059-12f5660c6ed6", "comment": "Malware payload (Mirai)", "value": "a9655b78d395c7a518c17b8c2936ce3be3cfa2e560abf35b683561ebb55a6b88772a6dc4d8ad4d6ab5b8a72fbfe76464", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014836, "uuid": "0fdc82a3-7104-4970-8286-546fd10fb051", "value": "T157931A67F800EA72F40AA77A04D74B157670FBB60E932722B3173965AE721C53827F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014836, "uuid": "424b2f8b-8716-4087-aed2-07f3cc2d582b", "value": "1536:ru7CntMA8JdlTOWoCkThvvk9VOU9EelEyt7oJ3a32YV2lFcSmC6V6qDj6ufSae:rVtMndFo5dnxelEyt7oJ3eVV2VmC6V6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014836, "uuid": "bb53510d-ed03-41a0-8397-eca33b7d585f", "value": 96633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014836, "uuid": "1386b6c3-5d1b-4ee8-b0c9-5b849290c63d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014836, "uuid": "0d14d9df-71e5-46b1-a756-484972c36a73", "value": "01c6e6dc23c0e0613575a56e218441fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955e008d-286b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690015302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015302, "uuid": "a7347af2-85c0-4a6a-a848-0979a4cd7b61", "comment": "Malware payload (AgentTesla)", "value": "14cd46a14456cb563b7754e6c1f21d39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015302, "uuid": "cecc19f4-97c6-477a-bf46-341d853a6c84", "comment": "Malware payload (AgentTesla)", "value": "c9ea862e0fae95bc7fc1acc8ffd7afdaa96eac42c8aaf4d3c4ea47cd8b346291", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015302, "uuid": "6f469b0c-232a-4e54-aa89-59a9629bf9bc", "comment": "Malware payload (AgentTesla)", "value": "652e1073239fa0570c000315c80ba17b86c0fb1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015302, "uuid": "4e6c756c-b29f-41e7-9c90-29bebae2b642", "comment": "Malware payload (AgentTesla)", "value": "1bc0216bf3fb81585a06fedfd4c932ee4ccd67294dda2da47f65402ffff5e2a757344aeb6b1b7c2cd8d70ff797e1a286", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015302, "uuid": "f1b339bb-59d0-47cb-b59f-bcf73e669cc1", "value": "T1E4D423C028D1483C786DB43586DE9799FE09FA7EDA1B32CE4A6CB665342D640770A34F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015302, "uuid": "108efa51-d7cf-4251-9d25-5a686d5b344e", "value": "12288:/98plpdqW0BlBhaOLknuyKrfFqf+4CyiVmpM:/HDB5Auy6Fq4p8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690015302, "uuid": "86b807a0-4f0b-46b0-b0c1-4d4ca80f59b1", "value": 612439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690015302, "uuid": "538db6d3-e7b2-4c53-8513-9fc563068cef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015302, "uuid": "5c501384-b13c-4e53-8807-b0a2b41fb845", "value": "RE Offer Request.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b217244d-2872-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690018357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018357, "uuid": "8178919f-f235-4f5b-b2b2-ee9fb93225da", "comment": "Malware payload", "value": "2d49d0d6906103a3f6c171d354faa0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018357, "uuid": "dba9d051-b341-4389-ba52-60c40e3b81de", "comment": "Malware payload", "value": "ce3dab7e124372ea19e7e9e9b5c61a482951c72156d82196e9045cc2055d189c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018357, "uuid": "8174cfc8-2a2e-4044-b14f-2595862d3322", "comment": "Malware payload", "value": "1132e7c79711ca7358ef712f917ada28f7df0d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690018357, "uuid": "9982bd18-5813-4817-ac14-45a6c501c7c0", "comment": "Malware payload", "value": "3683b0c4b0b7a85599c17375afb6c416dfcd66f4637e9454da3e5e44955cedd4538849ff910b5a8454a54b5866dfbdc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018357, "uuid": "f6979df1-b088-48eb-90a1-e853b06ca7ea", "value": "T177F5E18742C10776C773B9384D5973BB4A19AA1359247CEAFD926B4C2B35E02FB20736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018357, "uuid": "ae02bd41-79ba-4d7f-a9ee-69f055faf4b0", "value": "49152:Bq1vUXJXXcPMmtQk7AMS9CYS5DRzOmpinVI+kFLgDi9Ufbrr:Q+XJHcdTYS5lzOmpimtEDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690018357, "uuid": "23dae0b8-909f-4855-bbb5-a3e0ad0a5ff5", "value": 3444736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690018357, "uuid": "97e50a39-304b-40c8-b96d-0861a0119ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690018357, "uuid": "63d70cd0-9b8f-4ff9-9bce-30306a911230", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.10881.31061", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8680dbf9-2842-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1689997668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997668, "uuid": "e503f839-67e1-4afc-87f8-406eceaf7b7a", "comment": "Malware payload", "value": "d13b979b1bd8830f093bb9aab1c3f80e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997668, "uuid": "40314f51-8e20-44ba-a26b-ae2c6b4523ba", "comment": "Malware payload", "value": "d147723c89539aa5c4cc1ffc41478111a4c058bee7c0faa73ef3c77294a997bb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997668, "uuid": "945530ec-3d8c-4812-81e1-cc733f45d9a7", "comment": "Malware payload", "value": "257d663cbcf39d0fe1315c9cbbd1a13eec5ecabe", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997668, "uuid": "eb53ddb8-7706-41b7-97ac-9f767f3ec294", "comment": "Malware payload", "value": "d1c2558efb6a610e8ce3df069dd200159e3da74984f48ad25c7821d1748b1b6dc3167a95d5b6eb65dbf4651189b4c85f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997668, "uuid": "c0cc3bd5-2de6-42ab-98f1-60a975fb3124", "value": "T123254B33859AD5CBF0A1897739D17757B0A37A2AC13A7FFF9660E9054324340A38E729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997668, "uuid": "1b78a8ba-6db8-49d1-aa1c-b1d0caf9a4bf", "value": "9610b1b4706329fadcb93ef9d2576318", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997668, "uuid": "c6c62bb3-2706-475c-8d2e-b7e23df96553", "value": "24576:ROCEhCCa2ruQpGU0WZnQNXeicIIKQ/CFO:ROC5NWZnQNXed1/CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997668, "uuid": "8e7f582d-e8e2-4a64-ac21-458a7ecbbe65", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997668, "uuid": "07e04247-89cf-4393-9883-0e9225ffda2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997668, "uuid": "d0c563ee-189b-4124-b915-e45eb40d44e6", "value": "d13b979b1bd8830f093bb9aab1c3f80e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b211ed-287d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690023171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023171, "uuid": "c9598f32-b5bd-4ac9-a714-d3f6a2816053", "comment": "Malware payload", "value": "95d11e01eeaef7cdee6fc3602be02d46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023171, "uuid": "17a9b56d-c579-4206-82d0-947bd2f2d051", "comment": "Malware payload", "value": "d1aacccb86e796ac4eb1c86b4c8b8ad37ab9043fd7da2e89846581954563bb26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023171, "uuid": "b1c897bc-2c40-4bf5-99fa-263882f17153", "comment": "Malware payload", "value": "e2499fde84fb476f79e0d79b8f99e140c4f6fe11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690023171, "uuid": "c086ef99-d26f-49b3-860b-f914a90d87f9", "comment": "Malware payload", "value": "94ff9ae20a7fe0b0272a43c68dd76742805a48a5fb6fcf4d3cfca9c330ee6bae61b806a708adc928990e389bf766286e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023171, "uuid": "73cedc7f-eba7-43f2-a583-cff720680822", "value": "T12B633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023171, "uuid": "85b27a74-eebb-442a-8da5-4575fa522681", "value": "1536:lGRaTYmol/hGIAs4PNvAYQGGm75123tStQl:lya7hJtGmVD2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690023171, "uuid": "6400bf80-248c-4484-9c5b-a497380fed58", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690023171, "uuid": "584dc69b-bdef-445f-a31b-8ff95313484a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690023171, "uuid": "19660825-9499-45c1-ba6c-e4185545e4c9", "value": "95d11e01eeaef7cdee6fc3602be02d46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96764171-2878-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690020888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020888, "uuid": "aab40d63-7bb5-47d1-b7ba-6fbbe0e0a1a6", "comment": "Malware payload", "value": "60721b043b60723d391efafc4dada363", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020888, "uuid": "42fb0a74-d8ea-41cb-840a-4a8223eadf62", "comment": "Malware payload", "value": "d1e40c66c92da43346186e94f2bf2c9c0322bc195de73c92689c808c9c134e42", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020888, "uuid": "00158f4f-b667-418d-a58b-58006b9f500c", "comment": "Malware payload", "value": "13ba7f96fcc56437a7433f92ddf06bf0e0cd7d01", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020888, "uuid": "88a3fc47-a73a-4f30-9687-fd24c2b1dc05", "comment": "Malware payload", "value": "4e3ad3daef97006f556b644b77d7cacf94d595e055a531d1cff1753d629b574eada6acd80056fad9febec69c0333c834", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020888, "uuid": "b71af83e-6b03-4797-8e83-65dc3770571f", "value": "T18B534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020888, "uuid": "ec5c6e45-0461-49aa-ae21-b2e37545b148", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQNLiKimfFoktCe3fYRMp:WShU3q7cEDlCK/0D19i8Fok06fYRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020888, "uuid": "3d10ad84-a650-43f1-ad12-24f7397780b0", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020888, "uuid": "3d8f67d3-c485-4447-9459-f84706d8236d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020888, "uuid": "0df760ba-89d4-4a5a-b98a-e574ecc1f4a4", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99993b82-28b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690048810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048810, "uuid": "c18d652d-2444-429e-8696-d1773c37ede8", "comment": "Malware payload (RedLineStealer)", "value": "6e485aa3cfd1f954404d853a298ba114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048810, "uuid": "e42de6f5-10ea-4687-8c7f-f31e3ba4ee22", "comment": "Malware payload (RedLineStealer)", "value": "d5615e8fc7558f84a76d8ae2a6d5c15f11ec0ae854f41dcbaec818b08ec83233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048810, "uuid": "c22754cc-5548-459b-8ec2-a52bb9a60f83", "comment": "Malware payload (RedLineStealer)", "value": "2fa7ae4c1a9e8f295367eefe36c1d6baf453f006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048810, "uuid": "b61250c7-55fb-4966-a53f-25666e1e65ed", "comment": "Malware payload (RedLineStealer)", "value": "2826f04327702c5c607049293bb13975e6d0bd7432e71ec0e2262e8dbe0127c6b81aafa73bc9c834521dab269db685e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048810, "uuid": "47d35c0b-8d48-41ad-a490-8d32a20f7fd6", "value": "T165656B0FA3E9BF0ECBF92675E62D1450DAB6EE024953E30F157B14267C992A01F636C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048810, "uuid": "1292e5ab-1e8e-42c4-b00f-98dabbb41781", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048810, "uuid": "5b9945cf-ed6b-434c-893b-adc45d7705b4", "value": "24576:V7X71SxWmB+kU978/RkClPbvT7zeJjTIrutC:V1Sx09XOPbr7SJjUrus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690048810, "uuid": "9cf686f3-26c8-4fca-9b5a-444560c1aaea", "value": 1473024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690048810, "uuid": "dc68cc6a-4d28-47bc-ac94-62ae9ef2b000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048810, "uuid": "8340ef2e-c4ea-4bac-b530-7ec507bec93f", "value": "6E485AA3CFD1F954404D853A298BA114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915ba9c0-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1690014866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014866, "uuid": "e789099e-7bdc-422c-a31b-3589b7d99562", "comment": "Malware payload (AveMariaRAT)", "value": "f5f68b61111db3de2384787417e44141", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014866, "uuid": "a618047d-629e-42c9-bddc-6ad9feb5ec86", "comment": "Malware payload (AveMariaRAT)", "value": "d6ca30a85a4791e7a4dda3515795274bf9b051218d18c74092a7bce8061cd702", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014866, "uuid": "8b33c254-4642-47a8-be6d-9fb341b370c3", "comment": "Malware payload (AveMariaRAT)", "value": "113abb6e74b8456f044e459e0b21ecc844f86c9d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014866, "uuid": "4a59ccc5-76ce-4eae-8992-48c1a4cbf125", "comment": "Malware payload (AveMariaRAT)", "value": "8da15e7450d56ee8b98738ebe86d06501d455c6295594218c2d59498e8f4a59099b82a8a656b2dd641c1934181ed1b32", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014866, "uuid": "00046bd2-b397-4e1f-a08a-c90060f94067", "value": "T159D4233252174C5EC79F9FB8489149B9136F8FDFF927CA07AD45B23A793630A80512E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014866, "uuid": "85a3dd27-cad3-443e-a7ae-052111451069", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014866, "uuid": "ed7cc479-c38e-423d-b337-e6983e9c9fef", "value": "12288:pS6ln+flo/XciMvNyJ+xA9p1ebYkIAslEuclfCwC5fJ:wTdCjENxwOp9wclfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014866, "uuid": "9a716c9e-5751-46b6-b687-b014330bca15", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014866, "uuid": "e667d4ce-a7db-4506-b2d1-dae8c118f61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014866, "uuid": "92434896-3050-49cf-a021-963c33b0f3ba", "value": "NECAT\u0130 G\u00dcDER - Kredi Kart\u0131 Hesap \u00d6zeti - 4743xxxxxxxx2339.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af723134-289d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690036821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690036821, "uuid": "479dab81-801b-4945-9978-a162b1cf92c1", "comment": "Malware payload", "value": "8bb15c76e2d55780ced07a1a2c589486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690036821, "uuid": "1878ee5a-02e1-475a-b88e-ce7b6a21962b", "comment": "Malware payload", "value": "d9f6408b67628d5618a4fbaba97404ac55988633ccb2a02a09c95b0b134bafc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690036821, "uuid": "4014c35d-41c0-41d6-b69f-c9a9e7c67492", "comment": "Malware payload", "value": "1c28776b212347e0746743db176820aecfeb20ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690036821, "uuid": "14fa5850-ba6a-4c58-a4a9-2a7e273f8d22", "comment": "Malware payload", "value": "2fe9918a3454defa88870062ea535c964c03d2fd2b2201e669e9140f73fd7afc9372e59bd3277060243f39e0ac1ddd86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690036821, "uuid": "f18ea9b7-4f30-41c6-b858-00d00cc8c2a6", "value": "T1C7A5336033A9D50AE2759E74893152B09A317CB1C8BC8B0BFEC965CFAF32D459B21747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690036821, "uuid": "ab37eccf-4f57-4af9-a2df-2d184fba74c0", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690036821, "uuid": "5597b555-53aa-4364-916a-34c9f07fb6f7", "value": "49152:dusT49TJp6obw7prohAAGQFEVxYL+7vAzieEdfr:FaPtGXVKEvAz+dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690036821, "uuid": "a14f574a-b6e9-4002-97a5-3ba9864579c5", "value": 2146080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690036821, "uuid": "0f314903-d0b5-4ec8-8389-4279e9e13c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690036821, "uuid": "b52d3568-80fe-43a8-8ad6-bcb43a1888a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d94849f-2892-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1690032066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690032066, "uuid": "ec496191-65ed-42a5-9bb5-aa00db09cd84", "comment": "Malware payload (RemcosRAT)", "value": "e4661f9c8d4cb3ae13f8bb875a8e7680", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690032066, "uuid": "2135d0af-1e2c-4470-900b-9f0929b7a76a", "comment": "Malware payload (RemcosRAT)", "value": "db9b54869c09234b1284f990515224d7f86d1571fca2c3349329404f24cd2da1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690032066, "uuid": "43c38b57-b5f3-404e-84b8-b4d1814397fa", "comment": "Malware payload (RemcosRAT)", "value": "ec8a4e8d0c34570650d0f761f9bd3689f9620a15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690032066, "uuid": "52b45b7f-d8b9-426f-96b3-169656cf2e87", "comment": "Malware payload (RemcosRAT)", "value": "a75c8dc322766df259db1e7735306f524dfd08b67a4899d8ffefbc4116299bc8597e6e6a36c325f61496a93a23b3e39a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690032066, "uuid": "61a5391c-3b01-4ffa-b4d6-e1c15f6736d7", "value": "T14B659F23B2829837D0B2193F9D5BB6699425BD039D2CD80A7BE44E4C3F3B6C13529D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690032066, "uuid": "e7797904-e218-4e9d-8a5c-20cdf484b114", "value": "7ae416377d1ae94f412d8b958c2f23da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690032066, "uuid": "3b9ae63e-f1a0-44c5-9129-ddf0ce8af1d2", "value": "24576:FtuY8DyxG8F+KDWKejV9xvEirHl97/KcS+H0EqB0Q//T5Loe/XMCv:fYGQQ6V/l97hkEqN/ffv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690032066, "uuid": "25e7d717-7f91-4bde-bb33-0c5a3c4b3c9a", "value": 1493504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690032066, "uuid": "6070de33-707f-44bf-bfbd-da278885dcf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690032066, "uuid": "0a45a6f9-131f-418a-93c8-729890014ef9", "value": "e4661f9c8d4cb3ae13f8bb875a8e7680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623d43c6-285f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690010063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010063, "uuid": "8b72b137-5ab0-45eb-97c0-4f088cbdb042", "comment": "Malware payload", "value": "863e7c22c771e4005197ae28363584f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010063, "uuid": "dfa46d89-1101-492e-a67a-34af747e1512", "comment": "Malware payload", "value": "dc59d5c1001df8271925781c33dd7360fe27fb750357107f12844fb5903bc65a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010063, "uuid": "c782617b-632e-4d8f-91c5-6b096e87f0a5", "comment": "Malware payload", "value": "c2b6309eaf265e8f727ae416c3e2dc80c85093c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010063, "uuid": "3e9b2ea8-0f0a-4b21-9e4d-d4a7803ac8f6", "comment": "Malware payload", "value": "a4e5292b3a267a1a3e757ca90c94b292f50772633911ff56f7cf16a722221ec438040153fad6de7c1d84a82deb84466b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010063, "uuid": "9cc71d79-0ec9-4666-89f3-de6214bca2ea", "value": "T100C30AEE7291D5ABCCADC0BC95BB8A714E307CB9C574A21A0FC065122FB1DED5A2CD11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010063, "uuid": "65d9d732-6ad9-4530-a435-3a415ae2e9e7", "value": "86df07379a44a68306a92b3aa51feb2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010063, "uuid": "3482b66b-4b9b-4707-a8fc-29a6419b91f3", "value": "1536:i+TFehW6kk7PW6uZ7rSGFJVnmnMHOUc1D9SKD3wgz4/3INHOubF:VaPW6w3SGFJ9mnMSD9SKEgA4/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690010063, "uuid": "68a08639-3507-4942-93bf-425ec43d52fb", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690010063, "uuid": "20976f30-cb80-4804-9a85-42bc483de635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010063, "uuid": "feee4171-9ba0-45ce-a421-e6404d9a4a9f", "value": "863e7c22c771e4005197ae28363584f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915e2734-2878-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690020879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020879, "uuid": "44c032c8-63db-4201-bf50-7262b20ad204", "comment": "Malware payload (Mirai)", "value": "8d3d3958cd1abfe6e8c403db51b16d83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020879, "uuid": "4b428d88-cfb3-475c-9bbd-3745650d0beb", "comment": "Malware payload (Mirai)", "value": "dcd256ab626ad1f58bc71d741666756183fd111a9e8563b32ada88a3027aeb7a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020879, "uuid": "9d28a7c9-796d-4106-bf49-9e356cac21e7", "comment": "Malware payload (Mirai)", "value": "fa0aa1b9e12d6e973680a02feebd7745a1c4794e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020879, "uuid": "8623caed-818f-417e-9b8f-7c438cc537aa", "comment": "Malware payload (Mirai)", "value": "0a47e1ed76a857066280816c13d264ca44d6a4e899b75cf2983099488129a0e2bca2e4136d28d38fa2d5ef0b0f768c26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020879, "uuid": "4d5b81a0-4700-4360-ad51-3bcdc0d773f7", "value": "T10603F751BC829A77C2E1137AB6AE4A8D332163E8D2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020879, "uuid": "1c10e5b4-7799-4e0d-a732-a6a5b6347c33", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTC/NYwW:svbUG5fPlUlDf4Sycv+PUJjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020879, "uuid": "2c06c1ee-6d9e-4d16-8424-9b93eeec1005", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020879, "uuid": "2f967508-7426-4cd3-b457-cefdc9cd28c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020879, "uuid": "84f22dff-352d-410d-b32d-a89b75331afa", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a3bfb1-285c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690008854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690008854, "uuid": "654ba317-59b1-4c9c-9f1d-277a2964c316", "comment": "Malware payload", "value": "973af5778ac82a81d3af23a156b2bace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690008854, "uuid": "d504571d-22d8-409f-8742-f0317ddf860c", "comment": "Malware payload", "value": "dd124a7b396150e4d8275c473594e47ac24606ef0955e2c13310aac9045554ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690008854, "uuid": "151a7202-5898-4c45-930e-d1cf62f367f4", "comment": "Malware payload", "value": "e7aca649fb9347c4e2ff3e02f692f8ef8978f642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690008854, "uuid": "59858112-733a-44a1-9acc-953370cd43d4", "comment": "Malware payload", "value": "83b8cb8cc744eb9ec6e0327c649c2e2633da84b3f49398d099a9fb51c9da0c35b1bc6e1667a9389acfffe3898f1abcaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690008854, "uuid": "4d01108e-3042-4b6b-9a42-a58f1432c5bf", "value": "T1DD464B90F9DB84F2EA03557004A762AF23306E0A4B39DEC7D6407F6AFCB66E10977525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690008854, "uuid": "ed642cb2-f5d4-4aa4-81c1-078d9ddd1346", "value": "ef5ee1a30d4a83fd2256bd92297da50a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690008854, "uuid": "c2e2eb08-e764-454e-b7ba-ba7ee9c881a4", "value": "49152:TtSHkCyvh0uhRLTxd+K7EIrbgGCpLXadU/8IrOZHZVRcfM62d7Ep3W/61jn+E0tA:T5veub/x6ebgGCpLXSRZ0msx973u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690008854, "uuid": "90228b96-e826-458e-ab92-7c0b0422b70a", "value": 5685760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690008854, "uuid": "ed53b577-773f-44fa-9b98-127d2d9d7cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690008854, "uuid": "a8a6002e-d2e5-447a-8dee-16348f9c992b", "value": "SIack_Desk_v3-271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04780c3-289a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1690035614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690035614, "uuid": "8b5e7478-7d0f-4c02-bfd6-f52676b5ec23", "comment": "Malware payload (CobaltStrike)", "value": "1b2ad89ff00089dc6407f1806cc6dc29", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690035614, "uuid": "7f8ec0b8-6dc0-4625-98e9-ff67e14d6085", "comment": "Malware payload (CobaltStrike)", "value": "dd99e8480bfb4aec08c0186034b491ef54446b03303483cfe6c9f72ca647c2ca", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690035614, "uuid": "08ae7010-3f18-4ddc-adaa-b409ba75852f", "comment": "Malware payload (CobaltStrike)", "value": "1ac4c9b1c8fe7022b542e0537744455edbfc9475", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690035614, "uuid": "3b4d7142-5bef-45b8-ac42-bf74421c8113", "comment": "Malware payload (CobaltStrike)", "value": "2c79e6008a18446231f2cba79570c093c2caf0e8180dc2f2db97cfe747e16c27d2797419dffef89ecf0116d25959d369", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690035614, "uuid": "b32901d9-05bf-434d-9234-64efc4ca5acb", "value": "T183447C4973941CF9E877823589628A15E6727C160770EA7F03E4BA27AF332906D3F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690035614, "uuid": "fa289620-2afa-46be-8047-2ef926d16da6", "value": "51f483a45fcf944cad45656e910bc484", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690035614, "uuid": "56f86a34-af07-4b32-af96-e65937c9ef35", "value": "3072:KY3ToGV0GOyTxA9LGl3ENfZ6Z2bX8bC90xwl9QZiO41CoY46YxLCE4jE2l5POuxD:KQJVeyTxAZG52fZSMsC9sjohHwuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690035614, "uuid": "15c45fa9-843c-4eca-a943-43be04699dfe", "value": 261576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690035614, "uuid": "d9713384-9959-4d7d-b815-c799e1d74340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690035614, "uuid": "c22bb075-c6a8-4ce6-b280-e6d9a549c329", "value": "1b2ad89ff00089dc6407f1806cc6dc29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e096d4fa-28a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690038192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038192, "uuid": "ac8667dc-b796-4888-838e-9e3c60dd8929", "comment": "Malware payload (AgentTesla)", "value": "4f00274ba9cf0c94c9fa92dba45881da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038192, "uuid": "7a108733-2cdd-45d6-99f8-58c3c4318c3a", "comment": "Malware payload (AgentTesla)", "value": "ddf7770047bab26cd3cc7752df568dda1b03789739ed404e3c5143bf0abba51f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038192, "uuid": "d7be760c-18ed-4670-a71c-688f1fa60485", "comment": "Malware payload (AgentTesla)", "value": "b2803664e5cba4ed1a9c2a38bf37ffd5e0bbe457", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690038192, "uuid": "f8dac030-d59b-47ad-8e10-2035c15d5dae", "comment": "Malware payload (AgentTesla)", "value": "02f1ff043689af866eb1f52da08c2650c56135800b777d28be3903affe1033770a99efd7646bc7304ec8ff5602a15f6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038192, "uuid": "ed9741b2-5ca7-4232-8e80-689a7af25a6c", "value": "T1E605173818BC1627C1B4DFF58AD08427B2E0A96F7215ED386DD357D64216B06E9C3A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038192, "uuid": "b75b9a72-79e9-4160-803a-1220021551a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038192, "uuid": "c4048b7c-d862-4759-bdcc-718a63fdbd38", "value": "12288:ZZBvSTHHv1aQ1S9sh4IkxeYFYNtchEB4YVsKN/+QrWHyEP4iOv:ZZpU1pc9sh4nxeYOci4YvB+QrWHD4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690038192, "uuid": "0fbe84c3-9973-439d-849b-f2d93121bddc", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690038192, "uuid": "b04e6b68-8c34-4cc8-a81d-a0a0f6c6f760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690038192, "uuid": "7e122d4c-cb51-4147-ba6d-8f03eacddfc7", "value": "DOCUMENTS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c7f0a5-2889-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690028186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028186, "uuid": "ab0e519b-f88f-45cf-bf79-8bebcce48fa9", "comment": "Malware payload (Formbook)", "value": "240f052cd9b3267c2e88fbca8d46015a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028186, "uuid": "8f1369a5-b997-4035-a691-c04ed299d8ed", "comment": "Malware payload (Formbook)", "value": "e0da3238356f21885951bc8b6e7436046c55e32151c79e9eb018abfbd70d8882", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028186, "uuid": "4377d503-9a88-4747-8697-5ea1447f7c23", "comment": "Malware payload (Formbook)", "value": "899b2b6d25dae412c1e7b45bb5295c33fa4a39f9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028186, "uuid": "5e5b9838-a8be-4f8e-9563-ef8d1198cc30", "comment": "Malware payload (Formbook)", "value": "6f415cebd70882369208b8030d741f3f84384bf9fae2ee9de098da4dbc00d01b26fd02d2b657526b3537a26d27549931", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028186, "uuid": "5712798b-4f3d-4dfd-9c24-24cfa43ca3c7", "value": "T119E423318454E56CF62670363E554EE7751B4AD4AA3B0A93CB66CFC6DEE2F10B4031CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028186, "uuid": "50a445a6-e407-49e5-9b08-e71de98d60a9", "value": "12288:4vChZ12zSZz8mSUwuP2qR7lwQwjf82Htp3ilDNDVDt6bWPNaTguk4mTx1AIEHCQ:wcZ12iz8Rxi2W7lwQwgq3iB9VR6waTgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690028186, "uuid": "a3a50a4c-6e0b-480a-94d5-c4bfa14198eb", "value": 657928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690028186, "uuid": "87444309-cc53-42d9-91de-06e16bb402d6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028186, "uuid": "dcede41c-1935-44c5-9587-234785009a9d", "value": "PURCHASE ORDER 091020.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39980d2-2870-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1690017554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690017554, "uuid": "49e1a5d8-7ce5-4a85-b152-a5ea840ef895", "comment": "Malware payload (GCleaner)", "value": "e2c4d15d52ad163feff9485adf5d577d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690017554, "uuid": "dd5713e4-1e76-49cd-90ad-0ea186b0c67d", "comment": "Malware payload (GCleaner)", "value": "e20d8500c29a288d9ba280531651ad74c81cfc4c77a95bc4f08cce232ff1b6aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690017554, "uuid": "4baf7397-4c5d-407b-8ef7-cc03b0fe7e4b", "comment": "Malware payload (GCleaner)", "value": "0de8e73173ed7791250242fe1521554f38bcfd36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690017554, "uuid": "81fe66f2-60c6-439e-ae08-a5d96616339c", "comment": "Malware payload (GCleaner)", "value": "bd457ecc76f1bf1ce66a582fcd0f69d61d5eb40a73000f1f2bfe6f0d88de546579336333f0706a03c4d969855b952f13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690017554, "uuid": "d8490e95-a938-46a8-9a5b-0e516583559b", "value": "T13664F11139A08072E59B693099B1D6512E7BFD63273506CB7BA4372E9F303D11B34B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690017554, "uuid": "234595ea-7c5a-4ef6-88a2-db1767d031a4", "value": "6d688d9cc0f6602b42d54dce0edb5c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690017554, "uuid": "28fbc112-7c98-4bfe-b686-daef06b70ad1", "value": "6144:GZy8qgW5ixeelIUsI4lmCfm7fpdWNgwOE/Caf:AfqgWEDlIUaIg6d0bO7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690017554, "uuid": "f3856d59-1fba-4c18-8fcf-5d552cc63a89", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690017554, "uuid": "d94873ed-fe03-4f2a-b150-3537b19376a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690017554, "uuid": "c99a8222-6b6c-4168-9c84-61e01baad64d", "value": "e2c4d15d52ad163feff9485adf5d577d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5e6fc1-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014804, "uuid": "ef9bd30a-4870-4f79-9384-7603a72fde09", "comment": "Malware payload (AgentTesla)", "value": "50b304e16c0ed6d9e9289377dab23021", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014804, "uuid": "aac1901d-6a22-44cf-a738-fb0350be4a03", "comment": "Malware payload (AgentTesla)", "value": "e213f4e03acb673bdf171735904353088ee43e966fefe127ab867079e77d4c16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014804, "uuid": "e79c800f-df00-4742-9725-976af575be7e", "comment": "Malware payload (AgentTesla)", "value": "0604ca98903a66811004e6e73541e37d188e120b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014804, "uuid": "783a0f9d-b358-43c3-b93d-1e48a8eac6d5", "comment": "Malware payload (AgentTesla)", "value": "252f497e6cf1a7da4a13de0b73c1711e1aecd458ded06353fdcf5c834d92f01b5f7feff95b20263a711a17ebf3fce6b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014804, "uuid": "acac4661-2d03-495d-8b1a-13cc04fcb0e8", "value": "T1B0E4493C48BD223B81B4EEA58FD5846BF0C0A96F7211AD35A5E35B554306A16F8C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014804, "uuid": "8a3409d7-c072-41a3-9643-6f9cf009523a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014804, "uuid": "5689602e-4c2b-4db5-9657-9950e74d7023", "value": "12288:CWfle+zcekag/SnizAoQUDexS4nMbiNoMT:CcYza/izARUilnMbi6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014804, "uuid": "ac09757f-1f59-47be-b867-b4ffe7e78884", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014804, "uuid": "d4d70e64-a722-43e5-b45d-e68029b9ec97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014804, "uuid": "d2ba579b-c6fc-4841-9fb6-51550c43c4e9", "value": "DHL Shipment Document_22-07-2023_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8ebace-28a5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690040116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690040116, "uuid": "314ab4fa-3fe4-4ea3-945d-c8914710682e", "comment": "Malware payload", "value": "4c8380468a547be2cc7ec54ab385023c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690040116, "uuid": "18dc429c-6f92-462e-ba37-541509758932", "comment": "Malware payload", "value": "e4d545ca96439da716625ce74f1322fb044ca31e9c310d143aa31ffcffd0a96d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690040116, "uuid": "db5931db-53bc-45a1-b35f-7af11ba33c4a", "comment": "Malware payload", "value": "6b2124329edf730cd525d2486ac2d06052d3bfeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690040116, "uuid": "693a4dcf-5d23-47e9-b034-1ccf83d0d1d5", "comment": "Malware payload", "value": "6a0e261c912e733ec6094b2a403bfbf25a82262420ca85a941d4f65d945e701137e1c1460649f862d9c95016702d41f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690040116, "uuid": "d6285e6b-7b14-4051-aef6-a1a7770d0828", "value": "T1DE94AEB1F078A82EC036D77BB96C13BDFB41D1D6B12501048562FDB96AEEB418D386C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690040116, "uuid": "d8fcca91-b3a7-4e46-93c4-def930246046", "value": "12288:cK9rb1E1HaxDIlBtmgWywFBb8iT9SBmwU/BJy:HiaxQt3X2cU5Jy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690040116, "uuid": "455cc052-7b66-459f-83be-c07d8de7a8c7", "value": 443940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690040116, "uuid": "b6be6e9b-bd64-45f0-9d54-0c4a8dfcdb33", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690040116, "uuid": "5be88e13-c35a-479f-9433-e59fc6521299", "value": "libfm_cp.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2f45ad-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009326, "uuid": "5d18dc5d-c907-43ca-a12b-e08c150fc98f", "comment": "Malware payload (Gafgyt)", "value": "a3d483df1c1e409147bbb67947a42556", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009326, "uuid": "80961d85-7408-465e-b261-98586c2231c3", "comment": "Malware payload (Gafgyt)", "value": "e6da70af160fad27270a4e527aa1546b585821a4ee3a27c683333b63b756cab7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009326, "uuid": "a18effa4-4cb5-47a4-92dc-9335949d5b56", "comment": "Malware payload (Gafgyt)", "value": "d7b16e62da1aec1b518db6155218596a402669fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009326, "uuid": "9053464e-c157-44f2-9d57-ce18af373aff", "comment": "Malware payload (Gafgyt)", "value": "f14e5533b3bb8371c831ef8a00d8d0bd2afeedce09b6dc85fa85ed97c31fc50719e4871f9d384ed33ce8216b00afb602", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009326, "uuid": "6de2ea87-549e-4f29-a168-790f9230a7be", "value": "T154E38266BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009326, "uuid": "29d1b457-9f6e-4916-8d0b-35bea0aa7b83", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVdpLtaoLAImlP+s4zWfOodW:byvWmBx+sK/Pfl7gImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009326, "uuid": "845ba409-f820-49c5-bc11-d86f2bcff0f6", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009326, "uuid": "5b9194f8-e2bb-4cfc-acae-27e7b639ec72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009326, "uuid": "3ffdde35-457c-4b69-aab6-c7c6ff50dc65", "value": "a3d483df1c1e409147bbb67947a42556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d5d800-2878-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690020885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020885, "uuid": "41727ba3-3efc-487b-b214-fbc888f147dc", "comment": "Malware payload", "value": "7ea0cf559c743204115992b509252d56", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020885, "uuid": "7a28e34d-eb41-456f-a031-3bf48d35d1cb", "comment": "Malware payload", "value": "e8d34412fd7d15df6889a3d5faf5e105dfb4c204e9d8d38928de7777dffb0470", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020885, "uuid": "549357cf-2b55-4a29-a819-8eb5186f3de6", "comment": "Malware payload", "value": "3d8c1f319f3831f3bbc8cce675d83358c2b6ed60", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020885, "uuid": "98087cc8-f04d-41d2-b97a-bdb3522ece5d", "comment": "Malware payload", "value": "6c94e35c41dab0faff5d0d3b97abd7f3cb94955d0a56d6e9392bf30106d7b8fc5f1fc5e9ff4af4829ac6b6be979695bd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020885, "uuid": "05d25d02-1621-42e4-b877-c4c084f69f38", "value": "T141730856B8814B12C5C5127AFA2E128E332357FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020885, "uuid": "86cbeb5c-d2d2-4f6b-8e49-2d037ba26f80", "value": "1536:mln25xPBXk1wnnkL7+KE007k4VkyazN0bIqvikNnsvHTGsV5GYIWR:rxpXCMkM/3ja4NnsvHqsVER4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020885, "uuid": "f198a9a5-b521-4404-b1d0-e3e2d803a53c", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020885, "uuid": "237d3d93-1a8e-462c-b8ea-696d21ef94e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020885, "uuid": "dd4eae7b-c6aa-4f19-aae0-fdb9e6804b40", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87deccac-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009267, "uuid": "e60e6eea-293f-453b-a3b6-b5185a5b5f59", "comment": "Malware payload (Gafgyt)", "value": "dad8583f91b43d33657f23ecb51057db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009267, "uuid": "3443d3f7-6926-4fae-88d9-899c1c1f6b59", "comment": "Malware payload (Gafgyt)", "value": "e8dbb2fda30ce3a6af999a896804195c3d63edd87715b07a04579917d1d2f0ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009267, "uuid": "dc0d0d87-e267-45ed-9816-705f2c0f93e5", "comment": "Malware payload (Gafgyt)", "value": "f4df5bbeec6c9859752c216f5780d6af70dec7bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009267, "uuid": "8f153782-f566-4fe0-b88f-5733f83b7b9b", "comment": "Malware payload (Gafgyt)", "value": "721112cfc3e63dff4f6bfa049cf3f99af7eecb4b8eda680394ad0f53963fa3651ecf2229d7c667b0ea69a07d649d6b66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009267, "uuid": "c56d41c4-9701-4a7e-b3c9-4cd9b9fd3f08", "value": "T1DF933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009267, "uuid": "903fbc24-44c0-471e-b2e0-3768484c3d6f", "value": "1536:mlqmFTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emiGMUNLe5um7WAgcVjmZIcBI:ml72UVUtBUI8GwPfHkk8rQeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009267, "uuid": "982ff9d0-f1f9-48a7-928c-226944fac8d2", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009267, "uuid": "18415e94-6c55-42c9-bb07-3ac195e42c58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009267, "uuid": "142b4639-764b-48b5-b83c-3ece15301da0", "value": "dad8583f91b43d33657f23ecb51057db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7b5eee-28b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690048901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048901, "uuid": "34d42026-80bd-453d-b26e-07ad505291b7", "comment": "Malware payload (Mirai)", "value": "4d75403c1ed21ac721f49039be9a11fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048901, "uuid": "a345414c-f1b4-4828-b91b-ef18f935e82f", "comment": "Malware payload (Mirai)", "value": "e976357924c99c3e2812765474bad41160e51e88a4cd321e9300671191a32f62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048901, "uuid": "1300f2a7-fd15-45f5-9fcd-9ba5dcfeac9e", "comment": "Malware payload (Mirai)", "value": "a13df97081f041872c78caa54e7002d6db799caa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048901, "uuid": "9396f64b-78f0-4420-97c9-93b33081b0f6", "comment": "Malware payload (Mirai)", "value": "94ec4443af4984cdde0ab1f714a6f340dcff1c70a94c091fa8004e5f2f5174d7c9affe7985ab3aea3bff696345fbcfd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048901, "uuid": "c53be493-ce6c-4020-bb53-b6649aa9c48e", "value": "T18E73A659BF510EB7DC9BDC370AA91B0128CD695B21B47F36B930D828B61B14F26D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048901, "uuid": "3d52e456-fca1-41af-b211-f300d68571ff", "value": "1536:x7CaoHG8vjFPotoncVityyZcLthRDi4N:x7CaoHGUdeyoDi4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690048901, "uuid": "354e795a-1acd-4545-a465-9bb23e5a37fc", "value": 73580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690048901, "uuid": "f85df26e-54c9-431b-907f-1e7959990550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048901, "uuid": "d66cbd79-9a8e-4588-a78a-074cc0bbbdaa", "value": "4d75403c1ed21ac721f49039be9a11fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7edcd99-287c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CobaltStrike)", "timestamp": 1690022715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690022715, "uuid": "3580ac69-4f27-444c-91c9-6cd907e6668a", "comment": "Malware payload (CobaltStrike)", "value": "0e62dc80bb864551a01cdd70b96970f4", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690022715, "uuid": "bfff8c09-f4d5-43c5-a4a4-bf63305b4531", "comment": "Malware payload (CobaltStrike)", "value": "ea73ad2266d73da03328dfa1bdb5971203235e1dd2c53978955c85445e057365", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690022715, "uuid": "69763a82-25a3-4ffb-a4ab-1e83ae2ec979", "comment": "Malware payload (CobaltStrike)", "value": "2d933aaacee299ac4f9317972b082e86526d50b2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690022715, "uuid": "90733529-94bf-4a67-8fb7-2b9f3ebdd436", "comment": "Malware payload (CobaltStrike)", "value": "e0e765f2460ba56ba31c60e5a84ec02a83651ae944ac46e92cf84d1fe135fd8b69b56a8ed27515d050f88e5cf9d0f17f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690022715, "uuid": "f11e8db1-288b-4df1-8532-c617bc9f6d82", "value": "T15592EA3FE31368E9C106D57885FF2732DCB13DB345A7932A1724D2B42E106A46EAE610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690022715, "uuid": "c63eab98-5376-4063-973e-6d27282a4ac0", "value": "147442e63270e287ed57d33257638324", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690022715, "uuid": "a16a3432-88a3-4847-8150-c4f6b5b81098", "value": "192:yV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2jCP9LmHD5+WF8qa1Dojjgi:8qaCF31cix+Dc4zj+oLIV/FF46gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690022715, "uuid": "7e6795a5-d733-4191-be78-e2b8d9b98958", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690022715, "uuid": "d1b11ef0-570c-4774-8c6a-14edbd7d3569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690022715, "uuid": "e87063dc-a5a3-492a-b5c7-bff84fa3b08f", "value": "0e62dc80bb864551a01cdd70b96970f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf87f8d5-286b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690015373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015373, "uuid": "866770fb-f569-4cb9-9f43-085cd0d96e28", "comment": "Malware payload (AgentTesla)", "value": "1527a62e1729e27830e00be3627db60c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015373, "uuid": "09f33f64-38e6-49ed-bb63-2b355770e4fb", "comment": "Malware payload (AgentTesla)", "value": "ea9e59dd7174a63eef63668d6d07b0c4fc734718aee5c3342ef0100ccd1921d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015373, "uuid": "414ad887-e1e5-4a89-937c-b7fdf2605256", "comment": "Malware payload (AgentTesla)", "value": "b55d2ac7fb166745978790c2a6ed7c7ae7800ffc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015373, "uuid": "3b5452a9-4474-4181-ae32-4d27ba9455bf", "comment": "Malware payload (AgentTesla)", "value": "c9a1f0fd9d3bb0359318a3e23508084ece81916ed779a8dc57fe8be1f9ac57468628e5fba2e21bd9aa3a200cdbbcc150", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015373, "uuid": "902429b5-28be-4f59-8600-5bd5cfbde61e", "value": "T1B305273C58B91727C1B4DFF58AD08427B2E4AA6F3114E934ADD257D64206B05E9C3A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015373, "uuid": "5f2259ee-358c-4301-bd57-91ee8d99c9ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015373, "uuid": "28348db6-6f40-4d46-8732-b047e9a89079", "value": "12288:IkvoedWlA+eQ5lvz9lkIvbcj+0dhz8LEcwA0zbx+:IkvFGAqHLQ+gsElAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690015373, "uuid": "49f8af66-e854-44c0-ab37-13b5cb2d1f22", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690015373, "uuid": "1129d114-3ced-4c4a-90cf-a678a7920f03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015373, "uuid": "1a7b2ad8-a40a-47e9-9739-41096fc214b9", "value": "3433109056382544127859043648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0934ae-28dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690064407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690064407, "uuid": "b0adef30-5db8-45b1-9898-aef983301dd4", "comment": "Malware payload", "value": "0364f8100802aade2ab6f4027e7e7c2c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690064407, "uuid": "98bd930c-a966-4599-bab2-e7499a7c762c", "comment": "Malware payload", "value": "eb9659fe647ed73c38a6ed5cf811392aa36230b6ff91a8588d1b5ab557757eb0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690064407, "uuid": "5bb85495-5cc6-4689-a90d-79e2fb46c76b", "comment": "Malware payload", "value": "17830b30799b545cf25f676a407608ca4be4c17c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690064407, "uuid": "83d38b69-a85b-426b-808f-20af7ceaf900", "comment": "Malware payload", "value": "09bc545b9efae3c0b9e58ed44bbfb2177575032bc6375013881f3aebdfac8ef2e983b2244422c34b05685310f30fb773", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690064407, "uuid": "525d5b83-5944-457c-801f-54084238b763", "value": "T119F23911B7C7DA26C56C2F37C4D151141375E742A623DB1F3EC9236AAD4339B1F12AA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690064407, "uuid": "56c34c7e-4740-49ab-9868-36b192d1e50c", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690064407, "uuid": "8f4a65ee-bbe8-41fe-8686-49e409b01b9b", "value": "768:Hmw9x1LlYLGZEsayeWetzc7uIfeq+gjX2Tqs5:Hjx1LTpPYgjfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690064407, "uuid": "86931dd3-61c5-4b58-b659-b0a78cef6922", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690064407, "uuid": "936ba3e6-ce11-4a89-90b2-fe6e58294783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690064407, "uuid": "6676413b-f150-4b29-b087-94e6f3f8749f", "value": "sc0pe_carved_deobfuscated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbcf83c-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1690014939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014939, "uuid": "081271f0-f4d1-4686-a093-85893e4b231c", "comment": "Malware payload (Formbook)", "value": "c6f6b42355b9a7345e68ff94a1da963d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014939, "uuid": "b49c6226-af79-49e5-8209-c1e59cfa4775", "comment": "Malware payload (Formbook)", "value": "eba13fb7add78aecfd66663814ab64327bdb631b6dbdde9af86be4853c3cd599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014939, "uuid": "9103a2b3-0925-4e38-ace6-2124ebdfae1f", "comment": "Malware payload (Formbook)", "value": "bd6571b730a87f9bcc0fc068c8de2fc2e60a0a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014939, "uuid": "ee50a6b2-dab1-4967-9f52-a8849366d70d", "comment": "Malware payload (Formbook)", "value": "bf9f223fe31401695cfa5422ea00fa5c83eb7922b6dcc2775e31ebfc8f523a7da6e375ff5c5981ec7c150a0185d66f36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014939, "uuid": "7418cc00-4eef-4ec4-9d36-8bc0dfb012b2", "value": "T1BA05283818BC1627C1B5DFF58AD09427B2E0AA6F7114EE346CD257D64216B06E9C3A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014939, "uuid": "72c9e551-9cb0-4b25-90d9-f307d05456c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014939, "uuid": "ada7ddc8-3b84-4f65-8ea2-3dcfdd46560c", "value": "12288:5MXn4qKaF2RcEck8YRQzbvNdvDB7Njy79DA8vXKr2scvWhzz/7H09wrD:5MX43v+FFFxypc8vXKrqWNzjMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014939, "uuid": "1f3d900f-4624-40d7-bdb4-dfe7f874c599", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014939, "uuid": "762ff7ee-a6fb-49ce-9edb-5f05672868e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014939, "uuid": "a0b74ee5-ccbb-4d46-ba43-a0e73a4e661d", "value": "New quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4054ad96-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997980, "uuid": "60bc57d4-8d4d-4afe-a44b-8d71d67a959d", "comment": "Malware payload (Mirai)", "value": "77380549a8467ccdb110ef964c1e754c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997980, "uuid": "3cb3981c-5151-4d19-a9e2-1ec01acbfa44", "comment": "Malware payload (Mirai)", "value": "ed1f7f858c36d83e61a17529cf5cc7ed63604832930de878b4c3a12f92a7b0ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997980, "uuid": "a37a76de-307a-4c5d-a09d-acfbc96e385d", "comment": "Malware payload (Mirai)", "value": "2e06b5a43a4f270651821e0b0533e1d3b2e591ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997980, "uuid": "7af1d85c-639b-47f7-a885-62a2e52a9e47", "comment": "Malware payload (Mirai)", "value": "7e3d190a8f1537b5185e4847cff80d495819685697cb03201122ace6bcdb92da7cb01270d5f7a62539743495392ca55a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997980, "uuid": "fe52f1e1-542b-436b-9d16-2eb77de02346", "value": "T15993504E6E714F7DFFAD823897B79E209309339616A1C684C1ACEE025E70389741FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997980, "uuid": "6278b112-3e05-4c46-a9ca-cc8efceb0cb4", "value": "1536:fUNyqwipEXzKt4kKSdkVz+lW86YExjSk7IB6CUeHXYpvJQEHAB:8mkKSdG+lW86YExjLMhUeHXYpvJrHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997980, "uuid": "4770bcbd-7396-49d8-875b-74c21afc8d55", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997980, "uuid": "6a5b38ac-ad25-495f-9fcf-10e4b70331f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997980, "uuid": "72a3f474-f574-4e20-9328-7313592cbabe", "value": "77380549a8467ccdb110ef964c1e754c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26653dcd-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997936, "uuid": "33b2af6d-382a-4ec7-af04-7b0ffb7e3d8c", "comment": "Malware payload (Mirai)", "value": "b1208acd653560d63c486b679651a855", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997936, "uuid": "e2a79c41-6fab-43cc-b101-32ac5a600838", "comment": "Malware payload (Mirai)", "value": "ee6622d6a7e243df0dab536766e18cda13739835ff06dde0ae561acc6b50190c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997936, "uuid": "60e2b76a-2ee8-400d-832d-38760b0f0552", "comment": "Malware payload (Mirai)", "value": "064f9f5ad96dd0e2297164ae6c8d9f975d711dd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997936, "uuid": "423cc891-1339-4926-8bf8-7b38adade013", "comment": "Malware payload (Mirai)", "value": "1f06901faa66a4ae10e53f001f190ecae599eeb49e56bbddb91bf59232efc0d631d575863f57a5a800ea60fc64a1c419", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997936, "uuid": "c34a440b-dea2-4f60-91df-2a71424ccf54", "value": "T14D732915B87A2E17C0E4927E12FB8615F2F6330E1470866D3D790F8EFF64684A94A277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997936, "uuid": "cc7ead18-e0ca-44e7-a0cd-2d6f0a6ad38a", "value": "768:Z7ROahnu+oRA44ju9dTHZsZTWYGtSFIO0ZLBXRW4W53dP58iPRufXYLt1rpz/xmT:pcku+M4i9ZarMEVD4prLJTEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997936, "uuid": "7b3b573d-ad21-48ad-aa0e-c4af8e42fa0b", "value": 75104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997936, "uuid": "fdf4b663-15d8-477d-a0ce-50d844555d89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997936, "uuid": "7ee0c787-618b-4a46-b333-abe369a31a70", "value": "b1208acd653560d63c486b679651a855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51591083-284f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1690003162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690003162, "uuid": "60bb3e18-80de-46be-a424-f102866fd90e", "comment": "Malware payload (Smoke Loader)", "value": "a6e553dbdf0123278b750d89d1c35ff3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690003162, "uuid": "3b4b3511-f853-4e45-a55a-26742a8bfe02", "comment": "Malware payload (Smoke Loader)", "value": "eeda861f847c8e1965617979471e1983b9fa1838fb804e4d67c7c22b36b9b462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690003162, "uuid": "fdc86cfb-7312-4759-8060-ad7604426be9", "comment": "Malware payload (Smoke Loader)", "value": "5829e25dfe59f9a239b5400935e3ea8bf622a929", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690003162, "uuid": "4c696716-7d7e-4c65-82ff-6c5e91a3a720", "comment": "Malware payload (Smoke Loader)", "value": "6d9af4450849bb093792b35f5c45b11c16fe118c1aceff4c0a3375f67905c60ecc6703575a6aa8bc5f5994c08fe7ef09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690003162, "uuid": "e6e54bc9-b78d-451a-8ac3-99b5ed659832", "value": "T1C344CF2276E0C072D06346304830D6A15EBFBC725BB6D5CB77882A7E1FF16D05AB53A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690003162, "uuid": "fbe2a3df-fa4d-4a38-99d5-bffa425c44a2", "value": "9a064d655ca92ebdb195df1065a05abf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690003162, "uuid": "d8a1f2a7-cc40-4ddf-8e5e-f3e60ac4eb8c", "value": "3072:gFtqD/tjhAnZSeg1XGK09h1OHEVMFnCbP/7GX1y86sIa:mqLtjhYZNgAKqh4HDnGHif6sI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690003162, "uuid": "e71b7e46-5e92-4c51-8960-852b3ba2f681", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690003162, "uuid": "f710d78f-3a41-498d-ae35-38bcca0135c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690003162, "uuid": "ca58264d-213b-4d34-be1a-b9051c56dd6a", "value": "a6e553dbdf0123278b750d89d1c35ff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88035b6a-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690014850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014850, "uuid": "1c0e36bb-4267-4f0f-b6af-86b18c074744", "comment": "Malware payload (Gafgyt)", "value": "5962096609dbc00fd65764b048e83c74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014850, "uuid": "4fade9bb-7f02-430b-a548-7aff1059dd13", "comment": "Malware payload (Gafgyt)", "value": "f2dbb580eb0fd256b44223353ee06591abb3818f0d9bd228d3910c83885f7318", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014850, "uuid": "3c478140-d0ef-4013-bf54-19cd4e8b0fa7", "comment": "Malware payload (Gafgyt)", "value": "2770c96946e79f8cd6d6fd58f7a091f1c9555fbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014850, "uuid": "c3806e41-df5a-4a35-8456-9aa242c8fdae", "comment": "Malware payload (Gafgyt)", "value": "1924c9463613419a0b3e4254f6466e6ef71f14ba417da2d7bc30ba48ae1756b5ac0ec0c6831a5b0a74889e8ffe15b06a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014850, "uuid": "6f072be0-e8d8-4797-9ee0-e7d996f4de28", "value": "T158833B8AE743C6B3C44306B1029B6B190931F9FA1A2FAE56F31CADB49F125D57127F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014850, "uuid": "4a676e29-dccb-4136-bd7b-58b535dc8587", "value": "1536:hZ6eLECETvtYWnKMS6DXxU2+9XXq5hirfJbNIhSKzT0bNI5Vma6jtafbek:OeLERK36DBX+Fq5hirfFwS9b+5Vma65M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014850, "uuid": "4a0177b9-205b-4421-9310-7827cd670188", "value": 80750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014850, "uuid": "0dfc07aa-accc-4a74-8b77-86b982259391", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014850, "uuid": "eb87b417-130a-4fa3-b473-5489437c1a16", "value": "5962096609dbc00fd65764b048e83c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db65e8f-2843-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1689998083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689998083, "uuid": "112e34f8-cb0a-4b58-bd6a-9f0e914566dd", "comment": "Malware payload (Adware.Techsnab)", "value": "173ab2d3641eba04cdfa95be069f84f9", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689998083, "uuid": "9126239a-6198-4e4f-a45b-befef9c922fa", "comment": "Malware payload (Adware.Techsnab)", "value": "f2df3448c11257f826a0b860d8862ef3ade68f64a2e036071961f7f46f16428c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689998083, "uuid": "553a7924-1dbc-4f11-aed9-3073283cb9d0", "comment": "Malware payload (Adware.Techsnab)", "value": "a87eb05864ba09bd2e239a38939d9621b61a1f94", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689998083, "uuid": "d931a40c-01a9-4656-a73a-f6c7c5bd096d", "comment": "Malware payload (Adware.Techsnab)", "value": "59a88eb2cde54aace03cdb5300987d8690be64aaf3dcb4df2f2b07c7817561b0937bdc8916bd68d624dd38ffddb37ff8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689998083, "uuid": "7cd2ee95-2a19-41ab-aee8-733f5ee3371b", "value": "T18AF5E01A53800B76D633B9384D5E63774A29B9131A246CE5EAE62F4C1F35E43FB20367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1689998083, "uuid": "d219a39d-330f-4e53-8f15-cacb7cbbf075", "value": "7d6554579927a7f105f096c4d9af8292", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689998083, "uuid": "701c6305-d2bf-4992-9074-1b16457db3fa", "value": "49152:xr8WvAW6EiOvQUXJXXcPMmtQk7AMS9CYS5DRzOmpinVI+kFLgDi9Ufbrr:x/vAHivhXJHcdTYS5lzOmpimtEDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689998083, "uuid": "5e5a64e8-7663-4b06-b7ab-e4df9342f6a2", "value": 3424256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689998083, "uuid": "660ec3e0-d8df-45dc-9206-34dd69bd7caf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689998083, "uuid": "b3a52ea3-841b-42aa-acc1-4e6727d28b38", "value": "Crack_Installer2.0.6.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fd6521-285f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1690010064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010064, "uuid": "26dff597-c529-4d77-8262-5179166fc775", "comment": "Malware payload (njrat)", "value": "b69155f321c0c3c610cdd6aaa2f4387e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010064, "uuid": "ad75a183-e348-4ca1-9580-4ab2cfbec4e3", "comment": "Malware payload (njrat)", "value": "f537d1274d7ba4071b2e9a5a12a17c1b469a6728ebf43d0dec94ff4c00058579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010064, "uuid": "d9b198b8-f377-4ae8-bea7-86ca9dc5e96a", "comment": "Malware payload (njrat)", "value": "b279cacffaad61b20cbb1f6570be7e8d55e8ffb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690010064, "uuid": "8e8e90f0-1a83-496a-b8a5-21007032231f", "comment": "Malware payload (njrat)", "value": "f87ca3917ff4c8ec314e036eb0feab6aaa3c56b00d2d2af968208cdb0155edf0ed2f71919bbbc66cc76f673eee93212f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010064, "uuid": "f0c9bf5a-e822-4aca-ba12-7c8f1e897c1e", "value": "T10E04F1DDBAC482F7DCECC57CA0BF45554E102CF8C9A992227DD0650AE8E2EDD9529C32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010064, "uuid": "0e88888d-71bb-45f0-8fcf-e36cd24e90b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010064, "uuid": "7f264f1d-752e-4f86-88d7-5fa4d08860b8", "value": "3072:AaQ5RgpkX+JQrVDD+mQm3eyVwqtQMQy9fTVVoSGFJ9mnMSD9SKEgA4/:2Spw+uVfn3e1q2MQyZVOSoWMSDTEgA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690010064, "uuid": "d9093a60-ab33-4128-844e-745ae03786ee", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690010064, "uuid": "b63c26b4-d789-469c-bf16-9c45009a4628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690010064, "uuid": "8c4d476c-4802-4528-9ece-1a0c29297b25", "value": "b69155f321c0c3c610cdd6aaa2f4387e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca854fe5-28b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1690048892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048892, "uuid": "bbf613de-c720-479b-9150-60ec4d350ac1", "comment": "Malware payload (Mirai)", "value": "5e8960c999dc3dad65eea6e46da70c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048892, "uuid": "f0a1864a-fcaa-44d1-aa40-84db39ab7635", "comment": "Malware payload (Mirai)", "value": "f54fe274624cc0d2feeda8fe24f184bba2289bdab3b9e373facce4b5fa8126ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048892, "uuid": "cd88cccf-b30f-47dc-8aff-5285365fb24c", "comment": "Malware payload (Mirai)", "value": "1170a3071f23d58bcbc9acd6e1a11234497b330c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690048892, "uuid": "d333a2c6-4a10-4a71-85c4-a9e6df633987", "comment": "Malware payload (Mirai)", "value": "5d812fe9c1f2271eac655867cccb98440c8f9ea0240b2279576a9fc4b1f4b668698ef09fe04e4de8c8cd92ec7a282ac1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048892, "uuid": "ac400017-e462-4143-85c3-79052c4da79d", "value": "T1E9434C21F6761E17C0E464B911F74B15B5F522DE25A8CA0E7EB20E9EFF219C06A039F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048892, "uuid": "d1fe1719-e0a3-4a23-9371-842eb051ad4e", "value": "768:5roMJetetDmt/djTb6LvWaxx/aXEnhQQCA+YRO+epnwKWXm5vhT:5r7JAetit/d7uWix/aO+YhJKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690048892, "uuid": "3a51560b-7cce-4843-8943-3f48b25360fd", "value": 58992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690048892, "uuid": "0f466548-512b-4050-841c-57b3baac7867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690048892, "uuid": "3bcd63e7-5a7e-4278-b6f5-b13f5d03e7be", "value": "5e8960c999dc3dad65eea6e46da70c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef4596d-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1690009305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009305, "uuid": "e158246c-dd4f-4ee2-b4b4-23aaf71ee0b5", "comment": "Malware payload (Gafgyt)", "value": "14024eb795defd21f9d867eb9e54d670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009305, "uuid": "d75de969-7aff-4583-ad88-383155fd7902", "comment": "Malware payload (Gafgyt)", "value": "f56ba300c3590603b53dbc71c5e2cce899c61fd54fe5e9b764e880a9a943baee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009305, "uuid": "10445841-da98-4d3f-b4e8-fb38358a8589", "comment": "Malware payload (Gafgyt)", "value": "5ff2a93f7341b00e3ed337731e3eed3e0328379d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009305, "uuid": "c92de4c4-4cb9-45f8-a5a3-62321fbbbd15", "comment": "Malware payload (Gafgyt)", "value": "df4859274a90a041644588bb57f01847cf88477652f020b2b2be684a771661a8030de01f2e7c1f7be126c43bed6c8b72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009305, "uuid": "dec57c82-a519-4d14-b615-9caacb2f3d0d", "value": "T1F7B33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009305, "uuid": "889682ad-149a-4043-8b4d-689b398768a7", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjC0B5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2Mjr0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009305, "uuid": "8c3245b9-cfe5-4f2c-bd92-5b8e4b367ef4", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009305, "uuid": "aa422ad5-9c4e-409d-ba0e-9482c934f2c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009305, "uuid": "a6e78cd5-03ce-414d-8af2-5baee5eb89e2", "value": "14024eb795defd21f9d867eb9e54d670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03e401f-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1690014891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014891, "uuid": "30baca15-0568-4166-84ef-f2644705d7d8", "comment": "Malware payload (AsyncRAT)", "value": "c167612cc0c7fc00625c1b7a99bb7046", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014891, "uuid": "21c72db2-6ebd-4306-8a06-387ddfa78824", "comment": "Malware payload (AsyncRAT)", "value": "f5c2d5ac66d5d1c7d6cfa05385827749860ef1ef6546090e179c9be5ef626735", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014891, "uuid": "76711041-31c4-400a-aa44-62da30161b9e", "comment": "Malware payload (AsyncRAT)", "value": "12f273440cf16a5d47970082189ad22e9b9faa26", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014891, "uuid": "2532ae4f-5854-40ff-8572-30ca71bb8a1d", "comment": "Malware payload (AsyncRAT)", "value": "e7a0a1d8824d9717591fd6e283b453a7b3c930a1c84b8a0592c1a298dded8f5a027e54286b5c686d036ffcbaa6acb6da", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014891, "uuid": "516e503b-62bd-46dc-b465-ce59462f38a0", "value": "T13D350212BEC14772D5F2C7325929E940F57EBD243E368E0D3298F11C573B09192BEAA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014891, "uuid": "d59e7d47-6754-4879-9947-c66456662ed8", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014891, "uuid": "61ad6fc3-2331-4982-8814-aef1c733b13d", "value": "24576:wNA3R5drX1DaKOFpEcO9JTq+zR9RagOGvLoHikzzNE:p5pOWcOX9v2CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014891, "uuid": "296a40c2-4b28-4336-863f-4a2b35933d58", "value": 1144651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014891, "uuid": "75adce6e-473d-487c-b12f-0e8500ac388e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014891, "uuid": "38a8233c-547f-4c31-9960-45890d50c5a2", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdebf33-2878-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1690020871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020871, "uuid": "fd29eb38-a549-4729-82f3-4fe19a2bb365", "comment": "Malware payload", "value": "f161d96182e2b1bb9c67b92a906dab47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020871, "uuid": "9d377ac7-1e4d-47ce-b923-4ba080f8bd3f", "comment": "Malware payload", "value": "f69ca3afe81cd7e65df2dd691c6b5c5650aa96f354cd9267d1d89df9d330ae21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020871, "uuid": "ed18659f-2ab7-450d-9358-95c5b523d4a4", "comment": "Malware payload", "value": "cf20522c51e471290ac3ad0bbecfb62f12c0944c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690020871, "uuid": "d94c5643-f1c6-4441-871f-31f95f19d614", "comment": "Malware payload", "value": "e597ba8cb18ae684c2ed2c19f93bc96c68bbfdbd9785c39e3d950af96f7601402143406179ec1ae0b4cf8cd275a3337d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020871, "uuid": "03afc2af-7ecd-49c2-8cb3-7b7ec3a075e8", "value": "T168436BC4F643D8F5EC8715702077FB379B72E1E622A8D643D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020871, "uuid": "10633d2d-9fca-45fa-93d0-8e6a55a41ff2", "value": "1536:JeESt/basV2rcZhG6ySN7na8tad1zWOIaEjrqMUs:JeESt/basVTgS7na8QdttXES7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690020871, "uuid": "6713c703-5830-4728-8023-9b5ad29d71c8", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690020871, "uuid": "ebdeb486-30b3-4b6e-88f7-d0943c5d7bad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690020871, "uuid": "504e8c92-de9e-4db0-9e98-da95b68517f3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afc5406-2889-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1690028116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028116, "uuid": "bdbf28fb-2367-488f-ac6c-7f41653ec785", "comment": "Malware payload (Meterpreter)", "value": "13dd572144465454cf880584142daaf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028116, "uuid": "c6705f20-2568-402b-990e-f89a02c23ecc", "comment": "Malware payload (Meterpreter)", "value": "f790bf11ea244e4397b152ca789091b3c5c442ea3c27ce0c18d3ec4c3d8ea011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028116, "uuid": "e5b682ff-8dc2-4a61-a077-2ff6893cf7dd", "comment": "Malware payload (Meterpreter)", "value": "5fb465c26b61f00657fe0c347dd3189758fe0f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690028116, "uuid": "05ff822c-cd67-4bfc-9291-0b4ad7703d1b", "comment": "Malware payload (Meterpreter)", "value": "6308f1e2b9d8f3c05303864ad9e58927dfc60871aa7f59e9348c9526aec0178dd2ec53439422f29d058d58bc159b8cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028116, "uuid": "de65984e-71d6-4983-9aa4-580d3bb211f0", "value": "T11D72E9916DDF60CAE3734FB013D8B9BF0596F9B11A2E31F87481498447A4999C8B2FB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028116, "uuid": "536e06e5-f415-40d7-bef7-11137eebe314", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028116, "uuid": "f686dae4-dce8-451b-b546-99d1b6a5d1a3", "value": "384:IEEoLO56ayzcMj+s+XszoM68y2sLVlYgwwFvwmcBe87jE:LE8O56lcVs+X5YgwwFdcx74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690028116, "uuid": "a9d55a4b-c6ff-4bec-8091-8422019957f3", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690028116, "uuid": "db1a76ce-b5a5-4048-ad9b-677729c4f1ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690028116, "uuid": "124f982f-75a4-416b-a306-4f2898b95820", "value": "13dd572144465454cf880584142daaf0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41bfb77-2868-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CryptOne)", "timestamp": 1690014173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014173, "uuid": "a420c439-2f9f-4cce-bb78-300e44773d83", "comment": "Malware payload (CryptOne)", "value": "8b108f53e1a62aa003ed47fd2d82d5d0", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014173, "uuid": "00068502-e8bf-46e7-ba09-d0bbf50f7946", "comment": "Malware payload (CryptOne)", "value": "f98b508204277a79f6eafac8ffde71c4e2fa6a760ff7edba567bd2f970aafeaa", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014173, "uuid": "56915a60-241e-4e5a-9e4b-cf81caa2c235", "comment": "Malware payload (CryptOne)", "value": "318f6d5aef52cb983b235f1ad9c3542e4f83b0a0", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014173, "uuid": "b1b32cbb-ccbf-447e-9650-e63478be60b9", "comment": "Malware payload (CryptOne)", "value": "82104120c9ea7e71f75da97a3d7df25de597726a4dcb7623eb1aec837fde9da601eb7f052c1b6ad218353d820dc68299", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014173, "uuid": "e866cfc5-e5cd-46fb-9319-a45d5ac4d5dc", "value": "T180852301B6C1C4B2C97219324F64AB36957DB9700F22CECF6385599EEE31AC1D731BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014173, "uuid": "2a616dab-2516-45a3-8302-449a94158c8f", "value": "0e806fd55a4f41060c8e206a25d6875a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014173, "uuid": "d7bd206a-bbda-4318-8fcb-840e5e710da6", "value": "49152:2fWhNaBfJXAE3J5WMLp0R3K+pq3ocFg3DTytWITwlHseTtQxp3mYQw:2fWhNaBfKEqyp0R3KshcFg3P7tlHl5eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014173, "uuid": "b874033a-6367-4286-a31f-4575d59e3933", "value": 1869071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014173, "uuid": "603a8d84-470e-4441-b0f3-53817b371ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014173, "uuid": "5c7f176f-0a87-4d83-8500-d13d8d07765a", "value": "8b108f53e1a62aa003ed47fd2d82d5d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965b0da9-286a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690014874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014874, "uuid": "95bc41af-18c4-4454-bca3-5d5ec7593e64", "comment": "Malware payload (AgentTesla)", "value": "7cd24ca9b89d7c467ccd6f8eb865b0d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014874, "uuid": "430c1a06-a335-4afa-9511-c0a906a9f4db", "comment": "Malware payload (AgentTesla)", "value": "f990c8a997a7efa88ce1b43ad08d47889f3bf72a6b69e67eb78781d3a2694ddc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014874, "uuid": "42dd60e6-7496-4c80-9578-ae360351338d", "comment": "Malware payload (AgentTesla)", "value": "6f8a1f1559269b3526b534eb2f1b006854d970aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690014874, "uuid": "c464f915-999f-4991-a433-d43438e47439", "comment": "Malware payload (AgentTesla)", "value": "2583a6587bc89e067a3128e4b6e72dd43ee0ff42ad5d34a89032975beff6922e588b1809ffc869a5a371c6ae611912b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014874, "uuid": "f4d6fafd-d499-400d-9bf2-6f9621fab7f7", "value": "T16015222071C1D2B3C4B7843449DACB7AAA7A70258B7651DBFBDE1ABA5F101C2B7351C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014874, "uuid": "42c53c4c-79e3-412e-8c74-873d176621e1", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014874, "uuid": "943d3843-26fc-4fd1-9000-223a9998b942", "value": "24576:/k70TrcXyxnI+KVt06gByZWokVPLaRKaE3xgea:/kQTAXb0eZWMcx2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690014874, "uuid": "603323ca-7412-4072-b667-030b744ec0b9", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690014874, "uuid": "584fdcbf-ffa4-4d84-a56b-9a31638e95d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690014874, "uuid": "c0e6578b-93c8-45eb-9b4c-8558e16d1549", "value": "e-dekont-20230721-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c56aeac-286c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1690015556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015556, "uuid": "f92a6124-496b-4537-b979-7934f432d183", "comment": "Malware payload (AgentTesla)", "value": "438ea1d810784cebbe1ffd336bbc899a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015556, "uuid": "0d818313-e718-414c-a3f8-b4dcd765a963", "comment": "Malware payload (AgentTesla)", "value": "fb691a42e8a2724d7607e6eecede7434abaca4d7ee341c8a736cb990637ec55f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015556, "uuid": "5125b000-d8cf-43f7-a8e8-fe22ea06d190", "comment": "Malware payload (AgentTesla)", "value": "070e195a515b7f42e57079e98ab37b78933738cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690015556, "uuid": "2537735d-1f0e-4d6c-89fc-fd462fe2932f", "comment": "Malware payload (AgentTesla)", "value": "8bcc1cdb2b2d4edde36bf6312f294d1de9a78756299b9624f1069d6c266cb1dffe77cd7a70edaf6418feab7843df20f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015556, "uuid": "d65e6026-a501-44a9-8595-d63ff0456b59", "value": "T10E154AA33099FB89F13DA734710EE11063EAE952E323D4DDBD461DCA074AD88F65B906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015556, "uuid": "37da16b9-decf-4592-960e-6c1857d63bc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015556, "uuid": "e911c736-bfa7-4d40-a9ef-5ce5fafeb20e", "value": "12288:OQkqIwcuDrF25EL/7SjRRPgcFaSlk4XqNMUT6gFC3rsdMyMbMUQe2ld:O2sdhdlk39Irq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690015556, "uuid": "b240a61f-8697-4543-872c-5da200863936", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690015556, "uuid": "7584d6f5-c783-471a-a9ae-e8e5dd6648a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690015556, "uuid": "61bcab9e-dfd5-4fd2-adb7-9f77e9e50a23", "value": "Delivery Note_Ningbo.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b146bc1a-285d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1690009336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009336, "uuid": "7d8d42db-31a7-4990-8f13-6a2ef6178a60", "comment": "Malware payload (RedLineStealer)", "value": "77c86923bbe25fe58e25e081ad1626b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009336, "uuid": "3ffff728-1f91-4a24-881d-cede7e68791f", "comment": "Malware payload (RedLineStealer)", "value": "fcbbbd849015b21c89ef9e9c066dfb0138d54ceebb5355628c2b8cf64f285490", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009336, "uuid": "5bcabd75-fa82-47fb-9749-56c020557166", "comment": "Malware payload (RedLineStealer)", "value": "aceb966188ff6b264554b67646ff41eca138fdd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1690009336, "uuid": "f6808b6f-7c52-4b99-b300-a8808459f421", "comment": "Malware payload (RedLineStealer)", "value": "bc5d54a35888614d16e156bb31a8fdd2ad14c43e44e0e37d8c59135900bb6656f148b31cf8ec11adb774beb3beb2c31d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009336, "uuid": "77ec4304-5f21-49c0-9c33-61f328273888", "value": "T13DB41243B6D85476DCFA677059F607C31B367C908C34836A3746298A1CB26C5B83AB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009336, "uuid": "8954745c-1a2c-4594-88bb-63a11edb14f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009336, "uuid": "bd438370-e85f-4403-b38d-9b3f92537ccf", "value": "12288:RMrdy90STni0OYWIE9nfRJarH+6ULuAwd/lOqth25:8y5ri0OYWIE9nJErFmP4lbthy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1690009336, "uuid": "aa6deb81-24f8-4196-a6a8-436f7e6f5cbe", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1690009336, "uuid": "245a245b-c67d-4f01-8bb9-85c701b43e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1690009336, "uuid": "00d1ccb3-86f9-483b-a7c5-69978d8cbdc3", "value": "77c86923bbe25fe58e25e081ad1626b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7b7650-2842-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1689997651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997651, "uuid": "1f137e56-2f46-4a71-875c-dd4ca8944b85", "comment": "Malware payload (Mirai)", "value": "d0b8819d0cc210145dd699850fd460d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997651, "uuid": "7413952b-2a1c-4050-916b-3fe1c4ee3bd0", "comment": "Malware payload (Mirai)", "value": "fed92e7dedd1dfa487536cdd3f737124b95df7dac5210e80269345dca4d0bbc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997651, "uuid": "10347017-a95f-44ea-9bc8-a2ae05fcede6", "comment": "Malware payload (Mirai)", "value": "85964a7ba973f97b4d065b9ba6f4e60996d640d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1689997651, "uuid": "ec91cbc6-aef1-4c84-a18c-248b2eb913e4", "comment": "Malware payload (Mirai)", "value": "a8455798db08b031c072c28cfd97563d7dee769e19cf1b93c2a7a6477ba2268515cd37008567f7a6624ce256907326ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997651, "uuid": "f55ef056-efc0-423f-ade5-8175b5c01ce9", "value": "T111E2F113A1C6836CF4C5897E1DBFF50A2069BB3C964086F3ABF4805B5A67B245F031E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997651, "uuid": "8fb680d9-e86c-4d37-b25d-ebd0c3eca86b", "value": "768:41GUWC15pvl20y2sJ6miifV3cVLDjwnbcuyD7Uiyq2:oTv+FJ6miSVEDjwnouy8Zq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1689997651, "uuid": "476d8c8a-f10f-4f8e-a343-ad17eecb3be5", "value": 33288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1689997651, "uuid": "7cc99f34-5470-4761-af75-b6501a210dbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1689997651, "uuid": "253f4d79-b145-4a19-893f-bc2ec57b99c4", "value": "d0b8819d0cc210145dd699850fd460d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }