{ "Event": { "published": true, "date": "2023-12-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-12-18", "timestamp": 1702944181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "eff7b50f-cd0d-4900-a646-3b8faef8ff73", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846854b3-9d3a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702858515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702858515, "uuid": "0b25152d-dc5f-4104-8300-da9d6974db16", "comment": "Malware payload (RedLineStealer)", "value": "6c36f21de5c193646f3a63a8f44eff6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702858515, "uuid": "3f406f58-316b-499e-85f5-560dd2eda45c", "comment": "Malware payload (RedLineStealer)", "value": "01497dea122f92d36b4e0ae4eade31511b2db302e6f7f87a695e817065834281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702858515, "uuid": "9f2e95be-1cbf-43a0-9d10-43d548675d0a", "comment": "Malware payload (RedLineStealer)", "value": "269e45e860ed40e7fcb1de9f7a0118493de77b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702858515, "uuid": "9fa592a9-d070-4118-a0f1-7faaa8b24578", "comment": "Malware payload (RedLineStealer)", "value": "cdfcda41bb6610404626334c4b100be1cfd5c4cf92c63a6202fb5fd53f00b89b3471806c650eeadd1bb3e1fef0c35f8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702858515, "uuid": "64c3d60a-adee-4a93-98bf-841114dd5d4d", "value": "T1AD063353B3E160E9D8E52F7008F7436B2B22A59A1878C79B34976D990CF2690297437F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702858515, "uuid": "155d94b1-58d5-4a62-8ed9-87190f933eaf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702858515, "uuid": "2d518f75-59eb-4aed-98cc-867cae21dc93", "value": "98304:LBq9McpKSkVkUluJE1va2P1SUHCeNyem8TbPMQEqExd0:2Mcppa++a2PF5yem+bPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702858515, "uuid": "2640832f-2d0c-4629-a575-b5c0472df529", "value": 3778048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702858515, "uuid": "31e1d075-fb98-40bc-85c8-43471480fc3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702858515, "uuid": "e43723a5-74c5-4677-af82-774ba14bce4a", "value": "6c36f21de5c193646f3a63a8f44eff6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc967863-9d70-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702881828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881828, "uuid": "caa78dae-9081-49c4-9afd-d48072b3b334", "comment": "Malware payload (Formbook)", "value": "df17b50036873f8f633a4556bc6b4c04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881828, "uuid": "d5379748-848e-44d1-aed8-6bac327d66ff", "comment": "Malware payload (Formbook)", "value": "0270f3ff7e3cfcb914e58ad2f0528d86a48d07d695dbd4a9a95d27cc93f75581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881828, "uuid": "20899050-f697-4529-9ba6-0a439a2b4b45", "comment": "Malware payload (Formbook)", "value": "4fc82686427bdce4b4ec79e9409aa6c8b673be53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881828, "uuid": "b7305520-0183-4ae0-abe5-bcec99b8afef", "comment": "Malware payload (Formbook)", "value": "71b64937420cbf59182d4c3ac0f2f98220a81d0087c456518bfb760a3e803aa6280a07eb40dadfed55514d206b36fae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881828, "uuid": "2240a5c5-046c-4c04-8d71-d614877f886a", "value": "T128822913B56D4B22E529C73EC49BD5523334E6012F03C64AB47B1F873D633AEE946265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881828, "uuid": "57cb5afc-6635-40f9-a79d-48add66dcefd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881828, "uuid": "98226809-69e1-449e-814d-9a019772eecc", "value": "384:chH4KB0Via9CWPK+hEWMtG2vbKuXKD7gNr9GNR6nZ09re8:m3BAfzOg2xaDo4cny9re8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702881828, "uuid": "813199e6-a3e0-4d07-a431-247b9a4d6a72", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702881828, "uuid": "dde871cf-d7fa-41c5-92e6-eb744f494c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881828, "uuid": "9c7f9bb4-524a-400b-8bb6-77f19b36ffe4", "value": "Swift Copy pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7cdc7f-9d64-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1702876518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702876518, "uuid": "87dd877e-d2ef-466f-85b1-b2804ead903e", "comment": "Malware payload (DCRat)", "value": "b0804a51ce2a1c55bb3a12e75e14c33d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702876518, "uuid": "af698981-2bc3-48ad-b51d-c57ba67aeead", "comment": "Malware payload (DCRat)", "value": "05cbc7fb269ecdc757ccd48938f19c93b736fc33eb9e65b7a9c1a788b75ee6c7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702876518, "uuid": "a8cfcef1-63d7-489c-a356-438c2d4cdfe7", "comment": "Malware payload (DCRat)", "value": "8dacb6bf85464bf45b3f50308c7fe0ecddc7186e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702876518, "uuid": "f611660b-1219-4f7e-b34c-233215427ac5", "comment": "Malware payload (DCRat)", "value": "2bcc37e3738fc4523bf0cf58dfba26e1fce5323e9748b7c5f0e6e90ecc964e5c2d8c8b17d8b36eaf808a16242522fa57", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702876518, "uuid": "ab43fb7d-55eb-4651-8f70-41d30adcdbc4", "value": "T1D216F103AA918E33C1B43F36D4D7102E52B5D7A52622EF5B362E21D5B94A171CB1B2F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702876518, "uuid": "092ea45b-7626-42d4-8fa7-44895887473f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702876518, "uuid": "2e559ae6-cb41-4264-940c-8aaf19de159c", "value": "98304:y/gtCE1kIJDvbupFwJK4mVU8b5pp+yCJY76iW:9tjjGuJK4mV39pp+3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702876518, "uuid": "f37a5211-6053-442b-ae6a-a7b855add0a6", "value": 4283685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702876518, "uuid": "a3b8da70-7e95-46ab-86f4-302b09b85283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702876518, "uuid": "6c721d10-027a-449a-a050-1c5c18d34f6f", "value": "b0804a51ce2a1c55bb3a12e75e14c33d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533258da-9dc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702919850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919850, "uuid": "548ac9c1-19d9-4582-ac06-a18b30ca328d", "comment": "Malware payload (Formbook)", "value": "eea5a59ef6ef5fb0b97e7b90cb861c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919850, "uuid": "2f0bc30b-4b5d-4aa2-9305-7625f21b8c5e", "comment": "Malware payload (Formbook)", "value": "06e11a74aa70baafdd097bf296ce99ec183393a39f4b9b6818ef11d1d41875ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919850, "uuid": "39a79734-6940-4f19-83ee-b36251118dc5", "comment": "Malware payload (Formbook)", "value": "150445df55b90c9ba96c8eae2b05eecd3c4bf257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919850, "uuid": "b44d0ad8-dc07-43b1-8d50-da68dd01b89f", "comment": "Malware payload (Formbook)", "value": "b59145f716a2b7ac0b6bcbfc0167457de259f3c7a5477c196d34cb372b59a9ca69928b018a773074f30eab650d4177b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919850, "uuid": "bc77af2a-79da-436d-b831-f8ab11e52adc", "value": "T10325C33C58BD2237D6B5C3A58ADC8427F25CA46F3151ED6598DA93E203C6F4278D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919850, "uuid": "40428e80-108b-4672-a4e5-de5f89aeb8a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919850, "uuid": "a5ea2777-5860-4de5-b9a4-d2e129359a49", "value": "12288:TGXDY6t60JcOY+nsEQnu6HCjSsZWvi6p/BZuqFBYmcCMSN8GlJGsJcdyUSHR7wC7:6zo0Nsdal8vigOSNzg2coUsR7Nkyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919850, "uuid": "aef05c25-c9c7-4fb6-9b74-1c837a593af6", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919850, "uuid": "95e58f04-9bc1-4d5a-a76b-a65fd24f2a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919850, "uuid": "bbda2b55-6dc5-426b-a0a0-fb3ecc78f435", "value": "0034687790905 -SwiftAdvice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a79bb67-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702889448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889448, "uuid": "916c1eee-3a5f-440e-acc7-e6c5a4ec53c5", "comment": "Malware payload", "value": "4fd90160fa09d3178c554ce41087a4be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889448, "uuid": "8777461e-c918-4dc7-977a-4b4c1b6c5a82", "comment": "Malware payload", "value": "07d63e6a3c51e232cfab6333b4aec5699a58c3b1a6e397d9619d159f78980d85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889448, "uuid": "1d894ca7-c7c1-48cc-82f8-54ee1837a98b", "comment": "Malware payload", "value": "4a2fd7e4eabe15af0a3722569e12e161a685c000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889448, "uuid": "e351cf6a-9a67-477e-a0d1-07239dc35165", "comment": "Malware payload", "value": "c1a5970650941fa5923a9134695c8eded311f8ad318e3131c98f3c24b8d42361be5d0dcca85a68ee164efea68ea72d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889448, "uuid": "9cd7d9e0-4a7e-4c66-8250-e58fb504691e", "value": "T17E149D72BFDBD827E0121978A796DA1CAE74EE149609D303E3B039AD953B2125C16D33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889448, "uuid": "928f21ea-ee8e-4bf2-9911-bee748c2a169", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889448, "uuid": "ef1a0ce2-c398-4687-8b40-9655688563bd", "value": "3072:jKWAjRhRiKunPytqwHHBjv1JAt/UV2GEVI9YwlfMB5b:jUjRSHPytJhjdit/UXX9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889448, "uuid": "eadd927e-32e3-40f1-9cc9-b78f89a7d33c", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889448, "uuid": "13df22f6-4551-4c56-85c0-27b76255fdb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889448, "uuid": "5348be8c-7687-4c2f-8f15-c71b2751839f", "value": "07d63e6a3c51e232cfab6333b4aec5699a58c3b1a6e397d9619d159f78980d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d5b5fd-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889496, "uuid": "f72ba445-2ad8-45e0-8708-126ed96a4bcb", "comment": "Malware payload (AgentTesla)", "value": "ddba01c1a3d0973e3b97aa57a8a56b25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889496, "uuid": "663f1699-6588-4209-b6f3-e7f83b0deecf", "comment": "Malware payload (AgentTesla)", "value": "088a34ad8ccb368fab0f25c6644019dfa08d52ea9c5acffdb27c74966bb68a47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889496, "uuid": "03cbcda6-e653-4962-b3d1-ab7067bb088d", "comment": "Malware payload (AgentTesla)", "value": "770e9621c5d726c1069b0105cbf671bef888d747", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889496, "uuid": "c48bcb6e-044f-4f6c-b618-db4c3fb4b424", "comment": "Malware payload (AgentTesla)", "value": "574a31d52929a017b789c57781d430cdaa8b670ee73d4506b40cc1df10b2c0fbd2755aceb337b76165830293f6b25245", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889496, "uuid": "3ee9a71f-d52c-41c8-9b30-09452f2196ca", "value": "T13FB18410A3C94737D9760BB6DD73A38202BCFB10DD5B8B5D2494560BAD66B698E32F30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889496, "uuid": "04350485-794f-4b0a-ab3b-7e71595f58cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889496, "uuid": "8d2108be-f476-4194-a994-7da0ea74a0f9", "value": "48:6rV+pjPdv9I0sOH4Xhz6uVAf3MJEWtPMlQpsVtiOlGfqFPpfbNtmG:kePY0sQfMJEWtUltI8zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889496, "uuid": "28c85773-5905-4733-b810-0e119b3d3758", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889496, "uuid": "f95bb0cc-aa8b-47fb-b55e-4f4eb87ada33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889496, "uuid": "c06298a9-9ad2-4d31-9f65-169554fc0ad9", "value": "PO199198#.PDF_______.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8951f3d-9dac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1702907672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907672, "uuid": "5c7244ab-17be-4785-81c4-a498a108d349", "comment": "Malware payload (STRRAT)", "value": "da71d774568ec966d75dc0303c5c212a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907672, "uuid": "ebe78de4-b53d-4cda-8440-28ca0c39d82f", "comment": "Malware payload (STRRAT)", "value": "0972f05cc8250416b109aec8c65503ec2d25d69778dcf36b9764a2bd79648618", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907672, "uuid": "ffebabc4-aa65-4cbe-89db-3707ae869a37", "comment": "Malware payload (STRRAT)", "value": "bb27749d3a869043a86962729f533de481d620bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907672, "uuid": "49a8b37a-37e1-4e41-bc9a-e3ba6d61a413", "comment": "Malware payload (STRRAT)", "value": "506d60d52fea0459df5dd6d384415551e0d37c031eeaeafaa879c22f1d38db8ce2604d01629ee2157ed0587690b550ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907672, "uuid": "f100a46b-82de-4a5b-9787-3daaaf19ef27", "value": "T164844BBB568EEA3AD9B0080572D7371FA160EF4E1918F85D647A1B8EFF2B7099514C0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907672, "uuid": "8dfadf03-2dc2-490f-985a-4fe870dc43c5", "value": "6144:XQrZJvDnhOVyeoTtl0DcIuP1VLJHRuBQtWQTvV07bn61NRtvyynoybw2+/Mm23iO:g7EoTrxRxtnbNr6mXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702907672, "uuid": "2d6051cd-b2b5-4623-9839-f2f8ef71a619", "value": 379105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702907672, "uuid": "8a727859-dfb6-44a4-91f8-ed9acd39ac58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907672, "uuid": "c0ef3bdb-0b3f-4834-8179-a1fc44ee939d", "value": "payload_1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d2db5f-9d92-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702896412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896412, "uuid": "99185c2a-9ef2-49df-9967-75393b9048f3", "comment": "Malware payload", "value": "3707ddf40f60a675f99762ec3b54a5cd", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896412, "uuid": "006921fb-2aba-40a8-af75-0a1187e45097", "comment": "Malware payload", "value": "0c615cafd1a4010bf90fd26246ba692743af46c8af299bdc780fd908fb560812", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896412, "uuid": "e6a5107f-6c56-4769-b3de-704b99cec2c0", "comment": "Malware payload", "value": "dd0b08e83213c25547f6c59a70ca850d4f0491c4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896412, "uuid": "85432fb2-954b-49a2-9822-62d11f73a48a", "comment": "Malware payload", "value": "cd18ecee2e8a4ccdaa464f71d9893fe8e36890c68a80c2588ab2f24fbed782809776e9bcb89ed76dc75eab9a132e33b3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896412, "uuid": "44e80504-022f-4d10-b05e-2e92e418377b", "value": "T17972D02BB1B752EA73D2123542BB4EE60B19C44FBFC5040925735A138F1CD35E27A5AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896412, "uuid": "a0b6dad1-4c87-4c23-8610-8a2e639d18f5", "value": "384:zQXvJKkIdwEwH9Me8wLmaCR4K/e5A1939ttwOILlie85fS:zQXvE/89M0LbG9iOKlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702896412, "uuid": "78450aef-c2c4-414f-b062-257d3f634090", "value": 16746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702896412, "uuid": "f0a85b34-5ed9-4775-8333-f19fc9d7eaac", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896412, "uuid": "eecbb8e4-c3dc-49fd-b443-fc2403b43783", "value": "Dunning-Notice-1016.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dee789a-9ddc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702928055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702928055, "uuid": "c4694c41-5f71-4796-ab0d-c00223b68cd5", "comment": "Malware payload", "value": "aced660097e6767c43f2c00033470b5f", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702928055, "uuid": "54a2183c-3930-4778-94e8-085ee60d4ce6", "comment": "Malware payload", "value": "0e51c4f52b63e7ce231959168dbc4270b4fa451c58e3bd2081441e7d83915361", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702928055, "uuid": "19bdb729-2246-4288-a58e-8ec09c99bef8", "comment": "Malware payload", "value": "62657c83a39b44368c1f49b103830dc0890d768e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702928055, "uuid": "fe7eeaac-05c5-43ab-b6b4-f176c970c523", "comment": "Malware payload", "value": "3f07730e08172fcd09e3515d9fa631a9dd32628daa6f116a2652f505f6f141a7778e7f6848cb5e8833ba2b94d23f0f2a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702928055, "uuid": "ff91682b-0117-45b5-9940-e45742864bd6", "value": "T1E343F1BF16E9A870C3A797F214C70E9DF29935CB865521C1F3CAB15808919A90F2E467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702928055, "uuid": "22aa876b-2cc2-4190-bfc8-bab2953e07eb", "value": "768:4XWwIM7ilBwjrJetomq5jKu4tQc1GJhA7GTE3AlWpjDeA1XqeymeJl2U3BQ/03ZP:fMml+jwtoL/R6IA9yWpjqeXVC3BccZld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702928055, "uuid": "de04a4fa-c6a6-4dad-a681-a21090f4f8eb", "value": 57091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702928055, "uuid": "96e9e218-dea1-4fed-8950-d5f0bac0100e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702928055, "uuid": "7c42ac3c-3d4c-46c1-a7cf-dccf1666f464", "value": "aced660097e6767c43f2c00033470b5f.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16150d7-9dcb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1702920921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920921, "uuid": "8f2574db-acf3-41e3-b29b-ea7e5d926603", "comment": "Malware payload (DCRat)", "value": "321b9fd745e7781ecdb39b18fe782a7c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920921, "uuid": "33993de6-b2c5-448d-8b75-cac4fd9a1c43", "comment": "Malware payload (DCRat)", "value": "0f274e72726032448709a84c712527735daa3733423baf1cb4da6871e7129036", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920921, "uuid": "f0c8ee0d-da59-4696-bb89-05db00e808c5", "comment": "Malware payload (DCRat)", "value": "5d966b4ffa0187de168f0cf1ae2afa88657e9ed1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920921, "uuid": "d7abb0b1-71ad-4ab5-937a-cd2bf5e26e49", "comment": "Malware payload (DCRat)", "value": "14270d0a80ee898d069bf3789e29f3a2ac5acdf8b101bb4a8efb12bb6c3c2d099e4aba7526b78fd03fe6ea2c73337644", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920921, "uuid": "12d2f46c-b977-46bd-81ae-cce8e9e97e25", "value": "T1CC06F1166B568E73C2993F35C5D7441D82B0CA627A52FF8B351F12D9A906230CB2B2F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920921, "uuid": "01ea98e7-a04a-4be6-bb1a-d16e84e06741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920921, "uuid": "22aeb47d-dcb7-448e-abbc-9d408c6d28dc", "value": "49152:noNe5lCKD1OK1o/21TFNqyR1piYXivtqIt2s3bDgiivqP7P8MMBV5Z1BpCceZf:nh311D1oqvV3JXivtqC2GYMTMD1BARt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920921, "uuid": "cc9bba78-d66f-48d8-9465-289469a22f17", "value": 3675648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920921, "uuid": "5facd113-d87e-4361-8743-269a460ac044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920921, "uuid": "99d2f435-7645-47f1-9f7d-0c20aa2996c5", "value": "321B9FD745E7781ECDB39B18FE782A7C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190a5f19-9dfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702941227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702941227, "uuid": "94b0fb1a-7112-4e29-9344-7d8f41b22353", "comment": "Malware payload", "value": "2e07fa6575040d59f983300bce58c9fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702941227, "uuid": "a684ca3c-0fb7-4153-8ca8-67c983c24ad9", "comment": "Malware payload", "value": "0f71b1805d7feb6830b856c5a5328d3a132af4c37fcd747d82beb0f61c77f6f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702941227, "uuid": "561251ea-81c3-4f0c-b916-bb4033cfdc3a", "comment": "Malware payload", "value": "ccf821afe70ab77762b24694f89aea8d08eaf04a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702941227, "uuid": "c46add06-abaf-403c-b6ec-c13793d0c07a", "comment": "Malware payload", "value": "b00ab611bbfad1b2c171d9ea23d9848cba0f16be59dd08df90e3884718baf3be50af958c972ae495ec42fa373e7a90c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702941227, "uuid": "40e9e39c-4d72-463e-a369-579f9eaedf8c", "value": "T1E7E35B5B73F9007BE0A7927489935A05D776BC1117609BAF03A0875A0F737D09E3EBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702941227, "uuid": "3fec92d5-bd3c-472a-a468-dbaefd55a352", "value": "e907b96b3a2773e8cd582e4019534188", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702941227, "uuid": "2d363825-fdf9-4ae0-863f-e4e601781ffe", "value": "3072:JoYulJTgA0fmTSeHmF6ffBaJ0r65GaENNC71:JYNp0fmTSyBffBKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702941227, "uuid": "e2b18a97-2aa7-4179-924e-9e2cb63177f2", "value": 146264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702941227, "uuid": "c66f1734-6012-4924-8990-32a0bbc03a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702941227, "uuid": "cfc111db-d996-4580-ba5e-d39b51ae6bf9", "value": "mimeTools.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd57622-9da7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702905188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702905188, "uuid": "d8c9144e-1ca6-4b27-8688-eff9f5ac470b", "comment": "Malware payload (Formbook)", "value": "5771e71802f16578ca575cce2f74a710", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702905188, "uuid": "5920248b-345e-4beb-bdfd-3b5d91ae5a25", "comment": "Malware payload (Formbook)", "value": "100eaca6527ae17bedec11b52f36b335b7128cabac1ab4dc56679cb1d8f181f6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702905188, "uuid": "66c492a3-2837-4805-99a0-afc4cae853fb", "comment": "Malware payload (Formbook)", "value": "dc94e0f2c55b054f4ad3a8578ae3e886240e73f8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702905188, "uuid": "8376de8f-16de-4ba1-b17e-edcc9a693925", "comment": "Malware payload (Formbook)", "value": "72b6ebdc51b1d979f58ffad08affc66730bd2ce22863443e123a921f63bf83e8efdef2ec3c2727c40fb4272040654bdd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702905188, "uuid": "8ad6e77f-5c45-4fc8-a0eb-90bd6fa16d8e", "value": "T1CEE4236A6DD26D6B40E3E74B6D60A9364E3B4F8872A10F3DA101913DE8F3205EF97D14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702905188, "uuid": "5e0cfd7f-1691-4690-b053-6d5300df433a", "value": "12288:7HVEjg4StsP3+cGZoFFoAFAlKgTbMcBAsUW1VR4JmlvDqLYYlhSleMfBcy9cUnIl:sRvRyARggW1V6mlL9lNBl9cPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702905188, "uuid": "8d81c922-e9f2-40d3-b50f-a513625eedb1", "value": 682997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702905188, "uuid": "c94a21b5-ba5e-4407-a59d-0d4fc23de5f6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702905188, "uuid": "931eff1c-4637-4f10-b190-d9e2d63f62bb", "value": "SLIP-full amount-50006654455339877322346689377782.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54b419e-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889493, "uuid": "5a2d6f67-8f8f-4355-93c3-ca807d0444f7", "comment": "Malware payload (Formbook)", "value": "099521fa325bbe1280463e5b38464301", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889493, "uuid": "c0bd9064-ff4a-4121-b43e-f5a6ff63e008", "comment": "Malware payload (Formbook)", "value": "10d4f54e3353007e0238cdfe1f380f8130b36a9d53915b78ca759561aef90ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889493, "uuid": "8c847058-447a-4d28-a6c3-cff79f75db70", "comment": "Malware payload (Formbook)", "value": "f09356846b6aa5f0f9e648051765398e17e77107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889493, "uuid": "20c066bf-e3af-4bb6-b2fe-87b081cb0a61", "comment": "Malware payload (Formbook)", "value": "dba9e4846bc66559311022907e37c3ca9f3211de72ec98df1ef2f80ab9d1941cc596b0243852f03f57b108df53567e50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889493, "uuid": "39604b28-2020-4e1d-904c-5b57c3ce6c84", "value": "T17105C052A7624966C3915B79D9BB9F000730FAA6925BD30F77CB727938173BB0E81702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889493, "uuid": "af4ef047-c02f-449c-9a21-f16646c14604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889493, "uuid": "d0fd4e81-b669-4416-8ba2-5431b737fa6c", "value": "12288:MlqYCFwNcFUYHeujdHEpLSJyFVOUrbz2ssdD3zfxT5yOj3Jy6+B0g:CNcFteCdHcLfFVO0vsRB5Z9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889493, "uuid": "b07432ca-d064-408d-8ac9-9ba300c86324", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889493, "uuid": "56edacb1-6865-453d-b7a1-0ac5910a79c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889493, "uuid": "a999c727-8d7c-41be-8ff8-d6c6caf6b572", "value": "payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e575e7-9da0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702902319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902319, "uuid": "4849590d-c843-4658-8164-f39f8b6db346", "comment": "Malware payload (LummaStealer)", "value": "b31b1bb8dd7498aba3ccda3d81b96738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902319, "uuid": "a9e886d6-304c-4e34-9023-a009f472682b", "comment": "Malware payload (LummaStealer)", "value": "113ca0c9919a99bd03a9d2399ba7ebd97c446117c2afde072e4a05c20df25e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902319, "uuid": "b33d5cfc-4153-4795-b67d-57ea114a66d1", "comment": "Malware payload (LummaStealer)", "value": "b8dad1301dead8460173c5549fecfd692a2b1fe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902319, "uuid": "1e5df00d-f21b-45b1-a55d-afedf7457167", "comment": "Malware payload (LummaStealer)", "value": "f3b24e75687f4a7662a429909b2358d37ab59277655b84c34be56d58ede020822ab367736fb87f8b0b88b86be6a1dd49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902319, "uuid": "0c363b94-3621-4020-bd5c-7778189b2753", "value": "T19454195393E13D94EA274B729E1EC6E8771FF5508F1977AA2219AE2F04B04B2C1B3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902319, "uuid": "d438e4f9-fde1-41b2-a158-656ca2072a33", "value": "e0dc07002fbf5e2ad2a1116b5c525f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902319, "uuid": "256cd99c-5b2a-4d31-8b3b-2a31cb92e20d", "value": "3072:PxepLO2nrGdZM2cp5j6Z/RFlyJSAX5d5Kzkdu8HVkO7:PxepL9rGdq2crUXlyRk+u8HV/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702902319, "uuid": "fada5f24-3083-41c1-a08a-f02360e588be", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702902319, "uuid": "59c781ed-a8b5-4542-bab0-3c065c1a03b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902319, "uuid": "15c57ab9-c389-43ea-9fb1-62c79ae84a79", "value": "b31b1bb8dd7498aba3ccda3d81b96738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb70a7d3-9dfe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702942896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942896, "uuid": "6c5a80d0-ec5d-4751-8b27-a7c52b86d1aa", "comment": "Malware payload", "value": "8c74cea39d5b57596e5eb166104f2550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942896, "uuid": "2821f7ad-3436-423a-a41f-cb6d5f9cf8d0", "comment": "Malware payload", "value": "14d6092d18c2cabd3b02465ec401c9edd107c921f97c206f551d2b7f61014062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942896, "uuid": "96b68571-734e-4bc7-99b0-32299dfe9192", "comment": "Malware payload", "value": "4c74a680912463789c30cf422960882a6b0dc3ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942896, "uuid": "02c310b0-c1fc-4a56-b6a6-03215a9a846d", "comment": "Malware payload", "value": "dc9e29429731a898987a6f1050d4b66a3acf1a591b2705b13dd719a51708e2635acc04a4bf6f0f07f4138027fbcbf41e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942896, "uuid": "3ba2a3c3-6fa5-45cc-8c07-6aad738c9c1d", "value": "T1DE24D736E304551DE87E437DB01C38B09E707CA2E16ED32F55AA7EED683BB498A144D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942896, "uuid": "ec717a1e-7f55-4a2e-97aa-ceb989adfc08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942896, "uuid": "0ad141ee-2871-4459-a34d-f0034cbe25ac", "value": "3072:TtJXRMeZYncNgckxQdxCr1d2t/q5yoQVZL53pRzzXZQAZ:TJMeucNgckedxCDo/doQVZdZRzzXZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702942896, "uuid": "00079d72-6bcb-4876-bc31-5f7c49eec8fd", "value": 228472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702942896, "uuid": "7d6f535f-c3dc-4f82-addb-1299c3e8559a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942896, "uuid": "1ea508ee-c9c0-4c0e-8c78-ae7a5993a36c", "value": "Linkboys.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1e31fb-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702880027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880027, "uuid": "45c580b2-4f29-4cb0-aa23-59dec9cac49d", "comment": "Malware payload", "value": "80701be92b6a92f8533cfb5a2739671e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880027, "uuid": "acd8f25d-c906-454e-8895-f9a1af4593d6", "comment": "Malware payload", "value": "17434be9ac1cdd39b9de4a3c8b4f5d8973d77d76f2617466ce742087fcee98c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880027, "uuid": "ec6c8451-4d59-41fe-b51f-f83a4ae2b754", "comment": "Malware payload", "value": "d0ab402435d1305a9f593e7b941a9e302530f951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880027, "uuid": "a5fcdb72-861f-4b98-b487-815417e24265", "comment": "Malware payload", "value": "f9f076e9463d203a667385305fb546726eb9d761f91f11a0777faea9ddce8c68b299aa074e9636b619c793d70e1c799f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880027, "uuid": "0167c586-7176-4cf0-bd1c-e8c916ee9e47", "value": "T138528CAD74028C93CB878B31E8939218FBB2C073171EC10B055422D6D8D1AEDEF9F989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880027, "uuid": "c10cadb5-1d3b-4e74-8c40-29f5337fe872", "value": "384:gCzE3oL4+5mYKJfSnAE/H/aCcMYzBMna1tvGO6AH4:5z0X+6JanH/nH8Ma/BbH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880027, "uuid": "fb1dc061-9ec4-4b64-891f-536b865b13bd", "value": 14114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880027, "uuid": "91cc6040-0076-4334-92be-fea1981f2aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880027, "uuid": "733bba1b-b1cd-4c27-b759-827c3a2eeebf", "value": "80701be92b6a92f8533cfb5a2739671e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08242bb2-9d6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702880210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880210, "uuid": "af78560c-12bd-49f5-8de3-019f68d9cf23", "comment": "Malware payload (GuLoader)", "value": "1ee9fc33b64c45579e21363f3816a7b4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880210, "uuid": "732136c9-3760-4099-9b73-0a9ab48dbeaa", "comment": "Malware payload (GuLoader)", "value": "17a3293a002eb2a940c7face62fccf977cd1ac97714c0c77d344c6948997a4fa", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880210, "uuid": "1ff67ede-4331-4c46-bb10-2ca3d5204968", "comment": "Malware payload (GuLoader)", "value": "d7b473e721c7ab061fadf9d004260af89eb449b5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880210, "uuid": "b08c81fc-8773-49ec-bff2-a0e7f6068f7b", "comment": "Malware payload (GuLoader)", "value": "ae539f153093fdd483643debbf5ab1856f3205f0cf9e4a0c7704f4810d20c2e35064316d1f876c7f120c080b0f1eb600", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880210, "uuid": "1baff5ff-13ba-4409-825d-5952b24abf94", "value": "T1CC34F110360CD85CE6445BF9B9F2B18E501DFDB379D5A2C76B88FB0E8836EAB910B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880210, "uuid": "afee88d7-e0cc-4311-8215-55aaeb5b5bac", "value": "6144:sOQ4YlLSmmeHZMhD6wM3XALQuENx3qqKKBjaoGKwBjN6KLuDTi:sOWQmmme6v3QLQuENx3q+BuEw6KL4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880210, "uuid": "801f5723-d966-49df-8464-aa019ea0bb38", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880210, "uuid": "03743ed2-4a71-4c84-b31d-116afbf8351d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880210, "uuid": "fee92f0f-174d-4694-8de7-462c9698fd8a", "value": "Invoices.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30f797c-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889517, "uuid": "b4944333-04a5-44de-8f79-9ab014126422", "comment": "Malware payload (AgentTesla)", "value": "bdba3ed7a520c67c07847c7236dcb23d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889517, "uuid": "997d8927-176b-4ea1-a832-33b5b5519a62", "comment": "Malware payload (AgentTesla)", "value": "18f01d88b99b13b08b54cdda4e681ac74cdd66e10b4ab500500b0d2158f4a02d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889517, "uuid": "14f79b6b-d52b-41bf-ba5f-74cdda76d137", "comment": "Malware payload (AgentTesla)", "value": "9e00f27f8c70e0a5a48f580cf10f45fa1653861e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889517, "uuid": "a18a20cd-e8fa-4201-99e4-83a2bef4d3a1", "comment": "Malware payload (AgentTesla)", "value": "53aac570aecea6bf693fd4307bc82a7f443e8e08d707ffe85a4a94f69d7ab5797d241dca26a1c7fee2dbb254f4d56deb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889517, "uuid": "46bb4399-7250-4be9-9a85-1a4a808590b9", "value": "T1EB15F15513100922C3A25774DA77BB418A11FEBB84A2D307E3DAB579B2371BF2FA0752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889517, "uuid": "a458ca89-d696-4da3-84f3-e395980a1df1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889517, "uuid": "ac653b0f-36df-4d86-89a2-5e9efdd5ab4c", "value": "12288:jM793kDd5eoznGHI3mfacly7y5GGXFR3Te5hB5OqVH8hJRCbRnGqacYBHsgCLkVY:l3bQRyO5GGXr3fxpCbRfwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889517, "uuid": "3d3e1bd5-d728-422a-898e-98f1c50d03a5", "value": 896560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889517, "uuid": "e7d57c93-90f2-4f0d-9697-1d80907520b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889517, "uuid": "0f999513-362e-4915-8cf3-d42d4bb66466", "value": "WIRE TRANSFER INFORMATION.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d16283-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873259, "uuid": "5c373909-f58c-4001-a901-a396819e423e", "comment": "Malware payload (Socks5Systemz)", "value": "9e0bd325ece3fd4ce2ba025ce71eee8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873259, "uuid": "8fe0e8bf-a9f9-4293-838d-086c176f2534", "comment": "Malware payload (Socks5Systemz)", "value": "19ca682d74b751f67db5f15c3e0f2a715c906a54d6196c50f4ed63d6cb8320c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873259, "uuid": "7d23fc4a-4983-49b7-a446-22aa6f547300", "comment": "Malware payload (Socks5Systemz)", "value": "907c36693624896776a42295ec5f7305e1d3b748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873259, "uuid": "9735ed14-604c-40ef-81a9-fce8dc818724", "comment": "Malware payload (Socks5Systemz)", "value": "392c1fcd5e8944265d75b30bba0ba573e2a7e924622ddd01b56d9999a88c9d77d7d5188499a5f41aa3cc6cf4d89be1de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873259, "uuid": "a2d5aa79-23db-4efa-9dcb-5dc25ce0283a", "value": "T19166331C84104D64D390AD3EAC36BA67DFBB3E698A350D20BD14D2FD46EB07D958AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873259, "uuid": "e8d2f7a7-dcb8-4e5b-97a6-8300a6da5943", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873259, "uuid": "9247d94e-fadf-437a-8a99-0f9cb6f6ac93", "value": "98304:aSPB0eTXOYDXPIGK1GZcFad2F1B5Kn4gi8FGVZ6wD2isox3HJsAkzGi7ppmA:DzT++TK86EeMLGLD2A3pshtpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873259, "uuid": "5e57ca2f-8d2a-46a0-9901-b7db4385f937", "value": 6765329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873259, "uuid": "01ffe444-dc1f-4458-8c41-bddefe338ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873259, "uuid": "b700b766-aa5c-4e4b-a6ac-d09b887dfb52", "value": "SecuriteInfo.com.Trojan.Siggen22.40889.32699.17687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b551a28-9dcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702921528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921528, "uuid": "99abba0e-8e75-4f69-a846-7bde33f2c1c9", "comment": "Malware payload (LummaStealer)", "value": "9c37ee4fd104dfce6626555136fbc268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921528, "uuid": "cef253d3-01d7-4872-b702-a980027dc819", "comment": "Malware payload (LummaStealer)", "value": "1c41dc6093407534913fb174e52d0454b0c8a9daf7e85aa6db0401bbe80d3b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921528, "uuid": "d98fe03d-53a4-4d15-b976-f0bd33216561", "comment": "Malware payload (LummaStealer)", "value": "1dc5d8973063537475abacb93ecde312eb9f5f09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921528, "uuid": "cbeb5d02-2f8b-4a2c-81d7-c89cba199341", "comment": "Malware payload (LummaStealer)", "value": "ec4e51757fbf41cf6320a26edee229a1b89785398b065e27b487b9b54916a242f279ceb1975cfc6a05e910afae9f302f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921528, "uuid": "b5a19b0b-87ab-476e-ab77-c4f3b0c382ca", "value": "T1E0542A1392E17F54EA264B729E1EC6E8B7DEF5508F09376A2219EE1F04B05B2C1B3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921528, "uuid": "6313d786-4ed1-4f70-955e-e860aa3a1c62", "value": "0cdd41052ceddd62a82a26620e6f1cda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921528, "uuid": "bf6766df-2fa3-492e-ab6e-a08672675261", "value": "3072:uLfgEAZejQ9cHx1sh+CQaIhQgq5ebD0HD9tJ/IJaAXp5+4du8HVkO7:uLYdMjQ2R1sh+C+odHHJQJPqmu8HV/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921528, "uuid": "6e4fdb24-4250-43b2-885c-fe81794de4db", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921528, "uuid": "3dfa4438-5618-4269-a065-137b061bb18e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921528, "uuid": "93ee26dd-460a-4389-801f-418cd253f2aa", "value": "9c37ee4fd104dfce6626555136fbc268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c57ff1-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1702925579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925579, "uuid": "1372641b-b0b8-40e0-a27b-c876ff45534a", "comment": "Malware payload (XWorm)", "value": "9bbd5bcf685508b2f4e703ecdcf74394", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925579, "uuid": "a0097e69-97b5-42a0-b4e6-9a6dad190fbf", "comment": "Malware payload (XWorm)", "value": "1f4d563b1fe38167cd853b5d29ed0c303b30eb2a45aae276bb1e7c2e9729fa90", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925579, "uuid": "276b277b-9873-4228-a496-ad4d41146453", "comment": "Malware payload (XWorm)", "value": "573dfa20521651b9b0608f0e9c842d6b9512513c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925579, "uuid": "8f808af7-72a5-4347-8bc8-3a7c7ae11ffb", "comment": "Malware payload (XWorm)", "value": "893f89be8c38478a8e4ce22baf719fde5db5d1a67584edcedda1e715107029bd5c3f6da9fefe856f8795aa44bb8f9273", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925579, "uuid": "36b4556b-3f17-4c31-be11-f126a7bafd02", "value": "T141115B1175F7A00432B7FD952BF574E34643B370295DE6AEA3080B4E8151C54DCA7AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925579, "uuid": "a80b693a-9390-49a0-be6f-60ef5cb110f4", "value": "24:QmbAeZPsHo8Y22o8YH6veZPZo8Y14ZXdLMnwo8YDTef8fKZXdLMSv:3rEI85J8Ns+8a4ZXdLk8nf8fKZXdLBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925579, "uuid": "0cb25821-38b1-4955-bdae-a85ed633385e", "value": 1080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925579, "uuid": "d7304371-7157-4cdd-866e-f135a96a78f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925579, "uuid": "324f64b1-dd3a-4ce0-af32-3c01906347c4", "value": "IMG44825426.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa36e2f4-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702908829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908829, "uuid": "fa229edd-c706-4670-8302-2b892015fadc", "comment": "Malware payload (AgentTesla)", "value": "7e4e23d4602c380e31d9b7df4926a9e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908829, "uuid": "43a1ff59-4d8b-4092-87c9-2130fda1c4b9", "comment": "Malware payload (AgentTesla)", "value": "21a19482c7a1a678d0797850431815d7778aaf3c76218e154cd36f13062e378a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908829, "uuid": "cb33f94c-715d-4f8c-852e-1de59ccd0ad2", "comment": "Malware payload (AgentTesla)", "value": "c307c39832a51b5d271230ef5456ef1b1b31b756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908829, "uuid": "2744c098-a968-445e-af47-b9d78d09d725", "comment": "Malware payload (AgentTesla)", "value": "cb51cb2611ddf0ee1da1676b049f0d57f0ea5535b09cc7c9ee78c181412a3f47827818cab1f0f4977a04d7257f4790ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908829, "uuid": "78551914-5d56-4c29-bb38-edea9b7c46eb", "value": "T17205D33C49BE223BD6B5C6B5CBEC8827F01CA46F3150AD6594DBC36653C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908829, "uuid": "8b32c159-9686-4953-a620-4c53f1d1781d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908829, "uuid": "714edbb8-82bc-4816-8cbe-9e2aa0065fa9", "value": "12288:QTwEx2iNE2xVzAEctO70Zty1iZRJi/AR8Yl2mCwypoyiF0YvC:0wk1OqzAjvZtyyJgM8m2IRiYvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908829, "uuid": "6117e7e7-f189-490a-bf77-0fcd37f0aef1", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908829, "uuid": "26f87470-d246-4e41-8e26-458943d3583e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908829, "uuid": "ca3beade-21b7-4827-bec6-e90863f95ce2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a230a2-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702880069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880069, "uuid": "f406f3b8-296f-4d27-8b83-10c89af48531", "comment": "Malware payload (Smoke Loader)", "value": "5a23b783637c7131a98ea1fd9fe1af81", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880069, "uuid": "51839517-056d-4fa3-8445-3014d398db9a", "comment": "Malware payload (Smoke Loader)", "value": "24789eb31376a14ad283f459600d684d473a8637ae544feeefd774010d777b5c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880069, "uuid": "1a01a969-db7e-44ab-845d-a386498952fd", "comment": "Malware payload (Smoke Loader)", "value": "389a0d8a356c4e6d820017c3a701e1fd3a9ed9bf", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880069, "uuid": "7f3fea5e-6912-4eae-baec-143c29c4dd95", "comment": "Malware payload (Smoke Loader)", "value": "71b3a19577c5202ce6f93657143c9a696334c2d49ca101e1237d6e9ad81f93fa9ac7e187d16076dc9881313b284afdc1", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880069, "uuid": "e01fd87a-763e-45fa-bc50-58be84dcfb57", "value": "T1B444AF1232E08471E1236A354D65C7B46B2BBCA69F666ECF2BC91A7E0F345D1C77130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880069, "uuid": "76a408b9-0089-428d-8b38-51f344531c8d", "value": "5e8686e70ea4bdd5e81bbb9e77bbf42d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880069, "uuid": "0a04aae5-7b0b-475b-9b37-27dd5d5c95ab", "value": "3072:SAM/6CbtIsOT9FJfMcoKQ9GPCe6yT6DEOAJ0t7t2cbge05n/7yUiISAIfy1VX:imfeKn9TVOAJ0xBbg75TRu7f+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880069, "uuid": "8c8573cb-ffbe-486f-b8a6-e784f9fab25d", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880069, "uuid": "facbd0a0-d19f-4eea-83d7-2b01a7f783e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880069, "uuid": "cea107dc-1471-41cb-8c73-eaa7a61b0135", "value": "5a23b783637c7131a98ea1fd9fe1af81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3604f68d-9da7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702905198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702905198, "uuid": "cb620748-3d70-48e7-b7e4-480cb9da4147", "comment": "Malware payload (Formbook)", "value": "98eac33b44f2c461bc2c680dfecf3745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702905198, "uuid": "eebf74da-5c23-48d8-ba3d-8517546dea1b", "comment": "Malware payload (Formbook)", "value": "24ba94ab2486ed9bbac37e3fb3508b6bb38ec8bafe1c0816719351e0790a21f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702905198, "uuid": "97f11560-f727-4800-a167-b40f81e4c4dc", "comment": "Malware payload (Formbook)", "value": "d311bf6063bb8de4c972b210a005832a1353f8e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702905198, "uuid": "c7ffea3e-10b6-41a4-9135-bc6d78ff8338", "comment": "Malware payload (Formbook)", "value": "dbbb88d3ec8b7e29568e4208f3fdb8e5f9127ac6c02a74f6793e25687a404eec6c837b0580eaffdebfc10b0663bcf194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702905198, "uuid": "c0808393-03fd-45f8-bbaa-95bb395301d6", "value": "T15D25C33C587D2237D5B5C7A58BDC8427F25CA46F3151ED6588DA93E603CAE4238E322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702905198, "uuid": "62ded345-41ab-4e28-8c7e-99e13a387e48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702905198, "uuid": "779af8fb-3c3b-466f-853f-eebe03182497", "value": "12288:jGXDY6t+RS4iHHx70BKUHXPZnK1Ic00xBkQk8p2jGZ8qsDIA0n99J:Kz14WHx70X/IDCB8/s0A0n99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702905198, "uuid": "0ed01201-7b0a-497d-b152-ee39311f3f6c", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702905198, "uuid": "9cd98611-f305-4b2b-a0bc-9a33dd8ba9ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702905198, "uuid": "cf3d4ea5-5156-499e-81c9-1d8dc9690165", "value": "SLIP-full amount-50006654455339877322346689377782.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d866d10-9dcf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1702922337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702922337, "uuid": "56dc67da-d118-443b-af61-c8db67f93324", "comment": "Malware payload (Pikabot)", "value": "4c1533a5a7e594c0db847f6140d99614", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702922337, "uuid": "d3fb3921-57a6-453c-8c68-2fc0ffc0a6e0", "comment": "Malware payload (Pikabot)", "value": "266e982351ed00f0eacab6814ad2e0f027cbee12745f5ff8ed8f22646634ee55", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702922337, "uuid": "9e959587-9b47-45f1-814d-1c002d995557", "comment": "Malware payload (Pikabot)", "value": "139708cc0c2dcc92df3d6bc8500209a7b0a0dc0c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702922337, "uuid": "6a6ed2ba-e4a1-419c-96ad-af998496e1a4", "comment": "Malware payload (Pikabot)", "value": "21bd1835cddfa8824dafb374dc3996edd94f8ffac5e99586df51067cab174199198019bf74a746d1dfd04df28aeaf150", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702922337, "uuid": "2e641e83-202f-4fd8-a5d7-97dd45b40706", "value": "T1A575BF11B7B2C079C9CB46308A39A7B500F4AF1ECA2068C77790BE5F6F36CD6D225959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702922337, "uuid": "b7750406-44d1-435b-8fda-01e7382e7d56", "value": "49152:dv8Uu7k9SFryQ3LZ/grnyZbAJDoNnOnAM9ThwM65XqYJ:dv7u7kcFrXLEJv79V6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702922337, "uuid": "7e1942d2-3123-46c9-b8c6-0fdd1efcc49e", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702922337, "uuid": "fca5e5dc-fe7c-4a92-8127-9bd319d38135", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702922337, "uuid": "c982f4f7-1410-41fc-ac3c-abb05f532d0d", "value": "Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87015ff-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1702880157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880157, "uuid": "8dbb77cd-ac1b-4f12-9880-68fb74ed5886", "comment": "Malware payload (Tofsee)", "value": "bb0693796c43e3b4954321a201c124a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880157, "uuid": "9d5df7e6-5b94-420e-88c3-b7d93e894608", "comment": "Malware payload (Tofsee)", "value": "26cf1fb6045f798cb624956dd361b97ea3dff8b950911008dfb5522df4059924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880157, "uuid": "5e208d7c-069b-4b1b-a0df-a039011748e4", "comment": "Malware payload (Tofsee)", "value": "5066abedd5fd1aebc207a056b1a2af7d7999d583", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880157, "uuid": "96e92bd1-ab29-4986-8801-dee072199383", "comment": "Malware payload (Tofsee)", "value": "6b08e38ffee7d2eae6afbd9e2d5e99f26ed2dd8164b9c8d9deb07e7da8c9c5fa6bf1237c543ffcc4812ce5b30178c637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880157, "uuid": "ac0aef44-948e-4fd2-8420-da55a2f3f7da", "value": "T1C524AE12B3D19872F12386364F29C3E5AA3BF8718F557ACB27994A6F0E711D1CA71342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880157, "uuid": "38445a81-86f5-4a43-a329-34d756290a50", "value": "d24c1e0e105697365c36bc6ecfcdbd9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880157, "uuid": "d1f1d3cb-381a-475a-8446-4cb4c5b91344", "value": "3072:EwJsPvd045hJkKkuW0MwA05h4TAQ2Jcx/MLm1nHvBQVy/eLWc8:gu45TkT0G2SLHvsae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880157, "uuid": "a46a1f8b-afb3-4919-a299-68c4c6d4663c", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880157, "uuid": "f2fb43b2-d65d-45f9-acb8-062c90ae0795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880157, "uuid": "8a48eecc-38af-4a54-a77f-f3a690337b88", "value": "bb0693796c43e3b4954321a201c124a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08487b3-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702908813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908813, "uuid": "eaa37047-489a-46b8-b874-187d4f720062", "comment": "Malware payload (AgentTesla)", "value": "d6e64c19995d496ccd587653d5d44c87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908813, "uuid": "4b1b5041-132f-4727-9527-0b5281c63bed", "comment": "Malware payload (AgentTesla)", "value": "272438e4a90035c1ab4ff8a0ccdfc3a4c3364e59963abc2c74ade2b0d56c066e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908813, "uuid": "bd111e53-d3aa-4835-b6eb-21aeb07aafa9", "comment": "Malware payload (AgentTesla)", "value": "3d4db6addee1360aff7512d54c58a87879a3a77b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908813, "uuid": "d447032a-2c46-4f76-8763-6b1a90e792be", "comment": "Malware payload (AgentTesla)", "value": "0e143b18e426dfebd53b79eb02f5b071908aadd55f209639693d2b14ea95479f35f0b2a0f28426bfb7799f4c3ca7c364", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908813, "uuid": "c2882033-20ca-4f04-a90f-107ce46686e5", "value": "T12CF4236B39663C05C384AD3015330F2BA776FDD45CAEB02B6AC961A55B2D94CFE312E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908813, "uuid": "775b9828-179a-4bfa-ad11-d9aefaf05ce5", "value": "12288:IWvqLy3gRBMP+R3aofF/Ay+XSfJYPN9usD8W/SCnXYt2BhY5PQ0WBuIqmuDXdMNY:XvOogRBM+R3DfGtXAYCQ/SQePjeUFDNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908813, "uuid": "a6a19f61-d78f-4e1d-8df2-e6d61c1d4188", "value": 742022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908813, "uuid": "0903340c-260a-451a-9415-4268503e6b1e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908813, "uuid": "0bae28b7-44e6-49b0-88b1-3fafd9282db4", "value": "AWB #150322.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d268553-9dca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702920189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920189, "uuid": "16d8ecb9-2a84-42c7-bfc9-62de2e550775", "comment": "Malware payload (AgentTesla)", "value": "aab50503e67a9a25d0337cb9f2251704", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920189, "uuid": "76f8b475-b691-4216-b610-b4a9aa55f5cd", "comment": "Malware payload (AgentTesla)", "value": "289fdeca4e918db13a5b5bc5f46d377877542b3c3c534859f7dab8ecc088f93d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920189, "uuid": "ac14b88b-1a51-4ac1-a0fa-46f0951cec19", "comment": "Malware payload (AgentTesla)", "value": "df4db134a4550d7d11aa02ea8e3e2497eac8f397", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920189, "uuid": "3c23babb-a235-4d80-b7d2-6d5708ae6d6b", "comment": "Malware payload (AgentTesla)", "value": "68717a17ee253d2689bade7dc862320cdfc335b0d96d0757062701dec952f6d996bcae9708720d03f5d453b1f2d70d3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920189, "uuid": "ecfbd92a-2165-4f33-a999-9734c8dd73e2", "value": "T12A15B23C58BD2237D5B5C7A58ADC4427F26CA46F3151ED6598DA93E203C6F4238E322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920189, "uuid": "140fcf29-0eac-4f6a-8f9d-7cd779ecaac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920189, "uuid": "9dcc4675-1abb-42a2-9728-23c0288b4041", "value": "12288:bGXDY6tGdWCP/0AXfAOzROtyrvJr/UIutucCYqHFF0HkkJ5yz17la/:yzcdJpPt7JXdz0Ekyzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920189, "uuid": "e770e0be-52b2-4ed9-a66a-66ea9b1030e9", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920189, "uuid": "4f9afe54-226a-4c7a-ba92-e55c0ded9345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920189, "uuid": "08b6a400-4b12-4c04-8101-513e4fe5d797", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a4227e-9dc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1702919180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919180, "uuid": "7bb720f0-bddb-40e9-b3ce-fb2d8ad5b6ec", "comment": "Malware payload (Pikabot)", "value": "97dc5b3d2163f4c2c256ebfa945ce20b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919180, "uuid": "fe3acb3b-ca82-42a5-8c03-1fcd043b562f", "comment": "Malware payload (Pikabot)", "value": "294644f81aca69b6cc734500b07a2e0ed1129aa5ee370785daae520961fe77c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919180, "uuid": "b6974fad-d9bb-4ea0-8453-a458e3f8a3fe", "comment": "Malware payload (Pikabot)", "value": "1adec3fb965a8dfbaafd8d46dbda373e6d312a1f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919180, "uuid": "76d8162a-2251-4870-8610-4573bbd7f70c", "comment": "Malware payload (Pikabot)", "value": "1182925a6e0022319a7a7eb3e1cb60e24a19188eb47739e75aa46733d8c9e2efd21ac34264e4937e51090bdd56f1bcaf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919180, "uuid": "08ae86ce-ace4-4d2a-9527-476d65c562a0", "value": "T1DE75BF14F7F2C074C689C6308B28ABF541E9A71ECA1168C767C0FE5E6F31CD9D229A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919180, "uuid": "51f01dfc-2744-467e-87ab-b89b97d9e2d6", "value": "37deedb4784101f901de7ee8fdfb81d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919180, "uuid": "68cc6057-1838-4e9a-9a15-ea476b5730fd", "value": "49152:/18UuLk9SFryQ3LZ/grnyZbAJwn2p51hW0XqY:/17uLkcFrXLEJ+2p5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919180, "uuid": "659f3de0-9703-4707-979d-3367336cadaa", "value": 1612288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919180, "uuid": "643b0de5-a4a2-4a19-a36b-f7935027f0ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919180, "uuid": "d68aeaab-b644-465d-8178-fbc3a5487f26", "value": "tenetur.w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240369e5-9dde-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702928790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702928790, "uuid": "25b1fa36-e8b5-441e-8a5c-b1876b0e8627", "comment": "Malware payload (RemcosRAT)", "value": "88aa7a12dbafa9f2d059943a7e112ac3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702928790, "uuid": "963051af-057a-4634-9bfa-d122bb23da56", "comment": "Malware payload (RemcosRAT)", "value": "2adb13c507ff82c0c2d9023814380ebd0f6b44aa65421a9e57459a6cd9b9fcb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702928790, "uuid": "b5ecfcc5-3516-47fe-9754-bb3f9fc5fef2", "comment": "Malware payload (RemcosRAT)", "value": "b6186445b5113477ca94283ff879d4a9401f882f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702928790, "uuid": "4b8c2cd0-3681-4fb1-91d7-5e43c2350d67", "comment": "Malware payload (RemcosRAT)", "value": "fe2da6e2d1a887a6acd4c25795c203dd3c118ed1d7e5134a9a483bfd389dc311ab940fc1fd7ced7e96001a096277c305", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702928790, "uuid": "4874093f-da63-4eda-b539-fbceca8c4912", "value": "T10F74121974C0D4A7DA878EB11C724F66E625EE6F432DBE8377215B6F3637683A481083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702928790, "uuid": "db024dfd-9927-4db6-a8c0-fa7533b5bf6e", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702928790, "uuid": "9178ca39-aec2-4287-beae-debb52e894be", "value": "6144:bhjmbFoOFty6YwJ1mkGQZGYnHkVuRaAkWG4NE/BlzAYnJzpRX3sbbovAvmw20Czu:cFoOFtykvxGYRaN34OLkYnJzpRQFmlpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702928790, "uuid": "10459ee0-ff1c-4686-a95e-b120f55bddf2", "value": 363398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702928790, "uuid": "26135f52-387a-4e8c-be63-14ab73cf4efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702928790, "uuid": "31fbfb7e-82ae-4115-9eff-7f3e35900064", "value": "88aa7a12dbafa9f2d059943a7e112ac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53457699-9db0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702909113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909113, "uuid": "27bd104f-a2f5-40dd-b1b7-ec4713d14d3c", "comment": "Malware payload (Formbook)", "value": "186d387078492b46bfea7e18f6249bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909113, "uuid": "edf5c6a8-647a-4210-80f9-41bc098eab62", "comment": "Malware payload (Formbook)", "value": "2d8e5e551e4d81cbe1bbaed9787cee95e554c133c746ba2de3fdd080e7817720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909113, "uuid": "1a7afae9-c8a1-4dc7-8728-6560926a9b38", "comment": "Malware payload (Formbook)", "value": "e36cdb84c7d8d145e648302046660cbfec78afb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909113, "uuid": "7ce32335-fe44-457f-90b1-63addbc52d6f", "comment": "Malware payload (Formbook)", "value": "a24a427069fd9a40938bc30b3a9d2d1dd0cd75beb266badf79dd10edd20cf7088d6753f8b16a21bb22168817549ff1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909113, "uuid": "e394e15c-9261-47e9-9083-927d5922eeb1", "value": "T1F105D23C49BE223B96B5C695CBEC8827F05CA46F3150AD7594DBC3A643C6D4278E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909113, "uuid": "33967317-5c5b-4d8e-abee-768940614aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909113, "uuid": "32397869-9344-4364-973a-1f4dbbe6135f", "value": "12288:tJrclXWcelRSVwdp4vt1WTZ7Tk4HB66dYOgtTUgp:1+w7W/4h6Sna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702909113, "uuid": "9e048d9d-e93d-4fc9-af5a-3ad18744a7b2", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702909113, "uuid": "f42b01a3-9190-4eee-8efa-17aba5a7acd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909113, "uuid": "aac67b06-417b-4ec6-8d93-673b26a5b8be", "value": "img-new-items-to-purchase-our-company-profile-Req-8896HTTM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cffc49b-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889453, "uuid": "836d4aac-b306-441a-8da0-6011724db3ac", "comment": "Malware payload (Formbook)", "value": "0be955f3116ed10f689cd7fa1e83cd99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889453, "uuid": "f05ea2d3-1fe0-43b5-b0b4-ac8bd0c5009f", "comment": "Malware payload (Formbook)", "value": "30c9ea4f3a251895e25fb7366c0b58dbf3039b06ad461ad59d08f402b00f8a96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889453, "uuid": "75151434-002d-41b2-b035-9a3f5dea5d78", "comment": "Malware payload (Formbook)", "value": "836a81e87637f5fbe9480f9ab3611badb7def391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889453, "uuid": "8993f14a-3ca1-4fd3-ad21-86881a049e00", "comment": "Malware payload (Formbook)", "value": "c28d457e582e51d634a732637813484fa248fca5f8e2d7665872c6bac73cf9ba5dbd3c0dbed38bc91116ef0641c4504d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889453, "uuid": "3e137934-7a37-43c4-8a38-840237efce0d", "value": "T16E3423321A400122E66E92B8369F3B9C24265FAFAF5053414AD91AE6D428DED73DCB17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889453, "uuid": "a111b65b-c57e-4f3f-add4-8ec1dfb13b65", "value": "6144:uXb935MhRqGvL0kjNcdtXMdP98axOZXcL:kx5MC+L0kjNcdtXk0Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889453, "uuid": "9ae234ca-0722-4171-b490-2ae76d991b56", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889453, "uuid": "c0afc131-87cd-49e4-abd1-07cdeb386214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889453, "uuid": "9dd3c5eb-88e9-4902-80d2-a819d4009983", "value": "30c9ea4f3a251895e25fb7366c0b58dbf3039b06ad461ad59d08f402b00f8a96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95b9210-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702908828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908828, "uuid": "a33e59e0-3c64-4127-92a3-1380c45d2571", "comment": "Malware payload (Formbook)", "value": "6a6238c5615d4f9ffcccbdeaee56fff8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908828, "uuid": "253a066b-0ec7-4197-a4ec-044baa809b47", "comment": "Malware payload (Formbook)", "value": "3138a0ae5402fceb82576a9012a131de0366d8cadabe03a31348940d75aa569a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908828, "uuid": "8a9e5208-ef64-4ceb-b511-b5a77e4c429a", "comment": "Malware payload (Formbook)", "value": "4f530c63992de0e8c2029debc879ef02f2796d14", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908828, "uuid": "4c16ffd1-e95f-465b-af78-09cd4fd30698", "comment": "Malware payload (Formbook)", "value": "441782838d90968f71a716a6d850d5be78627e7412c08bd88819d9b5b1268d0ea1a4adacf14418e28fc4f0ad79fc1b4b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908828, "uuid": "f334f439-85bb-4eec-9ac5-d08c66f0738c", "value": "T164E43363ED6590E6C8C7F0AC84B633DEB5E8C32BCA79521B3F561F6B410658D6E16083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908828, "uuid": "b93aa580-dcf9-41f9-b019-d8290af903e6", "value": "12288:88zGw26y9hspN0YhERJg/zAGa3PnSgoIoDIkOC/F2oMmJ+II:Bo6y9I0YKCsz3qgor/F2tw+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908828, "uuid": "3cc86718-2f20-4fd6-ac45-fb79cde77a9f", "value": 685349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908828, "uuid": "7edec399-8207-4a65-871a-6409135718b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908828, "uuid": "53a677ca-294b-4ba0-be74-a27727e609c4", "value": "SOA & Approved Payments.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6ed036-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889509, "uuid": "0bb82a9f-f638-47d6-b863-17d9c19c9de0", "comment": "Malware payload (AgentTesla)", "value": "6624778aa78c0c118edcbe869851a6c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889509, "uuid": "26cf93e2-2099-4170-9c73-0481b440e7fd", "comment": "Malware payload (AgentTesla)", "value": "316c8fa4a4be70c27c5b89e16ad38a2df6e3752143d2743c9f611ab39376bd48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889509, "uuid": "153cc2d2-ef99-413f-9502-7113efbe4ed2", "comment": "Malware payload (AgentTesla)", "value": "7242256f082b99850622b8e0c6e4a3511004bc2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889509, "uuid": "f7e62bec-abf3-44db-a03c-a202488746ea", "comment": "Malware payload (AgentTesla)", "value": "87bbc24999b4299380086fe101b98082e2f2299784c980f030622c3e7ab1b71206dc5774ae6062a532ed0423d0e41d85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889509, "uuid": "7663ea0d-25a7-45cd-b5af-476f9ac1ce93", "value": "T168D4232479AEAB2BEB7657FB521600981335E42D7023FB254FDEE4CB4237B006196727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889509, "uuid": "b5f3b9bf-efaf-4ed9-a49b-47ffa66e78a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889509, "uuid": "87e4a60a-88b6-4bfd-a7d4-b1d69521ec0e", "value": "12288:Z3IU8S6eUd33A/oEgWj5Rv0EU30vrn4UiI/YFIZNMjk0NH:RItSAd3wAEbjzv0Gv7wIQKDMtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889509, "uuid": "2cecf1b8-0669-47d5-b897-67b0aae1f455", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889509, "uuid": "ca9cf863-abb5-40bd-9fd9-089db2a87b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889509, "uuid": "6f6b1d87-a5c3-4ba1-a4cc-7791ce83a6f2", "value": "SHIPPING DOCUMENTS(INDO).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b4ea6c-9d62-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702875757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875757, "uuid": "b1706cb2-f205-4229-a61b-0bd2586822d6", "comment": "Malware payload (Mirai)", "value": "204f6dcb493bc4b7a98f77f70023d33c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875757, "uuid": "ccdd6ca1-0a7e-4284-be2d-c02a4ee2f156", "comment": "Malware payload (Mirai)", "value": "321c8bf013a8a272a29f66ddf35c0ce2e252a1a97313a355fedfe3ee4556ce96", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875757, "uuid": "89b73af0-b47b-4a5f-ab59-f0617a79ff2f", "comment": "Malware payload (Mirai)", "value": "3c0aa0d2ecd385c01cd15b6deb567a1020e2ce37", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875757, "uuid": "8dc5aa0b-c90c-46c0-b9b0-4dc59177108e", "comment": "Malware payload (Mirai)", "value": "c48db9c01127ec35df07d1cf5065cac10fcd93effe57a8cdc4bf59eba8e4afe0e1f68258c59bd227483954a79016fc33", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875757, "uuid": "780ae5be-301d-4188-a3e2-271f0c4cce10", "value": "T16B834B07B581D0FCC59DC274476BB63AD933B5BE1139B2AE27D4EA263D89E200F1D590", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875757, "uuid": "222b5baf-b924-468f-9f09-a23616f4536e", "value": "1536:aZtWLdtFca5ycapQepMFejqGFb9dSCNmLptGvoHYBEQVBJRyXaygp2nbh0/wvD:o0Rt2syc/0zjFZ9dSCN+tdHIbBJRyTgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702875757, "uuid": "56dea149-78cc-4f37-bf73-daadb1598842", "value": 83008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702875757, "uuid": "eb48ae33-1fd4-48ea-b7cc-b54b451aa3ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875757, "uuid": "b0471aac-66a5-4ed3-9485-094f1dd1c2ab", "value": "nig.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d438cd-9df8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702940089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940089, "uuid": "30e97cbb-37f1-4d18-b437-6b722da64bca", "comment": "Malware payload", "value": "2d36bae3993a9a4f9d95358bc80463fe", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940089, "uuid": "0241c032-451c-4ed9-aadc-45025093b1e3", "comment": "Malware payload", "value": "32f13566e971a0e674407446b5735dbddb05e19dc96fdb57909a4c19f783f346", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940089, "uuid": "571b8d8c-3dd9-4f4c-a89d-b3d213743807", "comment": "Malware payload", "value": "fa6f70181846bbef43bd9c728c6bdb48cf9f627d", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940089, "uuid": "0f888335-7085-47f9-9dff-d2e2aa07b4cb", "comment": "Malware payload", "value": "9cd5070e16c69be8b5e22e72509a1f37124ee88c803bb28789a8bafadaf3875ffe550be009de1787c139e63a9f3f01de", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940089, "uuid": "5135dbb6-203f-4336-b98a-b5d468fbd0df", "value": "T19233E0ACA6F4182CDC6682AD61023CD76446B82345C1986534FF8ED23F09FE1DA577E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940089, "uuid": "59744161-595a-4afe-a649-d40079c78604", "value": "768:Zc8nioBjyOhKxCkqU/B2m1KNjyyl470rEDax7W7yq0fuHBWHbFm/sYB36xK3OB7G:ZX3BmOhOqqwDjyylL6yqAuHLB3GKQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940089, "uuid": "32702135-780c-4b89-8106-38c71294b90f", "value": 51327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940089, "uuid": "417b5482-5765-4fb5-b6d2-7e7586edfe65", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940089, "uuid": "f3c27e44-f313-4711-a940-4ff87a701afe", "value": "20231218618342.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09fd975-9dcb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702920866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920866, "uuid": "1e6139ac-4daf-478e-94da-6a48ba0c9a5c", "comment": "Malware payload (RemcosRAT)", "value": "01fed888c73f8954f2c8a4e334cc2dae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920866, "uuid": "1a84897a-f25d-4b46-aa59-abcee3212a05", "comment": "Malware payload (RemcosRAT)", "value": "33208d34b4f679b8ec036d5be12f4d2ca960dbbd8af46b20247d5df93f1f63a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920866, "uuid": "54bfcb28-ae64-4e71-828b-ee9bc0f6163f", "comment": "Malware payload (RemcosRAT)", "value": "0965bbe8bb7126f8648f8a09f57cbfcce1a0675f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920866, "uuid": "f28e430e-ff26-4100-9954-996a461cbb15", "comment": "Malware payload (RemcosRAT)", "value": "1f9fafdde0d73a61b3cb592d01d97ce9f0205bfdfa8768b325964b593dade7929837232be00845c18fd8611d91959b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920866, "uuid": "b8fd2e19-dfe6-44f6-bb15-fb2e56086750", "value": "T1D015236073E84727CB2D9EFF9C1C68A507B35516AA51D4E58EC017860CE3B02173AEBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920866, "uuid": "b63ce77d-a310-4b72-9cbe-41c6eb59df02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920866, "uuid": "b8131b19-ba5d-4aaa-8462-a2afbd01158a", "value": "24576:/16gHdPIQkEJjUdxt6qy4QKOv4Kv6GR2fSMRMHAj:/M2zkbz8lxNv4KdYMHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920866, "uuid": "c29a5384-8b3f-445b-a0da-0a16e03d4228", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920866, "uuid": "9c8ad9ae-52d6-4adf-a7a9-6de5d2e4c8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920866, "uuid": "fbcb2ad6-fea3-4464-9d53-ed9350f0d356", "value": "PO HY202305311035 Shipment 9-6-2023 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ddf1f2-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702880104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880104, "uuid": "9a19574c-49a3-4852-a9de-0dca26ff3ec6", "comment": "Malware payload (Smoke Loader)", "value": "faa669660a14d7ab3fb483443b4ab86c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880104, "uuid": "49ba9246-b132-44be-933b-75e74aadc46a", "comment": "Malware payload (Smoke Loader)", "value": "359ddf4b6d3df8be2fd5a9ed0ade5211ae219ef29085f1a8737b39a75a3ca947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880104, "uuid": "ee0e8c64-0431-4d0d-bb49-f44b4921b102", "comment": "Malware payload (Smoke Loader)", "value": "cb5228829a559affd3a5d1bed3adf05df513e741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880104, "uuid": "22492fab-06ef-4b44-bdc3-54277099d4dd", "comment": "Malware payload (Smoke Loader)", "value": "4412bc3a75748a180b6c61bd5321ae7cb755f022c3316d25563da1ac270efd0b7ef49a4a03fe04259e4fad57fb0c7ac3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880104, "uuid": "bd936f88-cc07-49e6-8a30-58d6987f0672", "value": "T1D144AE1232D081BAE12356729E69C7F45B2BB8655F226ECF2BC85A7E0F342D1C771316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880104, "uuid": "5eaec85e-8716-4a69-b1dd-51e7df6de799", "value": "25c5b39875f5a4f6c67ff13501770773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880104, "uuid": "6f4c2eb5-e67d-4b93-a9a0-851ba08189aa", "value": "3072:H4Iaat/GHT5oIAc3cvaBIPbjK4NuCID3Fh+BGDwkz0ZjtJaWw+YbCUBZGyLqdX:n+z5ONfZQFT+BGD1z0Z6h+JUBZLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880104, "uuid": "cdc9ca76-df57-4387-971b-f3269413a754", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880104, "uuid": "713949e3-2cd4-4676-8a69-e7dc65831b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880104, "uuid": "177efc50-d9e1-4bc0-820d-9d27996eab1f", "value": "faa669660a14d7ab3fb483443b4ab86c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8e664b-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873243, "uuid": "d77a5ef8-bc15-452d-a5c8-a1195b2eb61a", "comment": "Malware payload (Socks5Systemz)", "value": "0ad78cf4385a6c4dd5aef267156b673d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873243, "uuid": "b4b781b2-4a34-461e-99e9-890579822889", "comment": "Malware payload (Socks5Systemz)", "value": "35f059fbcc5a665bb4d470c88038945a8a66650df99240911682fb0307eab45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873243, "uuid": "19a4d9dd-be7f-46cc-8b66-e35fc4c427f4", "comment": "Malware payload (Socks5Systemz)", "value": "87c93643bcf38ec8af657a008b85b081f245146a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873243, "uuid": "08494ea2-1de8-43a6-a998-25098e0b5e85", "comment": "Malware payload (Socks5Systemz)", "value": "1a1100d14af37e8ffdaa8cccfc13dfd1ea76a413d8a635fca312be3d2bc03ef66c7f0dc5afcc24c0692b6f7fe424fb99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873243, "uuid": "e5aad727-47e1-465b-b65a-fa9407a63cea", "value": "T16D66331C84104D64D390AD3EAC36BA67DFBB3E698A350D20BD14D2FD46EB07D958AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873243, "uuid": "d8408210-17f4-4459-936a-c03b34455464", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873243, "uuid": "f0f84b0f-d6c4-4abc-890f-2dae2467da78", "value": "98304:NSPB0eTXOYDXPIGK1GZcFad2F1B5Kn4gi8FGVZ6wD2isox3HJsAkzGi7ppmA:EzT++TK86EeMLGLD2A3pshtpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873243, "uuid": "3dd6e39e-4f0c-4f07-af76-60643812a16f", "value": 6765329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873243, "uuid": "dbdfc309-7242-4c84-8f6e-5e6ce6b604ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873243, "uuid": "791089b6-230e-4dd1-9a96-102fe5dd460c", "value": "SecuriteInfo.com.Trojan.Siggen22.40889.14381.24582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f6af57-9d62-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702875752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875752, "uuid": "35529fab-754b-4140-a76b-a429ce095cf1", "comment": "Malware payload (Mirai)", "value": "3dddfd73d031d199255deb410db6de10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875752, "uuid": "866399c0-e9d1-4392-83eb-1645f4ed7c41", "comment": "Malware payload (Mirai)", "value": "37bfaf8c4ee562a66c68bec5d1f13c617f605c796f265c004a63f0fb3b373827", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875752, "uuid": "48f8d3e2-55ee-4f24-8d40-0aa80cd5b12a", "comment": "Malware payload (Mirai)", "value": "7de37c463a9f354b26e52654718f01c41ca0be87", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875752, "uuid": "d7dff692-7125-4669-ab78-4a74e1906d75", "comment": "Malware payload (Mirai)", "value": "3836870eb2951341f51c0517b8bdb430a83da7655aae3634292b3437b275d72f5d2aa2bb588b0e8c11d1494cee0c48bb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875752, "uuid": "e7d16ea3-dd54-4694-9940-9fcf6fd19bf8", "value": "T1D6B3E70ABB610FFBDC6FCD3746A9070625CC690722A83B797534D828F54B24B5AE3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875752, "uuid": "ae90d19d-0cc8-4bee-8ae6-3d475222f0f9", "value": "1536:cM+mEEyGGBeXAByl2dwiTT9/xxldtAOSWSIMyiUwKJ4ZY/mwbJO3W61gati2cD3:p+v/GGBewwlUAOVSIxwKJ4A03j6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702875752, "uuid": "e2962299-91c1-4735-8959-910cf69d135a", "value": 113924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702875752, "uuid": "02d1f192-db3b-4937-8a04-d9fb123128e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875752, "uuid": "e85f7971-8cb4-4ccd-8804-0100fce0a9b5", "value": "nig.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1b1c5d-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702873236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873236, "uuid": "2c7aa008-8f09-47e7-9cdc-bb7f8fe2118d", "comment": "Malware payload", "value": "701497b0108acb3e48eee316cf7793f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873236, "uuid": "3c47e8df-7a6a-4b28-927d-b0ba566b9687", "comment": "Malware payload", "value": "3866d624bff95877459b8350fcdd1a06eb09ecb2f79a838a6634a7dd09c28c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873236, "uuid": "1edd1400-32d1-4766-a830-79c78cf4895a", "comment": "Malware payload", "value": "34a723b7b863a0381672240d6a7b8c41208e8d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873236, "uuid": "7c87f051-c45c-451e-bda7-319d11e15397", "comment": "Malware payload", "value": "641b985c8ff08077cf52d95e4379772261efaf12f7235015c4c3c83d6ae8501547db5ca2b76d5f6af70a2a964695e01e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873236, "uuid": "d32a045c-38c7-4bd9-bcb0-462080ed3008", "value": "T1A366332A8CA7C8B1C53746B4B85066C849A72CB33D7AB0DC70DE0AFD9C35F558B88275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873236, "uuid": "6925c77b-a820-4200-8d33-3e73e3c799eb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873236, "uuid": "d7d78a16-f9ec-4688-8b64-339c575966c4", "value": "98304:wnc25jgmteMgMFaqdatxB9FsoY42om6QlBtgN/oPmimiXmk4D3:C1dteqFaqdaBooY4oXlBcoefmmk4D3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873236, "uuid": "5687edaf-80b0-47c2-b248-25f6c15a2a51", "value": 6795192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873236, "uuid": "baf014af-d019-48ca-afb3-c5e62d9a65cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873236, "uuid": "eed708e5-cf52-4433-bd6a-ec1b74c34b50", "value": "SecuriteInfo.com.Win32.Malware-gen.30278.15157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0521912-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1702880036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880036, "uuid": "685d8857-8d9a-49b7-9f66-516c376e94b6", "comment": "Malware payload (VenomRAT)", "value": "028b6553fc66bc01936fe9339139ecaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880036, "uuid": "572baff7-5d50-4207-b0ff-6c31d4c49f46", "comment": "Malware payload (VenomRAT)", "value": "38a97d5849d3902228efad6e755bab94a824ab64a60e166dc05e380a16283efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880036, "uuid": "82363af5-d065-4634-8375-d65e22f927c4", "comment": "Malware payload (VenomRAT)", "value": "0d367258d1b2d24a5f3296ee3a001c5e9ff9d18c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880036, "uuid": "863f01cd-9a39-4c84-9bd4-d4ad102594c8", "comment": "Malware payload (VenomRAT)", "value": "7dddd6326e5fe713490b55bc7d883afe4a776b4eeb87f5ec0c84c5a8c2a503b435020b8bd53f859567b91431948dce23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880036, "uuid": "adf1e417-5449-4474-871a-fcd420b7fbdd", "value": "T153554A8BBCD045BAD0BA92324DA251927B62FC151F3213D72AA0F3782FB6BD09D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880036, "uuid": "6da3d126-ec82-4f9b-a182-90a5cda83d04", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880036, "uuid": "00b973cd-49ad-43f5-ac1f-3d74731399f0", "value": "24576:1wC2monBVtuebS8rjsfs6uMOgScqwWMeIqUy4ms+H/jzXr7v8ysWoSFjK2zlU/gm:1wCHSVAebVDNjrWI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880036, "uuid": "512f3e28-d9c6-4c8a-9242-656f0871a325", "value": 1403904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880036, "uuid": "af9fbe7a-723a-46b0-b6df-c6513633f125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880036, "uuid": "05e89b5d-ac7f-4ca6-a9cf-9790a2b58730", "value": "028b6553fc66bc01936fe9339139ecaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf8d511-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1702925584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925584, "uuid": "f8581ef3-10e5-45b8-9d5f-fd39b46de030", "comment": "Malware payload (XWorm)", "value": "e9a12935d20f60dd56b6f6df644a89eb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925584, "uuid": "0c1bb5e3-284b-41ca-8c5b-1fdf0f264c7e", "comment": "Malware payload (XWorm)", "value": "38b2cef499b4ee163a3f2ce4f588fd49457c2c9eaf65c2a84038df883b0f144e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925584, "uuid": "93c0fee4-038d-4da0-b0d6-3ebd3be9a93b", "comment": "Malware payload (XWorm)", "value": "75374c08529df0d17272f741accd38a98a15921a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925584, "uuid": "f39d7de5-9b2c-41c4-ad9d-c737578aecf4", "comment": "Malware payload (XWorm)", "value": "723df9a33642b804619d688da4d5c251c5ffb763f60379ccab8bbb056facfb6631b38acf51e466188545c4f1c0a9a293", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925584, "uuid": "77f6822d-aa60-4bd3-aeb1-010ae668c112", "value": "T15B113B9139FB940C7177BC9247F5F5A6471AF670921FAC0D6080070B98A3E445E82F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925584, "uuid": "940e39da-6190-4051-9fce-dffd699b6640", "value": "24:QDDCn4gBu5QgBuI6zIgBuN2MMl4gBuiTef8fNMd:2DCnvB4HBUzfBjMkvBMf8fNMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925584, "uuid": "443aebd2-2d08-459e-8a5c-bf7565da69c8", "value": 1080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925584, "uuid": "821a1e62-77f4-453f-80b2-8652f3389fa0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925584, "uuid": "d3dd7ef6-5872-4d87-b0e0-593e1a437c01", "value": "STATEMEN.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8895e64f-9dcb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702920799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920799, "uuid": "39685d81-7a55-408e-91c6-f0923b9e1159", "comment": "Malware payload (AgentTesla)", "value": "15a97ccd9958d55f9fae7076405b6be2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920799, "uuid": "b71e9563-c32c-4d38-8046-f3311f198a97", "comment": "Malware payload (AgentTesla)", "value": "3934d48c77cb712a0ee30371d372b3198f60e6e90b79d93dca8c972640e889c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920799, "uuid": "f8819762-ff36-4b61-aa36-c0a3d2c6418b", "comment": "Malware payload (AgentTesla)", "value": "1259188b51b5e20dc961aedecb563416aef6a003", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920799, "uuid": "c232de4e-e773-417e-ad61-5bbdf040bc31", "comment": "Malware payload (AgentTesla)", "value": "886edb041658fea22ebd7db2761aec48e1ca00921e5c86568f8aace059e18348ed7a9b99210c4f12fb4633c840a713f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920799, "uuid": "7dc0cd07-86c0-4825-95f5-43247c2b5f9b", "value": "T17C84CF90E98CBCEAE4DA0573763A942C04919AD896F401AF33673E3555F3BC321B7D4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920799, "uuid": "12dc11d2-3c21-46f3-b0c8-77eb9ba63d02", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920799, "uuid": "30a4ac13-41c4-4454-b30b-34226328b3e6", "value": "6144:wBlL/VhIfm0bB+Kil/6kt4OHY5/33+N8uTegmRmquhE4bcn6S8UQ2fCo32Kz5QHN:Crufz4l/vt4Eq/33QDE3uhEqcnZQ/mzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920799, "uuid": "9e2122ff-4679-4f7f-bc75-79f590db8f8f", "value": 384256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920799, "uuid": "9a0fb9fd-d879-4715-96ec-ccf15c77fcb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920799, "uuid": "70e49175-d03b-4982-b994-e8fae337b250", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c719bf-9d7e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702887805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702887805, "uuid": "7b825c35-ad8e-4b6f-881c-a07da82675cb", "comment": "Malware payload", "value": "9d271d7997f292d0958cf06d046f4975", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702887805, "uuid": "4054ac68-f617-40e6-b15c-1575ce3f07aa", "comment": "Malware payload", "value": "39a7da8965d63d6990954c2e5b7a4fb0300e3897866f6e0fedd7dd7f8ea6f56c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702887805, "uuid": "f454201e-ac1f-42e5-91cd-bf60ad583389", "comment": "Malware payload", "value": "78efc77c60abdff91b7f7cae00f958b4fc681dd5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702887805, "uuid": "8ae765a0-a5e0-4574-a8ef-19aec955cf2b", "comment": "Malware payload", "value": "377b0b515f7a70a193c46e54d9168392d28e925d5fd6e0cef55bbac0d413367b028fc2799950aa98a1b3c1b60c004c23", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702887805, "uuid": "0c955206-876d-4d26-b7fa-8e95ebb86895", "value": "T10321C8829687945EEE9E79F0481438CC5577C83AF2216BC946FD9BD29A2394F60920C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702887805, "uuid": "e6976a77-d7dc-4b23-90b0-e52dec7cdabe", "value": "24:7kjSySFj4gUtBreeyYa5qkOVN7YLJzx1URb/9equoq+gJSa:7keXFj4gU7rejqVNELJzMboDJSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702887805, "uuid": "d6ae232f-4ff8-4f47-acb7-76b2edde76f2", "value": 1283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702887805, "uuid": "f6959173-633a-4adb-bcb5-052eb4d32f6a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702887805, "uuid": "1d9add13-2b2f-4626-aa75-02af8bad40eb", "value": "VipPassword.txt.lnk.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0b27ce-9dcb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702920965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920965, "uuid": "259febf8-fc0a-47cd-ba15-d8f12d681ed5", "comment": "Malware payload (AgentTesla)", "value": "ecee41da2abf30fd188e2ce8b740bc97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920965, "uuid": "cdd3883a-ca8e-406c-a386-b2fc6acd679f", "comment": "Malware payload (AgentTesla)", "value": "3ae22f99bd5e1772eb6f9abb1d127c8682b5847b6e7e062d843ef236db85e828", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920965, "uuid": "a12d018d-dc5b-40ed-968b-9c9e13246fe9", "comment": "Malware payload (AgentTesla)", "value": "bb8a5a839980dc64b1dcce0ff723f7a312685f67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920965, "uuid": "89ab7288-905d-4309-bd43-ce5f40ea1afe", "comment": "Malware payload (AgentTesla)", "value": "c8f06d0c53bbd2f96784ddbd2c62a12e5a50acc6592e7cf23d4b7069b512731fe95ceb6ddea33505246b6b6e5581b2f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920965, "uuid": "d86900f1-c0d7-4877-9d0e-3bb1d5cc83da", "value": "T19DE423C835F99B7BDB3857B45EA56184C3F917481AB0FA081E6CB4CA0873F83D5A4627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920965, "uuid": "b112b4c8-35fa-4e14-9fa2-4cf430093d80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920965, "uuid": "6964fdd8-b78f-46c5-b934-f562cd7cab5b", "value": "12288:f2iNb0oLtr0mU9ivJALHTZYA+6m9mRUkQG2kozP6D3kTy:f16gimU6yLiIm9kJQGDxD3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920965, "uuid": "0b52501a-1edd-4d4b-87f4-971df7fa0292", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920965, "uuid": "3a33be90-ae3f-4785-9342-88be58df691f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920965, "uuid": "bce17d31-b4e7-4eb9-a1c0-2ac7401a5c82", "value": "Payment_Advice_231102131808 A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abae0f20-9d62-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702875760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875760, "uuid": "f751d581-5ba0-4739-af96-49ed8121fa79", "comment": "Malware payload (Mirai)", "value": "c7e1090a1b9a8e38f2ab5384bd67bed6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875760, "uuid": "f26e116b-47f7-4ec3-9713-4ae1394b0ab2", "comment": "Malware payload (Mirai)", "value": "3b7b51e6d96097d016b4da0fae26d3fa738c6d601de46c30676afe0a7278b100", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875760, "uuid": "efe7c7d8-9fb0-4162-ac57-ee020ad70ef9", "comment": "Malware payload (Mirai)", "value": "71b2da0903952abd9417d14b59e8434486f3d90e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875760, "uuid": "1da1b69c-a3a2-49a6-ad65-803f17999efd", "comment": "Malware payload (Mirai)", "value": "2791160ff36c0c4f4889a0ea0e8c2890b56d89841cee3dee0bafc5c73aed6d6bce8c1cc97b61fb8ad53e6d9933d1ac8a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875760, "uuid": "0e491a3f-cefe-406a-8461-7b24ffe3b86e", "value": "T1E7832981BD819613C6D512BBFB5E028D372613A8D3EF32079D266F20378B92B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875760, "uuid": "4944f45d-e2b8-4825-a2fd-cbeb9d3fb219", "value": "1536:O61qdGir0QAQhR7ShxCD13EsgSKXNOpsKYcik4uvKvncD:O61L8muZ3Esg77FfV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702875760, "uuid": "be2e089d-5f87-44a7-8bfb-2fe366131e2a", "value": 87672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702875760, "uuid": "a19422d4-1b97-4df5-b48a-74576fd58f08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875760, "uuid": "9071bdb6-0e20-4e9a-b397-94368d5b1c5f", "value": "nig.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a389737c-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702908818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908818, "uuid": "cbb76a53-fc4a-4695-8d9c-0a8cc87013c3", "comment": "Malware payload (Formbook)", "value": "2ecbd7265302b0c6037ebca4b850d2a3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908818, "uuid": "9708f881-bc1a-479e-a1a8-0a2ac987518e", "comment": "Malware payload (Formbook)", "value": "3bf0a6cf8f7ac3d9d50dd04d0aad499833b45009aec40b19d4523e0d74972f20", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908818, "uuid": "12063461-3678-4f95-885e-7144633f6cdf", "comment": "Malware payload (Formbook)", "value": "94eca00003c21df6466a56d7985b6e3b1a99449c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908818, "uuid": "36252925-b729-4b8b-8e81-17970e174aa3", "comment": "Malware payload (Formbook)", "value": "a12fb817ba0da1ba6064a8908be3748548375473bd74283ec4407716a765187d7ab92a85a96f7300e44fac371d8a53fc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908818, "uuid": "b28dfd7b-5267-4028-b986-a950e2be11e2", "value": "T125E423B11F0BADB55462F308EA657107B6235D77622639EE9B843EE542C4B0C7CFE209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908818, "uuid": "88950331-dc49-4f81-98e1-70b8068124a8", "value": "12288:tnacEaW5JG4utQY3tDk37CLaeTt4lRL7y/guUDmrhW3Xd7cBJVG/fTFMa+fDId:1actW5I4ugLOtKRduUDi8XdwBJkf8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908818, "uuid": "331851f7-1e48-4692-b5db-00a62d61432a", "value": 688176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908818, "uuid": "35b36b88-070e-4df8-96bd-127077eb71a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908818, "uuid": "c81fc840-8e9c-494c-ba5e-5e442a2aa100", "value": "order 18-12-2023_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98547500-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702889472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889472, "uuid": "c5214c92-71a0-4eb6-8f07-79d04432f323", "comment": "Malware payload (RemcosRAT)", "value": "2c7c1016b8608a9df2124ee26731b6a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889472, "uuid": "2d4f1192-3662-446e-8619-86a61707e3c3", "comment": "Malware payload (RemcosRAT)", "value": "3d537a7796fa465cdff1388141e37df9ff689007f024808b90381640f99b9b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889472, "uuid": "4aa5058b-5a1c-4ac3-b6fc-270a256ef83c", "comment": "Malware payload (RemcosRAT)", "value": "cbfad98221fac51faf809aa44ccd4ef4457e1fbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889472, "uuid": "201168f0-0672-4d97-b348-1ad319fa2e28", "comment": "Malware payload (RemcosRAT)", "value": "273fe1953a55d775eb239b6009a80412a09e72784fef3600bc555f22424781525862e3523f72bf097da6cfc39149d799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889472, "uuid": "c0644c98-cc5a-4d00-b3eb-b27de69d443f", "value": "T173C402A3751BDFEDC9070BF61876566001B72E0D99A6E80C64F93E2B32B33432951D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889472, "uuid": "311cdac0-9f72-4b5d-a5c6-d9d7354b6c2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889472, "uuid": "8394770c-37c4-4092-912a-d5b433544a72", "value": "12288:ID10oLtuot+o3og5xmdqpdlfUcFxH9rDnsnZNosjEAmD:I6gws+oFHmdqpffRrBrsZNosj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889472, "uuid": "92db4285-3c84-401b-8871-282a844139be", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889472, "uuid": "e9b02416-c84f-4412-b368-8356a36e84c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889472, "uuid": "212bdd00-9fb5-4b41-a833-7d6305206aa2", "value": "cheque-000000005903.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e1292a-9da9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702906168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906168, "uuid": "89c018ea-e7b2-416c-9f55-6f1b6f34afdd", "comment": "Malware payload (Smoke Loader)", "value": "515cebc2a1bba045ff54d1c7f19f52bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906168, "uuid": "649d340f-9433-42a0-be66-a6d4d3cd3f39", "comment": "Malware payload (Smoke Loader)", "value": "3da0283f7f3f55a370555508bdb870110c81b1445865c4c45075c1871225ec51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906168, "uuid": "163806d6-6afd-45a8-a1dc-3ee47b2bbd00", "comment": "Malware payload (Smoke Loader)", "value": "bc3889068df81f55106bce1dcd38e805dad595e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906168, "uuid": "e9bfdc43-700e-44a2-83fc-27c1fe2360bc", "comment": "Malware payload (Smoke Loader)", "value": "36b535b8f32600f9c42ac26d6e65ae0b26dbe94e91772b373e26958871403cbcd4f57c42d3015fcf43333ac919bf125b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906168, "uuid": "c5a8d3f1-5dea-4104-9e9c-84588273d161", "value": "T1C5A519A2D000F24AD6442EFD4B21E7B2D21D6DA15762C8CEA5EC3D5FB73D3E6076A421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906168, "uuid": "54598e7c-d10e-4f3c-8cce-b5eee8b8ebff", "value": "fa6172b2c7144c0c4c3047023c019acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906168, "uuid": "13171bec-60ed-42ef-8f15-c6ab014021d6", "value": "24576:FUV+MGY3uYyZFCjAhX6NweYm8+8mLvaxw24h+ffrSDeACwhq124HqpBNBqbTHUGW:hDGEAAAXr5GQsMzr5GQsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702906168, "uuid": "c9052c9c-6140-4667-ac1f-a7bd0435ec92", "value": 2093732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702906168, "uuid": "a4bea9b3-4181-4309-bb8f-1b8fd0599e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906168, "uuid": "59537d65-0ece-4c6f-934f-aa0b576bf958", "value": "SecuriteInfo.com.Trojan.GenericKD.70788680.21050.25766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed1bcb2-9dc8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702919521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919521, "uuid": "741ffb6f-3b9b-47fd-bb33-d1b5365adddc", "comment": "Malware payload (RemcosRAT)", "value": "fdfdb63af219f74f561fa2f22a4cc13d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919521, "uuid": "02cf362c-d8a5-4746-9315-8dca25f9f5f2", "comment": "Malware payload (RemcosRAT)", "value": "3de39937dbba16980b665dcf03505af8bd11a77a9f09d8e5ca69837932a9340e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919521, "uuid": "491f0644-5915-450b-80db-8da46b192964", "comment": "Malware payload (RemcosRAT)", "value": "c406f54f8d7567828e6b1ad62ab9d5f7a4ac7fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919521, "uuid": "187a3196-45a2-4635-a1fd-de710e43fccd", "comment": "Malware payload (RemcosRAT)", "value": "76a6d634ddc193b629cc72c2814d20a50efceb11d4cd5dc2c0a366972fef5477006321c33ee1779f78b07c307da67481", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919521, "uuid": "9ec1de61-eba4-4d85-bd9f-0526f42bcffb", "value": "T1F045273C48BE2237D6B5C6B5CBEC8863F05CA46F3150AD6594DBC3A653C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919521, "uuid": "a8564f94-3626-4362-90d2-01158e233933", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919521, "uuid": "dfc40fe9-842d-490a-b623-c79cf3662f62", "value": "24576:Owk17RZNcAxKr7pUn+Aaw787ioJhZFbZS8zt+X7KLV57QdqDt:5kBIr7pa+AN2JFZDa+hJlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919521, "uuid": "70963397-7f69-4978-a40d-57eb92673069", "value": 1190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919521, "uuid": "ab769094-212b-4c30-aac0-263f2f139b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919521, "uuid": "6991bc3b-bfe9-4d7c-8d12-886c781c4027", "value": "zHBPa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd547692-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1702880112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880112, "uuid": "39555268-eaf5-4945-b71d-176bf7a266a1", "comment": "Malware payload (SnakeKeylogger)", "value": "6f56162ccaafdd99cd623a0e3b23dc91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880112, "uuid": "290befd1-b550-415a-8068-12f9dde02435", "comment": "Malware payload (SnakeKeylogger)", "value": "3e43fe5dce47c5a3115320ac38040f4b6367e58356a06810ca638579da1bf3d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880112, "uuid": "8fba966e-8ced-4445-a680-0b7426c9bd2c", "comment": "Malware payload (SnakeKeylogger)", "value": "526fc6fed2734db26c8c49f1d42ec97fe991217f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880112, "uuid": "a9b36d7d-3ae7-4c1f-aea7-b55b8e023b9a", "comment": "Malware payload (SnakeKeylogger)", "value": "96f49d2390f30e16f59d378dba7e49c73a9fb0c5810309fbfd5e83120ed19630fb7e93c3f26ea66ef9c948a7c91e9686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880112, "uuid": "5622e4d6-f255-4d59-a289-ca21a797a097", "value": "T1AEC4221012E8AF13ED3F43F4166121B347F8041A9B5AE6568EC839EE66E7F11C7609B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880112, "uuid": "b7a81e0e-e1bd-4ed3-be8b-73a73c61d752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880112, "uuid": "caae6a5a-6fc7-47a1-a4a0-6e922d09d7ba", "value": "12288:x2iNb0oLteLG3GdEHillLnCaF4dQqbe8RwQFXk:x16gkLMGdE015xFgxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880112, "uuid": "8ada5fe8-df16-47cd-beb7-d0002dfe8c56", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880112, "uuid": "21155880-0067-4afa-97e6-4ea12a73b68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880112, "uuid": "d809b0db-8d2f-4918-8653-7949cecd1b59", "value": "6f56162ccaafdd99cd623a0e3b23dc91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d329f301-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873250, "uuid": "59bbaacd-9151-40d0-84d9-b77877762602", "comment": "Malware payload (Socks5Systemz)", "value": "d06bd4a3a43bd3b371f647b77695aca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873250, "uuid": "b920a5e4-8b0e-4c55-aa59-40aaed972e85", "comment": "Malware payload (Socks5Systemz)", "value": "3f96b07aa946056fea5622e3d0abcdd41d4c0159ddc61bcb1d8ed8be3d1a7bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873250, "uuid": "82893d29-cb68-4f0f-90a8-11df57d09f2e", "comment": "Malware payload (Socks5Systemz)", "value": "405d0ecd5b74bfa17145f80fca089d988a2e79e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873250, "uuid": "1b460a85-bc07-498f-a6a3-38f5c90d7943", "comment": "Malware payload (Socks5Systemz)", "value": "5ec9a8e37b046d729390961660a75023f1d13195442d944206e995dab3489f14a4f9edfa4888509499dd9d85e6962de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873250, "uuid": "25fc7afe-aaa2-4aa9-b90f-848eff4425ec", "value": "T1BA6633D376F56812E1738AB95866D0584BF6CFD9042E30889E4F5C8E8B7F709893AF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873250, "uuid": "818f5390-2399-4f32-b802-7ada7144b896", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873250, "uuid": "ccac17f9-683b-4dc4-9afd-ebebfba71c61", "value": "196608:SHY3srNMVqtbLF3Npk+VLnikPQRqupe90bKF:qYeltbxXlniMhupe9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873250, "uuid": "5f387cf5-c175-4f9d-a608-35e38cd0c08a", "value": 6742792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873250, "uuid": "b305da2b-48bb-41c5-983d-8721d1b46d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873250, "uuid": "879ec1ae-ffb3-4e6d-9d66-a46848f8c64e", "value": "SecuriteInfo.com.Trojan.Siggen22.40921.26844.32684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf4ea95-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873268, "uuid": "3c9d7831-992d-4618-a29f-71a4f48dbb33", "comment": "Malware payload (Socks5Systemz)", "value": "35e24fc0635d60d00706084389f3f244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873268, "uuid": "55a2d842-d329-461f-9abd-444cdfcc7904", "comment": "Malware payload (Socks5Systemz)", "value": "40eb8bcf5ca9bad4d9360f140db487855d959bbcaf1ec352cee5300d02429cba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873268, "uuid": "e9d2d013-8c57-4c2f-8ac5-10fdcd4449c2", "comment": "Malware payload (Socks5Systemz)", "value": "868775170f3a20c69061a6f4eee0d3a00d9d8dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873268, "uuid": "0f2be4cd-edf5-4082-9eab-3e8ac8498e28", "comment": "Malware payload (Socks5Systemz)", "value": "45224a9a7f5466fb0bdff858e19de5ad9c29101218724d18b2dd95de85b0ed81c63f00320dc1518e8fda3d66e6e4a821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873268, "uuid": "f0b84aec-eb71-46b8-811f-8007606fbf1d", "value": "T1916633169CABC972D6B346B6ACA061D88DDB2CB23C79F0C830CE45FD9C76FA45684075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873268, "uuid": "13e7e559-ea1a-46d5-9c34-a3357cbaa9b6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873268, "uuid": "7382190e-6ade-432c-81c9-ddcb5e427a60", "value": "196608:C1dteqFaqdaBooY4oXlBcoefmmk4D3REdlnF:C1tzaa94oXmmmk4rRklF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873268, "uuid": "426ed75f-387a-4519-91f6-2b3b2304158d", "value": 6795192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873268, "uuid": "379b938b-1360-4812-b51a-369d44d79079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873268, "uuid": "2052cf85-3c58-44c6-8fdf-ec160951eadc", "value": "SecuriteInfo.com.Trojan.Siggen22.40920.18605.8983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfb5f31-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1702889454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889454, "uuid": "3dfbe912-51ad-4ce5-87e9-c7405352d5a1", "comment": "Malware payload (DarkCloud)", "value": "d38fdebcb6d7a05452bed7919c87447f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889454, "uuid": "2ea8d819-f1bc-4986-87db-35432e118d94", "comment": "Malware payload (DarkCloud)", "value": "42e5176a1acf28dbd45d5c4410050362cb1694e19a40008bdbf6652f2ae8ac35", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889454, "uuid": "a029c3b9-c3db-41c9-9de2-f16ccc1603d0", "comment": "Malware payload (DarkCloud)", "value": "89fe9257a9d4200fddbd7d6fce2a5584510a3ab3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889454, "uuid": "f4ebb882-c842-40f4-ad63-d3da75f40886", "comment": "Malware payload (DarkCloud)", "value": "b1c58e2a3c5acf0a30a61d6f8b60813bf2dc6707e5adfd9d9e9fd2185fa577c034f024d29c0783b8116ef1f805a51d87", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889454, "uuid": "c1dd07a2-33a7-42ad-a64c-85670445c820", "value": "T1EB943A16E651202FF053C8B1EAD5A26BA8296D3A2588EC17F7819F0875315D7E8F133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889454, "uuid": "c76ce7a7-57c0-4995-a8a0-6ae12af0a1f4", "value": "966d9996c62d870333d6853769a84f18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889454, "uuid": "f34647af-095f-4ee3-8f27-292dfec9a60f", "value": "12288:gdVkMuJ5ACU8299NlK7Fzpy/p2/TI8UjYKkJj6GmZU:QuJS+Fzpkp2/08qYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889454, "uuid": "64eaf106-5b72-45a3-b912-70cfcdb6f741", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889454, "uuid": "70c16f29-30cb-4543-ad27-8e75bd793c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889454, "uuid": "d77c7dee-3958-4aef-b8b5-bdfef2406283", "value": "42e5176a1acf28dbd45d5c4410050362cb1694e19a40008bdbf6652f2ae8ac35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a48190f-9de5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702931861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702931861, "uuid": "293902bf-2957-40f1-bf78-9219169e96a7", "comment": "Malware payload (AgentTesla)", "value": "3e76e206fa47934466616d05600d8caf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702931861, "uuid": "c882e130-3ae2-45e8-bd8f-0b2e609d2279", "comment": "Malware payload (AgentTesla)", "value": "435994020a9a07105b38ca0f47bb6a362ea43f40aaa69a62121a328fa35bc322", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702931861, "uuid": "449d3e4d-bbfe-439c-a06c-23b0e27cdc94", "comment": "Malware payload (AgentTesla)", "value": "d8cc9352fa633fc8b026d1cbf54c3f05e2acbd36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702931861, "uuid": "d8a7a3f6-5b8b-4b0f-b772-61d687ec7831", "comment": "Malware payload (AgentTesla)", "value": "cc2ee877979d4772bd90265fa0a6c083a872cd29889f02e5e87eb3b765b9c008e76ba441f90c6a87975c6386f067dcfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702931861, "uuid": "8c153353-a1b7-4213-8a3b-72b4b1d448fc", "value": "T19425C33C587D2237D5B5C7A58ADC8427F26CA46F3151ED6598CA83E603C6F4278E322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702931861, "uuid": "d090b535-e1ca-4f97-bea2-3466f392a73e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702931861, "uuid": "49ad6e9b-a024-45f3-bfac-dab0aeb76d81", "value": "12288:rGXDY6tGdW4RH/ufqdXnSjgrZaGby9ks1FasjWy0hHNkpOiSLGA3BnE3/w4Yor:CzcdJuyg4s1Fas657iWG5o4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702931861, "uuid": "175aac6d-a9d4-48b9-8e34-182b709fb28d", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702931861, "uuid": "1e50118e-cc19-4146-a68e-d3e8d26c2b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702931861, "uuid": "87bc70fa-9cae-4bb0-983a-5808de480f6c", "value": "3e76e206fa47934466616d05600d8caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1fa2636-9e00-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702943712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943712, "uuid": "27499a10-e0bb-404d-89ec-6fceade6907c", "comment": "Malware payload (RedLineStealer)", "value": "872aef68846ab8587a930d7d786a1a51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943712, "uuid": "529d50ff-2673-4d9a-b75c-2c7dda9ec7b2", "comment": "Malware payload (RedLineStealer)", "value": "44365f98d16e475a1638df59aca02415388a327b2f3738acbea8dfddec202654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943712, "uuid": "2b58d7cd-3e21-4d78-840e-f9aaca764e84", "comment": "Malware payload (RedLineStealer)", "value": "0c47b4c0c1142d63fffab41705b1bd2945409865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943712, "uuid": "43279b0a-6cbc-46ff-a3b6-29f4ba994002", "comment": "Malware payload (RedLineStealer)", "value": "5eca962a1a9440c25ea17f9f50ee3066a9de7fc2af946d203195d10001ab9ebf9e959d36eef88b69e702873394c16e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943712, "uuid": "17299e09-8fc0-492c-8885-6c6638d3a2c5", "value": "T1E32523036BD0A4BBDDB51B7429F717830E75BCD54D38866B2386A49E4C72A90B83136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943712, "uuid": "b068c0b6-63fa-4c8b-a98a-f62b31bfd4cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943712, "uuid": "536e7921-691b-417c-ad57-e9774470bc9c", "value": "24576:+y/J/5LDd/4k91SgWcFSfEplA4vAvG1A5Ig:N/J/tDdjqgWRsXSGeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702943712, "uuid": "542966ef-c978-4406-a7e7-c06511c5b215", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702943712, "uuid": "7bb5e8c5-47c0-498c-a3b1-2d0a54471768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943712, "uuid": "dd0de136-c833-4c6b-a82d-208a75caf1d7", "value": "872aef68846ab8587a930d7d786a1a51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458e9254-9de5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702931853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702931853, "uuid": "d1fb982a-8a18-426a-9fd0-1c38b07492dd", "comment": "Malware payload", "value": "1a01797e5fa2117626317413590140fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702931853, "uuid": "26f5627b-a1fd-4840-ab12-c9c82dcf2fe3", "comment": "Malware payload", "value": "46cbe36431f2a4fb01b369f2278086f216fd0750d87c64e9e1800652b4218777", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702931853, "uuid": "df36d2a8-20dc-4c4e-9767-40d0b4bbd9d2", "comment": "Malware payload", "value": "c0a27e1f661fad26842e6eb22d6223fc7f2d9575", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702931853, "uuid": "b2241cd2-4a8d-46a8-9317-545a9576ad41", "comment": "Malware payload", "value": "15b0cb876da52a7891cf175ae5b6582887db9e65e42abeda3c2decb8336bcfacbfccd545f9a26284b556153460913fd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702931853, "uuid": "11af0f4d-7392-48f9-b8f3-53f5644171b1", "value": "T1A6F4E00832B85F9AE47B97FDA554102097B2B546787EF7194DC260DB0EB6F204E43B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702931853, "uuid": "81c9e253-a895-4ddf-9ab3-10c1ab8f9be1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702931853, "uuid": "91183f76-69d8-4368-afdb-f21e032ba751", "value": "12288:2fAZfcahsQmcEOo7e0oLt4qm93kejEFbJi3JN//3yoCmwzXyd3FFvYpZH4EYmb:2eo7RgCUejEE7//yoCRMYkEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702931853, "uuid": "7550ddbb-f82c-4600-8371-75d02436641f", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702931853, "uuid": "93ede895-f8c4-4662-9107-5a42ec354c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702931853, "uuid": "6e59689c-52b0-4851-9cce-4d11b1a480aa", "value": "1a01797e5fa2117626317413590140fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1811c1e-9dee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702935873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935873, "uuid": "2a10dc42-f338-46a0-83cb-b2a773d1ec62", "comment": "Malware payload", "value": "e442f35db1f64e8af7d51f653a2ab836", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935873, "uuid": "8b7737ba-6f24-48a7-a416-c554b7f1c2bb", "comment": "Malware payload", "value": "46cce8711f3857896a9a1c01d26da35ff7172cd399f9b821cd7da80d52d33fcf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935873, "uuid": "7f1ce2b4-8765-4b90-8ad9-84b7722c7fc3", "comment": "Malware payload", "value": "7cdf9e90bc4d67348ece7329d0006fac1e02c7a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935873, "uuid": "f2159a4f-f177-4e0a-83ee-ef72b5841c58", "comment": "Malware payload", "value": "ffabaab8a420e74a3fb8dece9d08a1f0654b57247a0d9a1bde005655c1618825f60fbe8246f88ea209123f6498362d09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935873, "uuid": "07fab400-e37a-44d1-9bfe-cd39fae33c83", "value": "T16D06025A476249B8EA641DAC28B91EC91AA47E313D34DCF6FD3F2043073367520B697B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935873, "uuid": "68683fc6-f837-422b-b35b-cb8b761fc988", "value": "24576:lcGOcGqcG/cG/hln1SJSBqiEKdFBLcCe0nTXWA8hi3HXL9mzUAAbM5LUlDUDGKRj:nDBgCeIWUtbM54VS01YSh826", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702935873, "uuid": "de8f6ab7-7ff9-429a-80a7-7b3d3dd98725", "value": 4012362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702935873, "uuid": "8c91e96f-3da7-4d70-b77f-308ccf566156", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935873, "uuid": "7543f2d9-7eb7-4d92-9fec-30be9743ffdb", "value": "document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd57a1c3-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873240, "uuid": "98f9986b-c254-4864-ae3d-54e573e84671", "comment": "Malware payload (Socks5Systemz)", "value": "f1302d61a617c8333cc2ca1121bf54e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873240, "uuid": "449ea575-fa38-4238-ac04-04ff576a3077", "comment": "Malware payload (Socks5Systemz)", "value": "4761c96e133617d174f72e7c41452270ff07da229b6cdb5d08ed23b615278d49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873240, "uuid": "348947e7-39dd-4fef-bd05-245231c72547", "comment": "Malware payload (Socks5Systemz)", "value": "04caa93e0ba9b4dd03c436b593135b84f415d144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873240, "uuid": "b66f9ddd-4355-46ee-a613-4ed1697f8cec", "comment": "Malware payload (Socks5Systemz)", "value": "0e60b3bcaa07ed6bf4665b1fe058ce68809a220dcd0e86e89a829a00f4adcb71b5692172a7b49d86936cf8ae9cf5b133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873240, "uuid": "977cddbe-9249-40f5-a1fd-501f23973d44", "value": "T1566633D7A3290439E4A241B5D231D14B8633EEA61D63A90D9A9C0C59FFBB01ED5B7FC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873240, "uuid": "a7b5f0d9-9459-4791-b5ec-16bdca73e0ef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873240, "uuid": "65de366f-17bb-4fa8-ba57-76e9015d0ff7", "value": "98304:NuBqzPyxslK+oJnlVGZoWYrIBJDmMis4PY3GQHQdLJ5XbWw5jjRGqULvrEwmemlF:wyymlKBbUo/r0wKHQdJwwNRLGzmlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873240, "uuid": "536e5c98-928a-4399-8440-c2af1d0197dc", "value": 6770166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873240, "uuid": "1cef076c-583d-4d6f-93ca-33e3d6b70de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873240, "uuid": "7941ef74-4451-4818-9024-1fc33f843b91", "value": "SecuriteInfo.com.Trojan.Siggen22.40922.3885.25077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c65d24-9d76-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702884471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702884471, "uuid": "51eee3c7-d2a8-472b-aaa4-5e89ecc0a5cc", "comment": "Malware payload", "value": "6847ba5f14cf0fc62e80ff221b1fd578", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702884471, "uuid": "f0801671-3695-4a28-ab86-6a14bc12ebfa", "comment": "Malware payload", "value": "47f9da44bee241352df4706cc0d6b8dfe35db2202d64457c788ccac1978bb498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702884471, "uuid": "20b43495-8276-480f-8890-9c4fb294ea41", "comment": "Malware payload", "value": "fe7d985dc464c3427d2a28ec3ea7bc4b39e502fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702884471, "uuid": "57e32235-3a69-4f15-b867-c156ab0f0c70", "comment": "Malware payload", "value": "48e341e5659248fc838d80d22607a43180d3df2e94e709b141e30037d70982c449b1e241d6a2893c427fcedc27796de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702884471, "uuid": "63ddcf84-4ab6-4c4e-b6a0-48dd0f72c3b7", "value": "T1E4C42400F3A173D0CF5A36F9C6B3B374A85EA6761AF3044574CAC6FB3B416AA2954E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702884471, "uuid": "15fb2950-a75f-400f-9504-c21b34d456e9", "value": "edb9bbb8943b11a2283e79515e28dff5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702884471, "uuid": "402eb0bb-ce92-43f4-8ff7-454ca4497f53", "value": "3072:glTqGwJw+Vrw2OAlvHS3xOAb40nRbls1vHkNEkb2glWlJaA9GIM/1L6c1pFeqwza:5lPPS3xOAbBnZls1f8LUNupFzMkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702884471, "uuid": "085a8ab3-2117-491c-94c7-d6c515da57a0", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702884471, "uuid": "1649c455-a2ff-4bab-8bfd-4d61dfad470f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702884471, "uuid": "4fd3300c-9f38-449b-9650-e89867d56535", "value": "yIheA3q0Ka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14a0574-9d45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702863314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702863314, "uuid": "c7bf79bd-400b-4e72-987d-a5aa3a775ad1", "comment": "Malware payload (LummaStealer)", "value": "af77aa69206f3f524eca3d3f698f3a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702863314, "uuid": "3acc84b8-7d30-4a5e-9a3a-a19aeeb00f23", "comment": "Malware payload (LummaStealer)", "value": "486271a3873f946e14f5662e2498d75c29323402c778bdf6ce0905b37619fc3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702863314, "uuid": "a71dc993-5b32-487a-9e46-f05dea3a55c6", "comment": "Malware payload (LummaStealer)", "value": "712d0ac24b17c81d70d7dda731bd8c8552cedb4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702863314, "uuid": "af912a5c-d33b-4af8-91cf-b94822c8e39a", "comment": "Malware payload (LummaStealer)", "value": "6fd1a351274d5242e8175079d1763400232be5569ae7ed79a4f1f945499b6fab552e47fe5e020e949dd732c192c7e454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702863314, "uuid": "2c1f8112-635c-4f5e-8b1e-c5266dd65065", "value": "T1430633035B856522CCFD7BB41DFB12632E353C510D204B7E1992FE096CF76A029EA76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702863314, "uuid": "380fba3c-3f8d-4825-a61e-05de12fdcfe0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702863314, "uuid": "b03295a3-052d-4690-b6b4-b5eedf5f303f", "value": "98304:9OPHMR79j+GBD5P2jy/9RDwu3JWsY7krAIs5TZjs+m:k0x9KGdBoK5gd7IAF5TZjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702863314, "uuid": "dc67ed99-c909-4586-b99b-eb3af1364f49", "value": 3778048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702863314, "uuid": "7e72872c-bcb8-4f30-914c-c507fec9aacf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702863314, "uuid": "cbaeff69-3d55-4d0f-8fcd-53a97ad2a826", "value": "af77aa69206f3f524eca3d3f698f3a44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd0a4b5-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873266, "uuid": "653d2fe6-ddc8-49b2-88be-72f53336fe8e", "comment": "Malware payload (Socks5Systemz)", "value": "5e9ebb464ffd9d38787d2328b4bec672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873266, "uuid": "06331e33-3f04-47c9-9c57-c2ac5fba2f34", "comment": "Malware payload (Socks5Systemz)", "value": "488acbc113ccd34512de2713159ec8206c4591fe8a8a3d99b0ddf00aa206ddc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873266, "uuid": "92f508d7-0220-40c9-93cd-3e1d6c65f5d0", "comment": "Malware payload (Socks5Systemz)", "value": "acda58c09ea810d05c6003d6d2ce5ddc1623b6b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873266, "uuid": "81da8060-2818-47ae-91bf-33eb793dd5ca", "comment": "Malware payload (Socks5Systemz)", "value": "6a365898f07b9cfa43c1ef38b01489ccf31625085ddeca78f053dbb640a6b2ce9a9d2ec92cef4c8f925de786173f8298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873266, "uuid": "3e2fada3-ca18-4346-8319-a3e7a0d75681", "value": "T14E66331C84104D64D390AD3EAC36BA67DFBB3E698A350D20BD14D2FD46EB07D958AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873266, "uuid": "b5accade-65c6-4088-bc6e-c8b779809458", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873266, "uuid": "dde34c2d-f198-4b5b-add3-096529b851a1", "value": "98304:/SPB0eTXOYDXPIGK1GZcFad2F1B5Kn4gi8FGVZ6wD2isox3HJsAkzGi7ppmA:6zT++TK86EeMLGLD2A3pshtpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873266, "uuid": "22d92883-eb29-4f71-a10d-55aea8e1b304", "value": 6765329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873266, "uuid": "d0d4f92e-4c92-4acc-8b08-78173f0d541c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873266, "uuid": "2ffbd323-21f7-431d-990d-f7f14a2fe8a2", "value": "SecuriteInfo.com.Trojan.Siggen22.40889.29955.30055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696cc4bd-9dca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702920317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920317, "uuid": "9a446597-af40-4a2e-8f3a-f3b0be85f040", "comment": "Malware payload (AgentTesla)", "value": "a1f14b0b17732341dd77e0d0a8aec92f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920317, "uuid": "9352fb79-6fde-4826-bf39-0dad13ed3a97", "comment": "Malware payload (AgentTesla)", "value": "48adf9ce5731899a9181b4fad87c5e889a0416d5d844ba41e48dd5171d1aff4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920317, "uuid": "e5b1749d-e2e4-4d67-a478-c3fb6affc702", "comment": "Malware payload (AgentTesla)", "value": "0032798a37ba7676b23e2be80b5231d35bd06146", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920317, "uuid": "7cb0bf84-57d5-4a4a-8102-beaf8dd0034d", "comment": "Malware payload (AgentTesla)", "value": "68ae0d6175aef798f0543e819f9da45028f7f80fa5fa594e9645bb108df1c5d43f24836b0b7eccec8fa3b8b87bb190c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920317, "uuid": "a73ccd44-4d00-4612-a4f6-1957e7621905", "value": "T12794CF90E94CB8EAE4DA15737A3AD42C4592AFD882F4119F73663E3455F3BC22077D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920317, "uuid": "bcaba57c-446d-4ea7-abf6-bb98ded35e8f", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920317, "uuid": "e812fe4d-4ff6-4ea3-b424-d291e3f46978", "value": "6144:Zhjmth0F6wqvh9VVecFF4Gy2FyJSJFAon10dOD2MNu2nOHUTSbM4CNDEVAdfBz:8aFd8h9il24No10sDbKfMTqWVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920317, "uuid": "d2a5691e-01e3-44f6-9614-845a58bb9a2c", "value": 420458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920317, "uuid": "daf599b6-2f3d-4d01-bdae-cd3be6273d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920317, "uuid": "a2d713fb-da95-47e5-840c-b1b4720382e6", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa3543e-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702908811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908811, "uuid": "da16f5d5-efd9-4e7f-bef7-d99ab4e84041", "comment": "Malware payload (AgentTesla)", "value": "64f3243b86dab2bedfe92cb529a67823", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908811, "uuid": "7528b086-f5cc-4dc9-85a7-8493872cbd1d", "comment": "Malware payload (AgentTesla)", "value": "4915b347c5da6581fce7b9f57c43f2142a6e2b461702b987a7e9e6459badb882", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908811, "uuid": "d83f5e22-e246-44b1-a1f7-a9c158d1b6ec", "comment": "Malware payload (AgentTesla)", "value": "112b7681b3b26b0760cb4e226b02f0da88c07bea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908811, "uuid": "1a095a6d-53af-4661-95a8-6a4f14979942", "comment": "Malware payload (AgentTesla)", "value": "c12f4ffccdf87f7ee6a409ce6fda1ff868bcd1ca81e354160ec6f6ab1ae970d5ae317e7f07670015d21552298d752354", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908811, "uuid": "42bc189e-b407-4c1f-9a74-d957631502a0", "value": "T1B01579E073029492C656BB33143585712265AF2E5F6EC17B3A89FF5AADFB2D0CF22051", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908811, "uuid": "abfcc2b5-50cc-46f7-b544-3424ee80008e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908811, "uuid": "2f87059d-8441-41bf-b9d1-25a98d1dc8ec", "value": "24576:Swk1wFjg29/hmFKBReBtPubPYqO7Mfu67AXID/FMNU:1kWFzhyKBRItPucqOQfn7AXo6NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908811, "uuid": "21c54576-edd7-4f65-96e6-869bf5d042f3", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908811, "uuid": "40b3ac78-4e5d-4f69-9d7d-bc6461597115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908811, "uuid": "f67c36a8-a0f5-40bc-b341-b262d80f9a2d", "value": "AWB #150322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd67dd46-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1702880085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880085, "uuid": "abf427e1-bfc9-4f2a-abc6-7d00b0e565c2", "comment": "Malware payload (RiseProStealer)", "value": "589d8f48e989f5c5bdf5398c1afe13a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880085, "uuid": "6bd42734-9a6a-4a8a-95b8-a901ffc885c4", "comment": "Malware payload (RiseProStealer)", "value": "498fb5d3430b064a7ce4dbdf5934cde9a584838cc676e7c5270734c1b59d8f51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880085, "uuid": "a8701301-353d-4dbc-bd41-41fc0f1cc326", "comment": "Malware payload (RiseProStealer)", "value": "4c30223f4b0b6f5de590abb5bfa69f7fa7f9efb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880085, "uuid": "a0717f22-58b0-4b9c-adf7-ef65d1f1ac60", "comment": "Malware payload (RiseProStealer)", "value": "e5e5fb6bb222eca989aa815bb861a63c375f83a82b02c6253abaadc0dac65f150bffce158f59e9c2181f7363cdfca911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880085, "uuid": "3ebe448a-cf12-43e0-a0d0-be5acf302791", "value": "T17F25121133D045B2EA3396329A6EC7B5265EB0669F6229DF2BC419BF0F351D2D73130A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880085, "uuid": "8e77dde9-ba55-4745-93bb-9af409ebfbba", "value": "25c5b39875f5a4f6c67ff13501770773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880085, "uuid": "b6eefe00-2ec9-4798-981b-12a8025297ca", "value": "24576:NBGAF3LrdCTOjjeU91SRWz52Mzyp3TG4Rx:XGIvlneUmRwij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880085, "uuid": "815fb45a-d469-4cca-9590-6feffebe49d0", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880085, "uuid": "f71125e5-d1f4-40b6-a1ed-8b5e8d1228aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880085, "uuid": "22aa2055-a849-4438-ad70-8720993a8ad6", "value": "589d8f48e989f5c5bdf5398c1afe13a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee8d667-9d98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702898744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898744, "uuid": "a58ee3bb-de94-4b0e-b749-a345d2825426", "comment": "Malware payload (AgentTesla)", "value": "19b63cba1326e939bac9efdb146f5d31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898744, "uuid": "80e20e15-28f4-4860-a358-2f5cb8c3bba5", "comment": "Malware payload (AgentTesla)", "value": "4a0a2c6bf6a863c1c56fb7b6657fd8cd60369e03fb40d8634eb5ee37d8575390", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898744, "uuid": "576c8ff2-c44b-4442-8643-1a4538697400", "comment": "Malware payload (AgentTesla)", "value": "49dd9d7e48b4b45bb0bcda8542068d93b75414b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898744, "uuid": "71974692-5dc5-42a0-bec5-2832c10a7157", "comment": "Malware payload (AgentTesla)", "value": "a0e84076fd42550762ff549647d83c48731df2a33223bb36dc7f9e640710ff7cb817b933b162e2f20b1ac6b65d9f17dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898744, "uuid": "7ada7c6f-3a25-4495-a39f-2f6c8b84d7a4", "value": "T1272502B60E2ED819D6913CBE6513C6982FB8D0122B1CF389DAE15DEF79ED39168C5043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898744, "uuid": "5f442192-2a97-40bb-883b-5ecb97971dc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898744, "uuid": "2a906fe8-b4cd-4109-8cff-c3459bd232dd", "value": "24576:7wk1bddEZOhsoWQc2KF8ul8lwqHH95Gv9WIsGayy9:MkreZOhsw46u/qHd5k9WkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702898744, "uuid": "50cc82e0-cbbb-4803-b6b1-2492d34be990", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702898744, "uuid": "863f8271-d3db-4d08-b4df-fd98b759e198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898744, "uuid": "dd5c7912-cc28-475c-b0cf-6ce2019dbe56", "value": "Outstanding Invoice For PI91128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c67dc1-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889499, "uuid": "fdda9f22-d576-4dbc-a31b-e259b7cdf4e4", "comment": "Malware payload (Formbook)", "value": "876f47076ab4a71eab579874e8ffe985", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889499, "uuid": "5adc0952-5226-42c8-bebc-d3fe8660ddbf", "comment": "Malware payload (Formbook)", "value": "4a34fe65ddd4931b016c6cdc7aee772f7184258c34ddbe04e71d374c7efddf04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889499, "uuid": "3916294c-2b8d-412d-a62d-32f5838807d5", "comment": "Malware payload (Formbook)", "value": "b7c43de658af4aebd2885bd4fc03f47e80d3404f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889499, "uuid": "45909a71-206b-415f-8fb5-39be66af5d94", "comment": "Malware payload (Formbook)", "value": "02e3c3bd4573d3265ec73bf9bb27701e537ee52e33ad11239e59ee25d7098389d8b0d91578591813e458e48ab90d55ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889499, "uuid": "9ffb67a5-0515-4cd3-b9c3-d4f253ba7833", "value": "T13115E33C48BD227BD6B5C6B5CBEC9827F05CA46F3150AD6598DBC36603C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889499, "uuid": "91aad08a-a221-4729-a284-c46fd52f0276", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889499, "uuid": "fbc1aec2-3d81-48b3-b2d3-78f231c06fa6", "value": "12288:fbwEx2iN30MUq0IEqLktDDQ8F+lprGPCV3FprEn7aua5TJLu3V:Twk1BHs0ktKjrGPC9Huao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889499, "uuid": "74278871-a4a5-460c-b340-730b3ce2ec5d", "value": 960512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889499, "uuid": "be7e86bf-ea19-4999-bf9d-dc291f760ed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889499, "uuid": "ec06d26f-74e8-4667-b4ba-087f47510753", "value": "PO KIURE29013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5310ef8f-9dff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702943043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943043, "uuid": "ca140728-7d6c-4adb-b29f-99b50aeef810", "comment": "Malware payload", "value": "4af2d6ad597bca3b44150e18f548c03f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943043, "uuid": "b724af9a-e516-4541-9a1c-b1c6e32c9c79", "comment": "Malware payload", "value": "4b5573ed9745b65027add9bfe3d7fc1a5b9eae9950c4e9527a0375305c185b57", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943043, "uuid": "07415ebb-8d15-4fb5-b5a4-435818fd35f3", "comment": "Malware payload", "value": "915c1708998ae07dd14ab004a5fe82b90f4dfb0b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943043, "uuid": "c30826f9-4bec-4a4d-a543-343b96e02a8c", "comment": "Malware payload", "value": "a9d088eb12b8f27c8f3599d6685e021036817a894e22c66aeaa5198135be9e83204879594e9f9ef5c2b3f7eacbdc3c54", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943043, "uuid": "0fb67134-b444-45de-8938-7447e5d68526", "value": "T1FB85AD017E84CE11F0199633C6EF494887B0A9516AB6E32B7DBA376E15133A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943043, "uuid": "02f1dc7a-4aa7-4d58-abe3-e24eca773324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943043, "uuid": "de03cdde-9cf2-4af4-83f0-26e5c92f0e10", "value": "49152:mhjAJVllHZrhbBruPk+xjSMX4ODTDF8OcFSkMh:mgVTVXYNX9mOWSkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702943043, "uuid": "a179bc34-8543-4894-bb54-940eb01154f7", "value": 1860096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702943043, "uuid": "f69fbe51-ede5-4175-93b2-207be5b0a167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943043, "uuid": "dca12c17-bcee-497a-b736-9332b13d1c8f", "value": "NGZLsNu5SRCJTC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb3d2bf-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702925587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925587, "uuid": "63402c99-2b83-49a0-a6d5-ee20e23b443e", "comment": "Malware payload (GuLoader)", "value": "80f817e514cb061ba083ba72026880e4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925587, "uuid": "28c7710d-31fb-4ed6-b9fe-df8e4dffcfd8", "comment": "Malware payload (GuLoader)", "value": "4c012a5371d6a2018d0f89e36469a133dbe6d63296f131ecc7c281cbdedc6416", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925587, "uuid": "32baf2a9-81a1-466f-9584-e09d90ca921b", "comment": "Malware payload (GuLoader)", "value": "cb91ff171a0b2a655ca1f6c022269b1c1eb9ef28", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925587, "uuid": "86498166-9072-4974-8470-487e2573eafd", "comment": "Malware payload (GuLoader)", "value": "ead6207d117e897b0db8d3f43ae13bf65aa49b69dd8cd58b4d0892a49085829dadb415783106c3e7f30f3d09ef2d24a2", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925587, "uuid": "1423b025-7602-49a4-ad0f-506cc14c1329", "value": "T11F23E4ADBF5BD619CC7B2E5DAC404847F0E98D374213502DBE95078E60065B887AFA3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925587, "uuid": "55f0f6bb-ad41-4d93-bd9b-ada89798be8e", "value": "768:NQh/CQssd3TrumVaWGleQJKFifVXZWAWMaX5XVqB24nwmB8CeaOSsSL/Ge:N4/XsIVV+e4XoJ5XVqB7n9kSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925587, "uuid": "8c50ce2b-622e-4c7f-a8fe-7759cd5d8bda", "value": 47253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925587, "uuid": "36dc583f-7d4f-4461-9862-9c40f85790e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925587, "uuid": "b83db6be-842d-4805-9be8-1ccaea5a9f1e", "value": "Pagamento- K102023.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d53147-9d94-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702897249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702897249, "uuid": "9ae1da89-3200-4429-ae48-cdff49f64491", "comment": "Malware payload (AgentTesla)", "value": "bfd67488f9119ba5429dc8a0af814c78", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702897249, "uuid": "226d06ed-570c-4770-af75-a42714eef2e3", "comment": "Malware payload (AgentTesla)", "value": "4ca0e4fa7acf9765dac61610aad74416d08f53439a8f653147e3e936f0adb051", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702897249, "uuid": "43282172-e131-46eb-8e29-faf53af6c4dc", "comment": "Malware payload (AgentTesla)", "value": "cb5097c9c4b6202bbe5b567bf6e914586260f20a", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702897249, "uuid": "6ae1d16b-cad6-4feb-a015-2308685e904e", "comment": "Malware payload (AgentTesla)", "value": "2eb01bd940387299ee06b03fa5d9252257481503c94138c41966d321352ff58d605e296af822bc6cc7106a6ec53dee4b", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702897249, "uuid": "59011bf5-b06f-4bb1-9e7f-0d9a03de624d", "value": "T16415DFC5E98565A5DD18ABB06A37CD3542233EBDA874A46C28DE3E273BFB3D31025017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702897249, "uuid": "fcf85638-ff63-4133-bfa4-4c8a55262dd6", "value": "12288:WPR00WG/pREqtod3MH2m5IHQ6M2OH8BosFQkDwrPxOqkX8X4C5VEDy7MP7r9r/+l:s0SpVtgMV5YnM2BskgYC5VEDOM1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702897249, "uuid": "a71c3d97-98a5-4fb9-a275-e106fb30996a", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702897249, "uuid": "1c608aa3-42c7-473c-b93e-fd7d13c6b4c7", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702897249, "uuid": "90b9c0cf-f22c-44b8-9f4c-1984a8e15638", "value": "TT Copy 20231218.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fc5297-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873234, "uuid": "6d15289c-8de9-4df2-aa31-4dae34c57a0c", "comment": "Malware payload (Socks5Systemz)", "value": "b9d754d196e23335c9d87da63dfc5492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873234, "uuid": "037e76d4-09fd-422e-9446-debb003595c6", "comment": "Malware payload (Socks5Systemz)", "value": "4cd3e2d99274c14ffa4dcd76cc9664a7d323c1cf3c29ce3f03f01823bd4f1a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873234, "uuid": "a416c94e-5972-434d-9be2-8bf79ea8b70f", "comment": "Malware payload (Socks5Systemz)", "value": "eff46bcef0782e36776fa66ef2ff873443b58e38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873234, "uuid": "bdeca4d9-b095-480d-a9b8-c673d5261626", "comment": "Malware payload (Socks5Systemz)", "value": "dd555471778f042379d728976d3f9a6461d0a93774cd16f2f0debd645f985141291eddfd7de11e647964cf82315aa9b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873234, "uuid": "b0a60dcb-d4da-4a46-9507-107f4971c487", "value": "T1E06633D7A3290439E4A241B5D231D14B8633EEA61D63A90D9A9C0C59FFBB01ED5B7FC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873234, "uuid": "77fb2f0e-845a-469d-bd7b-1bba6ebbd0f6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873234, "uuid": "4dd453a6-963c-4715-9990-596f0446f23f", "value": "98304:wuBqzPyxslK+oJnlVGZoWYrIBJDmMis4PY3GQHQdLJ5XbWw5jjRGqULvrEwmemlF:lyymlKBbUo/r0wKHQdJwwNRLGzmlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873234, "uuid": "0a533021-d634-4d02-a631-ce239d417ada", "value": 6770166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873234, "uuid": "cf096639-165b-4cec-a445-d7cac944902f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873234, "uuid": "294814aa-cd59-4897-8173-73275e8a9c2a", "value": "SecuriteInfo.com.Trojan.Siggen22.40922.17747.3927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ded642-9df8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702940313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940313, "uuid": "caa2e15b-c7b6-4d78-a63e-338e09bcf6b3", "comment": "Malware payload (Mirai)", "value": "d496980456e0ec115af8b907d22d7152", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940313, "uuid": "6b34cfef-9c1c-466d-b742-e95f13fc3a62", "comment": "Malware payload (Mirai)", "value": "4e92df6602ddfeaf2c133cd12ee78e886a9592d5a57a5ebd7067fc829a789c19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940313, "uuid": "66003e86-d27e-4c1f-bb1c-00ad790d140c", "comment": "Malware payload (Mirai)", "value": "474da78602b958592ca21387c7f91072c2f846d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940313, "uuid": "014d00a5-fa00-402b-b4b0-fd32869319a7", "comment": "Malware payload (Mirai)", "value": "eb833ba3d59e0e86def67f36d9499eb2c726a005652fce477f2aa4f90d6aa2065a9cae0da857284b514d0261fdfb0086", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940313, "uuid": "b8175a7e-196c-4b16-8163-5b9b789973d9", "value": "T1C433FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940313, "uuid": "97a272ac-a707-4106-854d-11094cf398c5", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGK:r/hqaJMeteqK806MHdkfQX6HuCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940313, "uuid": "7a7a7370-26bb-4b7e-a8c3-81d611de170e", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940313, "uuid": "ebcbcbd2-8668-4f4b-b3c4-ca1bab9de6ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940313, "uuid": "73a21970-2eff-4544-b0a8-a83e2dbb83d9", "value": "d496980456e0ec115af8b907d22d7152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1725feb9-9d98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1702898704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898704, "uuid": "958fff07-fae1-40f1-93c5-5a76ff4eba0e", "comment": "Malware payload (XWorm)", "value": "98632ff61f6bdf36e858831114f7255d", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898704, "uuid": "a30217dc-b7ca-4dee-847b-44c2a501c941", "comment": "Malware payload (XWorm)", "value": "4ef5959548bc14b431405fa6b7447fed08dd6600848605f2c90914425da2071c", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898704, "uuid": "85d812f5-63b0-43e4-9f74-33af30d6e1a8", "comment": "Malware payload (XWorm)", "value": "a21a0c03240083d405b5c8aa24d83ea189b4ea23", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898704, "uuid": "514151e2-caad-4ff3-b42b-f43ee9ff7bae", "comment": "Malware payload (XWorm)", "value": "105a92907da8496c5d32253c98a69ce896c13d271eae1c2b8d8d052945b4c05f799b312b1c18ad4eb2fa917c9db110d9", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898704, "uuid": "0accbd9f-1080-4d32-a87f-61e71e2b9c78", "value": "T1B145EC126BD90059F236663203F47311A7B4F93173AAD66F739C134D4FABA80DE6099D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898704, "uuid": "7b27bd67-f254-4f14-9c36-b0a7988907d2", "value": "96:5tL9tin/nU/JNxPQh542vBYBUzfBoGBMf8fi:7L9txNxPdZUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702898704, "uuid": "bf437062-7409-4dae-9b42-d1ea78bcddc0", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702898704, "uuid": "f2dab2ca-66a2-4d0c-a456-c8fbbde4ffdf", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898704, "uuid": "805f60d2-3186-45b9-93f1-6a7152098b3c", "value": "statement.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80afc914-9da0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702902317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902317, "uuid": "8bb5fba6-a33d-42f9-91b3-79ad60227dac", "comment": "Malware payload (LummaStealer)", "value": "3ca35f9ab86c24978de9677b9beba875", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902317, "uuid": "c6f900a7-a983-4c2b-b7ed-05105f1a0a13", "comment": "Malware payload (LummaStealer)", "value": "4f21b13659c11d2179c8f1670141f894a05cc7e63e8aabeddd7bf864c3b84e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902317, "uuid": "36b09ab4-6e79-4bb1-99e1-13796dc97718", "comment": "Malware payload (LummaStealer)", "value": "146a291fcf6bf856b9cb023f8cbb418232940da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902317, "uuid": "065b9294-b758-4b34-9ae0-54e7370f90c8", "comment": "Malware payload (LummaStealer)", "value": "9c8ea7f2e95edf620220014ef3a30f10c6be695c32bec086daf95338e50be98546acbfc58471b8e199445b37534275f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902317, "uuid": "3770055c-e376-4190-a793-ee2a55ea7225", "value": "T174856B4576F20490C2045A3B4986D758FBE4C3932A9DB333C5670ABB1E633D29C5DAEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902317, "uuid": "526c8a91-87fb-4636-bbe4-6ae345e800bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902317, "uuid": "8767c2ef-fe17-4509-a779-1991654b1ec2", "value": "24576:rN7WNrNN3Vd5oJHsdjVqMW314F8MrfJWmXuwgHrKka2pV6NzssPVYcnAEojsuhhq:hoj5i0BtsaumXvka2pVIsAVYcnA/Qu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702902317, "uuid": "79896928-6f1e-413a-b30f-45227f4a50e0", "value": 1754624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702902317, "uuid": "1b27bd86-8e19-4d36-b270-c5702689678f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902317, "uuid": "5c3892b5-7c5a-4155-b590-361271766e89", "value": "4f21b13659c11d2179c8f1670141f894a05cc7e63e8aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba6c4ce-9dca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702920213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920213, "uuid": "e03f503a-1292-44c5-9da4-404bb2b940b2", "comment": "Malware payload (Formbook)", "value": "845ce990d339637992938a0b65dedbb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920213, "uuid": "c009cdf8-34b3-41f5-9a83-2e555ceac43c", "comment": "Malware payload (Formbook)", "value": "4f8ef9616b1237912967776aff09a8b8fea96837f78787911ce7405ecb4b001d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920213, "uuid": "d98629b5-dc7f-497a-b6fb-5f92aee671d3", "comment": "Malware payload (Formbook)", "value": "3256e796878c7f369253f6362ff49a746ab707ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920213, "uuid": "b983b4cb-d50d-4a00-80dd-c7e63df983df", "comment": "Malware payload (Formbook)", "value": "e7520d1700057c8a5978529f9cbb4405b3af7ffca972c6af33139c225c485608e02d4792430aabfa3ed317e7fce0d7fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920213, "uuid": "6b7aaa56-fd69-46a2-b025-b38cc6b489a2", "value": "T1E915D33C49BE2237D6B5C6B5CBEC8823F05CA46F3150AD6594DBC3A653C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920213, "uuid": "98396a5e-12a2-4783-bb42-c819107fecfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920213, "uuid": "000ea57d-c1fb-484a-9887-5d72b426db3e", "value": "12288:iXwEx2iNlZF4YWX6lQFaCy7IrhVxnZxxdpZkaZoEzCd6HeiL5/U:Swk1rQq6Fa7ItVtxXZXEil/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920213, "uuid": "7abde502-3b0c-4c63-b864-7077231c75b2", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920213, "uuid": "ad37776e-43d2-4416-bfc5-d8e3c3f6943b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920213, "uuid": "d0054f29-537f-43e6-8f75-b5861db85952", "value": "SKM_Order0722112023 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9470881e-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889465, "uuid": "42a52fb0-2e32-4d7c-9264-009c0fe3d13b", "comment": "Malware payload (Formbook)", "value": "c83b057f4b72cc76a3bb50601bc5cf48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889465, "uuid": "7d4d9a10-861b-4b59-b262-7697ed3080ab", "comment": "Malware payload (Formbook)", "value": "509d26a3a48377b80a4d00e8041756a446b2744729682aabae20b396ff09879c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889465, "uuid": "2b4b30bb-5e87-4ef3-b8ec-3a1611102618", "comment": "Malware payload (Formbook)", "value": "3b64176c99598532bcc734f5bc70f0af0285d267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889465, "uuid": "55892bb9-0bf5-4145-a08d-adf7d61a4a5d", "comment": "Malware payload (Formbook)", "value": "4a578f055d7845bcb2364eec0506041a5f06f67c896c1963f36859681f4ca614a99c652cb01ad3616c4278df8ab3fa04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889465, "uuid": "86b943a8-b714-4b68-8d32-38a530077d05", "value": "T17584235E76C448E7FA494FB04DBB974BD7F7B504C0229A174BB8DFABEDA12D2410A042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889465, "uuid": "b34908e8-1b6c-4bc1-a8b8-a58845b028ae", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889465, "uuid": "136d5983-f4b2-48c6-823c-fe6b5a9591b2", "value": "6144:bhjmb9v8giE2KY2XhmSaNTua18zJcRDYavtTrDcxExtpNhhP3Kdw:c5jiETK808z8DYavtnwydhiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889465, "uuid": "aeca36c0-6c1b-4d02-b92f-c37a469b5691", "value": 381600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889465, "uuid": "433d415e-0760-4365-a72d-ccbb1afad3f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889465, "uuid": "ad7d890b-81b4-4963-aa54-0fb841d4e5b2", "value": "Agro Alliance (Australia) RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23df999-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1702889515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889515, "uuid": "e4dd94f2-bdcb-4e76-9cb6-6efa8d6ae881", "comment": "Malware payload (Loki)", "value": "1d8d9fd7f2de9f0c23f4841784a0b860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889515, "uuid": "aa77833a-2017-49dc-b0a9-0afeaf06f1bb", "comment": "Malware payload (Loki)", "value": "509f9d3065054df28846986ba9a1190361092f3bad865d77ef2ff10d32151ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889515, "uuid": "68aebfd8-e8a7-47b6-aa3f-10dbaaf92d56", "comment": "Malware payload (Loki)", "value": "4586fc6e6fd72372e5f68515f922870f3fa96dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889515, "uuid": "9c92fa80-943e-49cb-9c5b-5a67987dd9d8", "comment": "Malware payload (Loki)", "value": "d523cf70666adb42e88b86ccfb89de78c5f4b0d3f730222500e32fca96a43d9977fa0bed58a641be41bf1af48a81a9b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889515, "uuid": "f30f7ebd-679e-418b-9236-6b0e6c93cac0", "value": "T1A0B423592BA4C337DBBF83F6A411647247B9211DBA5AFFA8CDF471DC4492F408261623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889515, "uuid": "ab9cb1f2-05e5-4567-b511-af573c8b1730", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889515, "uuid": "de6f6ee5-8977-4117-9c75-bc649e8eafcc", "value": "12288:2EF0oLtU8TQWHxO0c9cjjrS/Un4Kl/N5TfZP:2pgeApHxeyjIU40/HZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889515, "uuid": "a6eea16f-34fa-497f-b298-0efd1b0e9ebe", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889515, "uuid": "b88d687a-7217-4e31-ab6e-a888aab70ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889515, "uuid": "c6c8d349-00b8-42e2-804f-45998086aa02", "value": "VS0880000452_202312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab235687-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702925581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925581, "uuid": "a8c2976c-b6c4-4308-9ff8-572ac6e32b30", "comment": "Malware payload (GuLoader)", "value": "d30c0d6ac139abea635d5238c64b7101", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925581, "uuid": "9e8d07cb-9efc-4a77-af54-af765eb90d05", "comment": "Malware payload (GuLoader)", "value": "5111fc70781dae71196f0f661b22448f386c3fc14f902d0aeffb5790ed8c2fb4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925581, "uuid": "bbbb8dd0-aecf-40a7-a0e2-28b3409fa801", "comment": "Malware payload (GuLoader)", "value": "b54b1258b14a3e163ceff7d4a3b5d7fd7705e946", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925581, "uuid": "bfa2b2a7-180c-484c-afe3-f17ef59d329d", "comment": "Malware payload (GuLoader)", "value": "87980ce448c688ed61b2ec46ce4b581e893ff8b2bbc931e004c22fabab13bd1c02bf767bc0e5965dbe5ea5046cd07bcc", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925581, "uuid": "a57f6a9e-fa29-4135-a465-31a8823692b5", "value": "T1662329A1CB951919480A277ADC037B80F97D8CD60536E0E9AD9D038E230758C9FBF71B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925581, "uuid": "006f6fb9-8c6f-430a-946d-9b6f167edec8", "value": "768:e0h/j5hL6wJgO6NsEVG15rMKbfGVR0AZl74sZr2sAJDxDxnfVMufuI06UL3Ge:e8/j5Im6NsCq/Da94sZrWlDhVMCqzLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925581, "uuid": "e30ebe82-4203-4df0-b84b-6d7ee5b84d22", "value": 47413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925581, "uuid": "220129e4-2b74-4722-84f3-9dffa5b41390", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925581, "uuid": "c737c80c-e88c-4d25-9e60-71a0421b30f0", "value": "Order Mr. Pastor.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f4e831-9dac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702907644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907644, "uuid": "39be0054-a133-4102-a42b-19c3606309fe", "comment": "Malware payload (AgentTesla)", "value": "dcfae0202a40716e471021ab97fc6e29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907644, "uuid": "cffd210f-5382-4862-8974-d5e859098af4", "comment": "Malware payload (AgentTesla)", "value": "51cf9f85e81dd5073791de0b1a763e2702faf95aa30ba4f879d704b24eaf7e56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907644, "uuid": "41ac7ab1-46b0-4625-9e87-e38ad0d1a056", "comment": "Malware payload (AgentTesla)", "value": "6bd8c97f63f9e8a8734a7976d700ed41363c51af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907644, "uuid": "a4555c5a-d0df-4fa5-a2dc-f7b3e2633ce2", "comment": "Malware payload (AgentTesla)", "value": "9acd559b440a25d7dd55c936efefacc08525be1a2485e95b495bde74579882a100b6391bb381b9d91d512e2a100274cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907644, "uuid": "7dc18515-83ec-43cf-9bfd-06ecd8e66b8c", "value": "T127E433CD143F2E4327D90AA8E2EFB532E46F6D538105D2BAC5D68E1BD4D072075ACBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907644, "uuid": "d2da35ed-9e45-4f0d-b338-d6ca2a5bdc48", "value": "12288:LG1asnVz3P4dLRukHevuvyM7N2hVq2FZlr3a/SFfaEytFQ+W1qV0G:LGYK/4d1ugpN2hJZ9RfaJtFQrcV0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702907644, "uuid": "e6cabaf6-0d07-4c22-9669-c3caaa78c910", "value": 693811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702907644, "uuid": "b309ac5b-8ec9-4431-9eb5-69e7b1369a74", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907644, "uuid": "4f11a365-043e-4900-b7bf-ff49db91be14", "value": "payment slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c947ff7d-9dd0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702923055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702923055, "uuid": "6f603ef3-5a00-4260-be08-08dd1a96003c", "comment": "Malware payload", "value": "a87634abcfe030d5fc41612a9c1d2dd9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702923055, "uuid": "254b951d-2c3a-4605-808c-bf165a4cea38", "comment": "Malware payload", "value": "52415f12e2a46da2a182093d2a6eed8c8273946e98c582115ba72a49e9bb75e6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702923055, "uuid": "a53fc051-17fe-41e9-a6b0-f34b2c380f35", "comment": "Malware payload", "value": "f7b92fe99e3d7baf94e726697b546d57f1f8cbb9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702923055, "uuid": "10e4df69-c038-4e94-aa89-b2305306f3c0", "comment": "Malware payload", "value": "7c4759ec8dc2d22f5080ac6905375629041aee3b9a7f8d254279b1c9315ddfd9f12733297bf2a97035311d1b0c490919", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702923055, "uuid": "e433a4ac-7927-4f7b-9c50-035e697c1524", "value": "T19FE2E163DA545CBBDB2541BB61F22B41D10D781B9E36380A9F33AB2B8C730CA4D79895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702923055, "uuid": "94ea67d8-6a5c-493a-9728-6f18582f0fc1", "value": "768:unLxcmuFze6j0omfsRYKiAMx9Xg0mpuSqQu+j:Qx+66/CYYek9Xm11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702923055, "uuid": "419adb94-bad8-470b-8bab-74669f9248c9", "value": 31379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702923055, "uuid": "c9be9166-9806-47b9-bd9d-ee1f9fc0b51e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702923055, "uuid": "28c29dc4-5146-4dfd-93f3-08e0099fa553", "value": "2360.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b092993b-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889512, "uuid": "78bd1d72-f248-40ea-ae11-c3abe9845c67", "comment": "Malware payload (Formbook)", "value": "3998175e48196c8d93366ef4b4ae404d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889512, "uuid": "ba3401e6-0f89-4a87-b744-7bdb68306e10", "comment": "Malware payload (Formbook)", "value": "531ba82cdd6f8cba501fd8c5160ec637c2193ce69c455dd8e591da083f2c80da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889512, "uuid": "1cc9d7f1-3388-4c6a-a213-1a43ae020eb0", "comment": "Malware payload (Formbook)", "value": "bc536befe9b8bcc32e9173dab5367e5bb6cc6a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889512, "uuid": "1bd25590-ec4e-4f2b-8f23-a6b27f4194b9", "comment": "Malware payload (Formbook)", "value": "d90fa593d83bfbdcce426ad660a8ed0ab0b3e03792cffbde6c06129498c3f4536e4c747e8def590e94f6b479f8783733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889512, "uuid": "7fd791dd-bc84-4ba7-985d-5806274e6fc6", "value": "T18B15F53C49BD2237D6B5C6B5CBEC8823F05CA46F3150AD6594DBC3A653C6A4278E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889512, "uuid": "dd4a1b86-922a-46d3-a5a6-f4898ea9b039", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889512, "uuid": "c02a6892-2f06-4f79-9bfe-0df59f472239", "value": "12288:6AwEx2iN1MFKSta6XSvezReUwsvXcFj7ZG3PmYks9gY:9wk1QFKSta6Kez1DfcFvZGOKqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889512, "uuid": "e48e757f-fe3a-4f7f-a341-f361ad856ec0", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889512, "uuid": "7bc6f469-fa8b-4625-8187-97aa03d5bc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889512, "uuid": "9feeda4e-3bf6-4cc1-bcd3-76d6f3a8a8ea", "value": "SLIP-full amount-50006654455339877322346689377782.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605b8fe3-9dd1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1702923308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702923308, "uuid": "38607748-e51c-4634-b968-68b41cce471e", "comment": "Malware payload (QuasarRAT)", "value": "87f75a6d940a2eccb60a7b464c91d8a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702923308, "uuid": "9de6b5ea-f2a2-4044-bfb6-27c86dc039ff", "comment": "Malware payload (QuasarRAT)", "value": "534de4e71840d12e43eb51ce41a594120695573da71989667c71afa614ad656c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702923308, "uuid": "3f7f836d-01d6-4945-8744-4eff9b05c38b", "comment": "Malware payload (QuasarRAT)", "value": "8c860099af4cc3be3270b0b0f1ba9e96935dfb39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702923308, "uuid": "8969ce7b-7d39-482d-87a5-25724290e213", "comment": "Malware payload (QuasarRAT)", "value": "8377b922c36ccab7cce680d35762dc4f31276badac751312b33e23fa5f4e67f8d70ea3b910ba8f009a4a8e141023194e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702923308, "uuid": "bdab0395-401f-4177-ba0b-6ced75edb7ec", "value": "T12EE56B0537F85E32E16BD7B3E5B0501263F1F82AF363EB0B5181A77A5C93B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702923308, "uuid": "52dd716b-919b-46dd-b563-ba7dd0ccd421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702923308, "uuid": "ef089bb9-2162-4f63-88da-164a1a058193", "value": "49152:KvAt62XlaSFNWPjljiFa2RoUYIQzB3+yoGdshTHHB72eh2NT:Kvs62XlaSFNWPjljiFXRoUYIQzB3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702923308, "uuid": "b74af236-8a71-48ec-8981-8ffff6d92028", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702923308, "uuid": "ffabcf39-a580-430d-8b84-10fa7bcfb8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702923308, "uuid": "7dc713ec-93d6-486a-b1bf-bcad9ba6d60e", "value": "87F75A6D940A2ECCB60A7B464C91D8A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c86add-9dcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702921440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921440, "uuid": "8666d399-c695-474b-95e5-d91cf6391998", "comment": "Malware payload", "value": "fb925c8f0c9335f8a6a68b3d2a8ac415", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921440, "uuid": "ebcba86f-4a0d-4f72-ad7b-93a1121c9d9a", "comment": "Malware payload", "value": "53d183abcf0c3e5b5809b9131d6f6114872723d505d5fbb5b6b188981d33af90", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921440, "uuid": "82a6ea8c-e0a7-4ff0-bafe-36c1f89102db", "comment": "Malware payload", "value": "3101bfb531adb68b21f0b4e0cece9d032abf7345", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921440, "uuid": "6e968b15-6df6-45fa-8062-f4b2e5609949", "comment": "Malware payload", "value": "aa9d045e883aaa15ea7c0f39895c33e1fc0a3b452db62bb8c6c5e7856e4111c7f905cffd6ad243323fc8e2b42a1d466c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921440, "uuid": "aab1ccfd-ef17-4798-b051-f9d559192ce2", "value": "T127E43328452091B3F46B6D356D63927876BC71EF3DBA71AEE810E312FD0AD922621077", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921440, "uuid": "59226f07-bf05-4585-b536-2daf9394a02e", "value": "12288:jh/ePJhs9TjRcM/MocKssvuIogiVeH5mUUcTgGrXSQFLrFN/:juQRcM/hcKsUmJiUvGXXVN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921440, "uuid": "c06626a4-ed37-4ab7-a27d-80d2d668fcce", "value": 693627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921440, "uuid": "76a481bd-06b5-445e-b3c0-156a2d4dc2b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921440, "uuid": "7096429c-1082-44b3-8d44-bfd92b4f8d33", "value": "NEWXORDERXPO-20874.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a586ba53-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702908821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908821, "uuid": "5cc4a35b-3381-4004-92df-a554e07db1de", "comment": "Malware payload (Formbook)", "value": "9f8d5a08bd41de7c85f7a53789243b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908821, "uuid": "6701e832-e436-4b02-8d46-8c01f18c078d", "comment": "Malware payload (Formbook)", "value": "56cd0e12747b872def87829710c32165fc42e34ed351872e1750fbc13a8c31a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908821, "uuid": "af93d02c-3a47-432d-b2d9-743c8d6a8ef6", "comment": "Malware payload (Formbook)", "value": "6fa14cc1f89bcb6fee6f3464bc2f193837c70c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908821, "uuid": "269de058-8a36-4748-a74e-1a4ce4727c32", "comment": "Malware payload (Formbook)", "value": "55a2df6ada143f85b753403a788d937988dc97cde5eba011169c375994f392b6a7806328791d6166975cef845defbb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908821, "uuid": "0f87d5c8-1614-481b-9518-aa423d3dc0e5", "value": "T14525C33C487D2237D6B5C3A58BDC8427F26CA46F3151ED6598DA93E213C6E4278D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908821, "uuid": "2ea017b6-1d3a-4a8e-9ce3-b84f26d5d734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908821, "uuid": "749c4557-6a3c-4eb7-b59e-7f8abe6fb621", "value": "24576:XzBzKWisY9ER5iZZodeUmtoHFnlwUq/x:XzQPpsZkrtWnl5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908821, "uuid": "838fbd3d-1e1f-4f94-bd68-e3e51721c154", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908821, "uuid": "f737ddd9-6bf0-4a3b-9883-9acc24213059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908821, "uuid": "a5b35e13-7063-4ee8-974d-35e33200080e", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cb242a-9d98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702898965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898965, "uuid": "5339a97b-24e9-41ac-85a4-9ad27900a042", "comment": "Malware payload (Formbook)", "value": "7cc3e9ec3cff7f7fe3717d21f360bab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898965, "uuid": "35bffb1c-ec35-4e61-b260-7ff8ef824c99", "comment": "Malware payload (Formbook)", "value": "5721a2c6e2c0a577828b9e4b3690a18a7df63e541aeba65781464c1f73e8da91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898965, "uuid": "5add42e8-f29b-4b40-9157-cfb36e657cdb", "comment": "Malware payload (Formbook)", "value": "7ed47fd51ef28fbff520f72ab8249aff20b84776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898965, "uuid": "9167a81f-8735-452b-ba52-5f60b1cf21d0", "comment": "Malware payload (Formbook)", "value": "4214f3122fd135919c2a1adbf33a062de477c201e23aacf42693731653cf17c1ba7e879e4a4d48f50c4b2002fda48b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898965, "uuid": "25965f5a-337b-4e70-801e-f96f349faf8d", "value": "T14E25C33C587D2237D5B5C7A58BDC8427F25CA46F3151ED6588DA93E603CAE4238E322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898965, "uuid": "aa7508ff-9ff6-47e8-9650-247918f10ab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898965, "uuid": "a1e850ed-f104-4693-a3a2-3e78c989beda", "value": "12288:vGXDY6thnfHW2uq7AmJ6smFA1zzi8oT6QQzFMK3IpRy0VNT6nThNlYTq076L:+zL2NUAI0A14TPQzujVNMhN8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702898965, "uuid": "52988eb9-37c8-490d-8f0f-94b074751ad6", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702898965, "uuid": "94acfec3-71d1-43fb-af85-16ca2682bc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898965, "uuid": "d6d79f7d-0aed-4278-a5f8-c66251c70c2e", "value": "SecuriteInfo.com.Win32.PWSX-gen.20426.4566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976647f2-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889470, "uuid": "e06b10b3-70e2-4d65-ac9b-fa1d0a13dd04", "comment": "Malware payload (AgentTesla)", "value": "0a7ec3f9a7f83ef8505b6c58ec9bdd2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889470, "uuid": "8f8a6a9c-9f84-4f48-9fa3-addac63402fa", "comment": "Malware payload (AgentTesla)", "value": "57a28713c7beffa950e2b4a028d57b4d52dd1b3a523cfa2d47503564892b8aba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889470, "uuid": "792007b6-ea36-415c-8427-3e0f69b06e7f", "comment": "Malware payload (AgentTesla)", "value": "cec49e667f92eb8134a941c8914bbea162ece4d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889470, "uuid": "e82a52b1-8811-4416-a2e8-d3a899fd276f", "comment": "Malware payload (AgentTesla)", "value": "bd110eefc3e4e6a5910178e0278e5d5dc4d12a6e26a5c39590930516d3aa1bb16858b517f8dedb0d62394fa5afdc1114", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889470, "uuid": "e93cb2c8-64d5-447d-ba05-f475abf2e011", "value": "T14C45D068E1B7F428F0E966F5AF106BD3637100533A16D98ACCAED553305C9DB8BC6C86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889470, "uuid": "4c8d838e-e19e-4315-b3a0-fac7d71633da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889470, "uuid": "a05220ce-5a10-4701-9ee7-f7376c6fe6b2", "value": "24576:/VYExSh8UjK4zRqhqcShFaRRb8rhych3wsssIVP3:/VYn1RqhqJaRRePBw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889470, "uuid": "4fd042b9-ac28-4ff7-bd58-7910d74223b6", "value": 1248256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889470, "uuid": "efa2bce2-bfa8-4449-99e9-63e86f13f83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889470, "uuid": "898a9365-22cc-4f1d-8b07-702b1b8c24d1", "value": "CBD USD REFERENCE 3901828872899399391108390100110929111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1003656e-9db2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702909859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909859, "uuid": "4cf63991-7ed2-4198-a8f5-261a04251ae0", "comment": "Malware payload (AgentTesla)", "value": "17a523ae17b2b07353fb19d1a9593325", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909859, "uuid": "eedf63d1-ac03-4bde-ba4b-7c31b9033ffe", "comment": "Malware payload (AgentTesla)", "value": "5889d17651164539438b8f01cc545f343d3d7e2c3efde4fae6b33f7d13c49b70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909859, "uuid": "bb6cbbb2-64cd-4cc5-a74a-48e8d715f6a7", "comment": "Malware payload (AgentTesla)", "value": "b55f34f8c3866b0430fc5d526bade18392559d30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909859, "uuid": "8175e66e-e37a-4652-890c-c2fea2f4a703", "comment": "Malware payload (AgentTesla)", "value": "72691123eae73acd336f62f86cef973c73582e58f2a8473891cf1c6bd26680ca1b59ba1630fa54bf10e0e807328291a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909859, "uuid": "412e5527-b52d-4923-96c7-111b070fcb89", "value": "T14A25C33C587D2237D6B5C7A58BDC8427F25CA46F3151ED6598DA93E203CAE4238D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909859, "uuid": "3056ba01-7cc3-4567-a288-14ca85f1f7c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909859, "uuid": "646675d7-4a27-4702-b9bb-c42af533af63", "value": "12288:XGXDY6tfLKYtHmDrs0KUxnYPlTUs2xiqUljrWmFKgVtbcQwqhJass1YfCY2R:2zlTHGhn42kWmFKkx3wqHas06h2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702909859, "uuid": "04b2d127-bdc2-4e85-b5ef-bf534b5b7473", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702909859, "uuid": "565094f0-3223-4a6d-91cc-ac31fc548c24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909859, "uuid": "f567efe4-9cd1-4274-87af-757890cde973", "value": "Bank Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfca8212-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702925616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925616, "uuid": "cbb13bcc-fdf1-4e64-be20-f1dbabe07744", "comment": "Malware payload (AgentTesla)", "value": "4e56f5249b72ccabee1406ee1fccec8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925616, "uuid": "df637c09-e0cd-4cdd-ab2d-4f20d8d74fb5", "comment": "Malware payload (AgentTesla)", "value": "598fd9267e154c9fd5a5d36f5cf153a570c3265bd131cf63082b64cb4b4e7861", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925616, "uuid": "ceb6f345-67e1-44ff-9086-1a2d99f4d9e1", "comment": "Malware payload (AgentTesla)", "value": "a76ce94cff1cd952bc83c571d4f1d9ab62d5c352", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925616, "uuid": "ba9cc5bf-f26f-4423-9dc0-14c8be010747", "comment": "Malware payload (AgentTesla)", "value": "f2d1d57515752d98cbb7bef63a390fabacf4c771e05d8aeaf64e802809d4869183d5478b34a2420cbc5afabe7251d5a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925616, "uuid": "55cbbc16-5a76-48b7-a799-b8fcbcac76d8", "value": "T1E705D33C48BE223BD6B5C6B5CBEC8827F05CA46F3150AD6594DBC36653C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925616, "uuid": "32c00b5a-ca02-4763-8d7f-69da9f1f5b70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925616, "uuid": "a9a40b56-b8f2-44d1-9e43-80a709bf6b51", "value": "12288:3UwEx2iNg1NrWjZu1xcrYKJzXfS4CK8x9mmnMFIfAEONvOQRVPF804YnQ:Ewk1iw65izvlCK8ymnMGfQNv3Vd/LnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925616, "uuid": "0d985cc5-2d90-4f14-879d-43c699c31343", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925616, "uuid": "97772f49-fe56-46c1-a6ea-55eb3ca121f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925616, "uuid": "7ded6d90-3bf7-42b9-b214-aa667b21be8c", "value": "TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0305b84c-9dae-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702908119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908119, "uuid": "e7d37acd-b361-498c-a2df-d99964e7108e", "comment": "Malware payload", "value": "8c5b0073ebbaf46a3c787a3875dbb052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908119, "uuid": "c3d13dc7-4b2e-4151-bc87-98ce52298e10", "comment": "Malware payload", "value": "59a981793ed1613a7e0c44f5fa6b4889e27129e0200fe792d6e580329313a503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908119, "uuid": "0906d41e-f234-49a6-b94b-cfc6ca966741", "comment": "Malware payload", "value": "099ffe5d858492f90ba4edabef6fe09b36d16f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908119, "uuid": "7eda2244-7be8-4400-ab81-268b937c6020", "comment": "Malware payload", "value": "ba6a843aed2d0da40a219e0cf69a56bbd4d46ed142768e2048e6182db201ec4f240d54cce6a37322c85b8acf27f11c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908119, "uuid": "c84136d6-b8e8-4a08-b04b-cf41619fb792", "value": "T19C65F13BEF964113D3AF86B08C3654ABB915AD677001BD8F6ED22F511532603B4E922F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908119, "uuid": "a044cb43-51a2-400a-a926-088cd7ef21ab", "value": "89cff462cd276a564b3e08ad374d5f52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908119, "uuid": "6f13edeb-dbfc-4710-bdf4-db77497001be", "value": "24576:gaERpFdzZLBGI/peoRU86xKF5XErUBG4bG7hD:qB7LRUM5SUSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908119, "uuid": "f98db757-e901-404d-b656-6102fc77cda0", "value": 1422659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908119, "uuid": "f60c8bac-1702-4379-b6c0-2937fff42def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908119, "uuid": "c094683a-a7fe-4768-8c95-ed397b0b13a2", "value": "Bank Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28485157-9d98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702898733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898733, "uuid": "ba6b1f76-5313-4f46-93c0-988a9cf1e64f", "comment": "Malware payload (AgentTesla)", "value": "616075cd1b543434cf4d35606a3f5665", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898733, "uuid": "dff86bf7-3a05-4d86-9b53-a3ea7e39819d", "comment": "Malware payload (AgentTesla)", "value": "5a712870a2130aa24fed35fbc5ff8a102c658826c5ef18b9b4a8378447dce36e", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898733, "uuid": "dcc0dd52-00a7-4fe0-8950-64be340ac442", "comment": "Malware payload (AgentTesla)", "value": "11da75f39a13787febf41e6323d890f6b27c8e43", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898733, "uuid": "9906f311-7811-4f80-abfc-70100c09fc93", "comment": "Malware payload (AgentTesla)", "value": "8ff6e7eea7c6602ff9137354f32aa54d5f5c6592f6de8c8671822ee4d2ea9926175b4a1097b7cfa24cf38b4492423228", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898733, "uuid": "ae699f76-4a37-4d04-96b3-1fc53789d939", "value": "T1762502B60E2ED819D6913CBE6513C6982FB8D0122B1CF389DAE15DEF79ED39168C5043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898733, "uuid": "08fb061a-6757-4805-83c8-352f982b8c85", "value": "24576:rwk1bddEZOhsoWQc2KF8ul8lwqHH95Gv9WIsGayy9i:8kreZOhsw46u/qHd5k9WkOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702898733, "uuid": "4b7eab50-933d-4249-ab9d-e4c17ff6c7b5", "value": 969420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702898733, "uuid": "a7dd8faf-7a27-4496-ae83-23352c82a2d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898733, "uuid": "b9c67964-dc53-45ec-8968-0a26005fec15", "value": "Outstanding Invoice For PI91128.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7389105-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702908824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908824, "uuid": "e150561f-0ed9-42ca-9f49-adfc7af0985f", "comment": "Malware payload (AgentTesla)", "value": "883ac1850ba248a6a1b216a92dbf2762", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908824, "uuid": "b9b50c23-cc1d-4c11-82fc-02beafc008e6", "comment": "Malware payload (AgentTesla)", "value": "5c2b89583ad4ef56ba683f0c655e74d09fe46f1f6b0a79e3edbcfc8a50b1c79c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908824, "uuid": "e969445d-af39-4be8-8512-c5c5a2c83a72", "comment": "Malware payload (AgentTesla)", "value": "1d3a09465aa840f6309e2560b5261fb3383b1d87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908824, "uuid": "3cbfea79-cf2a-466e-affa-0d62adbcf53d", "comment": "Malware payload (AgentTesla)", "value": "c28ff9370768470befb45369a771b10b34c99e90bec9354f822888621fea527a45dbfcefaad68a62f014f01036ca7380", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908824, "uuid": "7c965831-b1ef-47ed-b4be-b76ff6af3e92", "value": "T1CFE4239A8528C1C50EE923C1F92C5C92E32B4BC3257D8B7313FBC1A459721EE474B92B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908824, "uuid": "6c6b5320-d046-44ed-803c-1554c03bce35", "value": "12288:1ax4ehJlrQa/nLSziGWkPIkQ0OoAGHNFWwSVZ1SBiWz7W4shILbquavZwR:1g4ehzUa/nL4Sj0xAUEwdBiq7fGBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908824, "uuid": "9293f694-31b2-4645-bcaf-06b6bd9b9d06", "value": 685385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908824, "uuid": "be40e198-69f8-4fb1-86b5-e25958809036", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908824, "uuid": "35a9cef5-838d-4dda-ab2e-226c000c9d9b", "value": "Quotation.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f8a9f0-9d71-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702882193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882193, "uuid": "672ed222-c99c-4b78-9f35-f5ecd938400f", "comment": "Malware payload (Formbook)", "value": "23abe3c5431af82379b42e9ffb3f3e95", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882193, "uuid": "ce5316c8-0137-491a-a644-0b40259980d5", "comment": "Malware payload (Formbook)", "value": "5d2030fbc946a9391cd895d9f00ad806c7a05f4bff6e5199bdef2c32ee16861c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882193, "uuid": "92718bdf-c8d4-46a2-9815-a200fcb40291", "comment": "Malware payload (Formbook)", "value": "f79372576365563ca2e8bafb6d3c69fa8bbe8811", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882193, "uuid": "0050e19c-b869-49a2-a812-277a81ab73a6", "comment": "Malware payload (Formbook)", "value": "122ccc2bb32b603af62e4988293178772a5136f9553c6f9f021e19ac2e6dbcdcef133ac1801f02498a789ac0f69ff31a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882193, "uuid": "66ed38d8-b0a1-4a44-b338-e4f429feafce", "value": "T163C4235B25338254483F67BC61936F6C139B5CFAA07D04256C9A884CFC05B9AB36FE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882193, "uuid": "e0ab9a36-e0a7-484c-9f5a-23b37c1e73f6", "value": "12288:W/aTa8dE04uKgPy0covH7eDyLHpHD2e4Iq/sNeY4CZJzBm:RRG0Py0tbNLJH6vXENeY4Efm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702882193, "uuid": "dbcf1fce-59c0-4484-8aef-3c401523f12b", "value": 583780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702882193, "uuid": "563e508b-abce-48dc-bd8c-458d7dda8eec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882193, "uuid": "29349732-0b93-4866-8781-c176c3c7c79d", "value": "\u041a\u0412\u0418\u0422\u0410\u041d\u0426\u0418\u042f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1838f6-9d7e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702887760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702887760, "uuid": "76cc6be3-29d9-46d7-a528-8aae0b31e6da", "comment": "Malware payload", "value": "ef337b3a359ec079b271dcd145eeab83", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702887760, "uuid": "ef1b290a-461e-478a-87d5-408f34c45b18", "comment": "Malware payload", "value": "5dd39481b2ffb8c1194ffc2b82a80de84778f4b559ca6fb5e8a8223788cceba1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702887760, "uuid": "f0a7f312-1c7a-4e85-801a-a73dbde0fe93", "comment": "Malware payload", "value": "4a35508c55d1d7d6d70ae5922ce939c66e5a1530", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702887760, "uuid": "f9a7b4e6-8618-4b57-b081-5e97eca59d9d", "comment": "Malware payload", "value": "0f2d821a382e67b2dc8141572a64c2a77d3699f2875da24cffeb428747bbc7e0c694c44167a34405cbe7634dfa0b47e6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702887760, "uuid": "05853a30-4e0a-4b2e-9ef1-07a5172438cd", "value": "T1FB21B7030DD3A80C34B445E66E6D8B108843E971E57796118DA179FE79ACA35D34488F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702887760, "uuid": "6d1b2ea6-60cb-4fee-8958-2fd2498c5f74", "value": "24:ZOrlh/ji4HIpkKznkINJ23Wto8CWRP2is718McB:ZSD/jX+QINOWt9CW52iY13cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702887760, "uuid": "d551a68d-53f3-4b52-a958-d1130595d905", "value": 1210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702887760, "uuid": "da76aa51-dbb2-47e3-8e7c-9209e51dc341", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702887760, "uuid": "a8977965-128c-40d6-b301-88b3f77bef98", "value": "VipPassword.txt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965e608d-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702889468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889468, "uuid": "2953ff18-0408-4a15-9fcb-29551211963c", "comment": "Malware payload (GuLoader)", "value": "222f2cca1a46890e09274e44a549baee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889468, "uuid": "6a969abe-b65f-4790-9bb4-8fced94ee795", "comment": "Malware payload (GuLoader)", "value": "5ed5d59a7c41e1f8a8e5b0926189ae54610558297b6b6edf04449c06771fbaef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889468, "uuid": "052f98ea-2718-460b-9d9b-7b736d9cfe13", "comment": "Malware payload (GuLoader)", "value": "98d097eeea1c4b608939ae12d9a72f05a6015219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889468, "uuid": "c34ab777-36a7-4409-9373-3f859ddcc777", "comment": "Malware payload (GuLoader)", "value": "e472fb3be4d94c32f756e5d1947183032f3be026c4132ac47fce4bd9ee43fa9a0e1ff2779a022fdffdf5ea4b78e0ca85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889468, "uuid": "f5729729-e447-43d2-9d2c-694174bf6ef9", "value": "T1ECF412713FD3D827E0156CB8A34A8E4C9E32EF14A515E607E3B039AC9E772526C16D32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889468, "uuid": "785c7ace-bd85-4067-a56e-e3cb7bd8d00a", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889468, "uuid": "5b11035f-8914-46ad-bf26-68cb0112aeb9", "value": "12288:CqwwbXXyWMnGcHtjLxLIC3gmRznHVkBou/o/hyBfzj7ELAplrOeC/z3bAdTr:hLyWATHfICFzn1k164fv7EKrD+zLAdTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889468, "uuid": "fec24318-a212-433b-a597-fc223f897536", "value": 758024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889468, "uuid": "3ce8ac0f-421a-4947-b092-ea03cec8258d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889468, "uuid": "9e1ef3ad-274b-41ab-b9a7-ca3cb0a3b9d9", "value": "Bokos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe12c9b-9d5a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1702872412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702872412, "uuid": "b3861d9f-0f61-4bb3-8d40-041d2c72a8e3", "comment": "Malware payload (PureLogStealer)", "value": "82161cc1e929bfe00328edec99329fc1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702872412, "uuid": "96ad5807-bef6-48c9-9201-b5cb755d1083", "comment": "Malware payload (PureLogStealer)", "value": "5f8faa282fee3a452e2c4f3d74a5ac11483312b66b242fb923ed0f8febb341e2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702872412, "uuid": "7159184e-f277-4180-b334-5d1d3c1b551c", "comment": "Malware payload (PureLogStealer)", "value": "c26892ee45c6dd67287af91480d6d6a416c26a23", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702872412, "uuid": "f5019def-9420-4448-b618-8ed1981f7b27", "comment": "Malware payload (PureLogStealer)", "value": "c8b79b71f1d191556bf1a79efb55e8a36b9a43b0cbd46972ce582435f1ef780d52fd51ce2e46888c8e5b83498d529f7a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702872412, "uuid": "500949b9-888c-40df-8903-99610defe341", "value": "T14C249313B7A28DB2E78A177BC58F4D000B71E5417247EF1F7A9F136928833A6DA41663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702872412, "uuid": "62a72205-8ddb-43c7-b80c-2b1861ed8155", "value": "6144:+IkFOKBv0aQQeUmxsjh0BuzG8CtN9W96n:+IkFksjhSuzG8CtNU9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702872412, "uuid": "542e6318-4f65-4d77-b75f-b442338d19de", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702872412, "uuid": "d60943e5-a24f-43fe-842e-8eb17bcfa984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702872412, "uuid": "cc373687-4c91-4b9f-ac85-8c40f52ca55c", "value": "82161cc1e929bfe00328edec99329fc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27deb072-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702879834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702879834, "uuid": "63376aeb-b321-4f95-9d96-7944184c2470", "comment": "Malware payload (RedLineStealer)", "value": "0c5ff9fb952ff320b94be5c7cfd1724b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702879834, "uuid": "3038906d-6c79-4cbf-8dcf-ec0289a19e7e", "comment": "Malware payload (RedLineStealer)", "value": "6094c51477bd50374c07dc3a90c3e06491a05366de272c1fb95d66c7678d6fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702879834, "uuid": "ea06221f-cf58-4aa9-8f19-e672ee014c3f", "comment": "Malware payload (RedLineStealer)", "value": "c154e354186c46b4e9d4b994391c90503927db8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702879834, "uuid": "d462ead4-8e3a-46cd-acb8-c14d8d341ef8", "comment": "Malware payload (RedLineStealer)", "value": "c45cce915473528fc6019748491f7b76e4394c81e0390cea1c6e51d9d921bf5c9d9d8e61ae555a206801fbd0c0aa4339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702879834, "uuid": "d808e177-6f12-4e77-a6c5-0ff7b1dcf542", "value": "T123954C51F2FA5B59F9F30BB856BA6625083ABC6ACF10C2DF1265904E0C31BD48971B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702879834, "uuid": "6b8b8c1d-5598-4635-aba1-0fb86a936cdd", "value": "89f8b2136c21fa2fa4c4263b97a4b62f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702879834, "uuid": "d5a79f06-58e1-4632-8af5-5fd90ded67b0", "value": "24576:eCzlfZQP+v7ETWXHKWTKh4CpQmw05Gtrg6a9DhvhoHKJycAYZoE5V:eCzdGguWTKh4cwc6a3veHKJycfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702879834, "uuid": "8b928e23-a496-4a59-9409-f1442fb82450", "value": 1976192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702879834, "uuid": "5829c11a-4af8-4677-b1b7-ba50dc46b012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702879834, "uuid": "0082ef45-dc08-4fe5-81f1-c3c9bf83a91f", "value": "lkadgje.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a00ddb7-9d6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702879516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702879516, "uuid": "bfbf1bd6-7da1-48a0-a477-d1df5cf28519", "comment": "Malware payload (LummaStealer)", "value": "b2520ef3556faf72c9cd3f8740a3b79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702879516, "uuid": "88271f63-095d-470c-be75-e54ef17f1eb0", "comment": "Malware payload (LummaStealer)", "value": "61580a88a54a94eac16c3f8f856d44e365581b1ba266780a6c789855f23e04a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702879516, "uuid": "216cfa96-e55d-4b48-afce-7b6a00588529", "comment": "Malware payload (LummaStealer)", "value": "f7be871b5ad1809158b699cd7c3863dad48953d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702879516, "uuid": "f417a7fe-5469-4125-942b-2eceeaa07ee4", "comment": "Malware payload (LummaStealer)", "value": "d8bf0cfd1438a888de145bfa95a7f72252df42daca4b1a10f34e650a63cf79d96b72458e504e43cdafc20a6800f6ec4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702879516, "uuid": "4b70107e-57ec-4ecb-9f2a-967e22b78151", "value": "T1404523C2E6CD8130E5F61B716DFB02872F397E606C74555B2744A94EA8B37D0A0B1B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702879516, "uuid": "985e8596-82b9-4155-9b54-842fad25f4ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702879516, "uuid": "a22986d3-6701-4244-9a54-3f61570fc115", "value": "24576:cy1vLWWezuOZILd8ECfweWWraBJanqlrnxip:LNcECINT36gxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702879516, "uuid": "d89f2678-b241-4eae-bcc7-9dc4608097cd", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702879516, "uuid": "24eef3a0-2434-49bc-b5de-e0267e3d4b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702879516, "uuid": "4aa9d24d-2476-412d-9ee8-922c8bfcc712", "value": "b2520ef3556faf72c9cd3f8740a3b79e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50b04c4-9db6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1702911907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702911907, "uuid": "f524b085-6989-4345-b0b4-95610f399279", "comment": "Malware payload (AsyncRAT)", "value": "c8f4d2973312b7e98830e42f825f8140", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702911907, "uuid": "ad0d9e56-f0ee-44ec-9ba2-f74316a6130b", "comment": "Malware payload (AsyncRAT)", "value": "6455ca7100c447b8e7678a01b654925a2f2514a108cdcc2b2dc26b823a59ebb1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702911907, "uuid": "5dc0ca1e-8bfb-4ce9-b6ad-c83b716dcbd6", "comment": "Malware payload (AsyncRAT)", "value": "cecc4e03c8f18f89747c6bd49b7a4c6beafadd56", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702911907, "uuid": "328e2517-61d1-4a31-8fd5-10fd6ce876e3", "comment": "Malware payload (AsyncRAT)", "value": "98c66eedd2ad904c8f202a2d58a976066d49b38a953831b9e509c95e7282a81ffa5bc3e8731a89c2c6617138fd51e491", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702911907, "uuid": "a8eae08d-dc54-453a-ae1e-acb0ed61c4ea", "value": "T133A41204737E6E0BFAF78BF68491821957747DA56A63F1CC7DC020CA19A3B7212506B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702911907, "uuid": "863f241a-58a1-4228-97a0-a6b96218ad0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702911907, "uuid": "f6c28e38-0a1e-4a25-9a0d-b58fb2653ac9", "value": "12288:vqGR+4WpAENy7zaMx82rc4YZCMwNd5tzjybwtPd+4et/q+:opAEH2rKU1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702911907, "uuid": "588842b6-5b0d-430d-8976-eb079810b1f7", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702911907, "uuid": "85da43c6-15d4-4f77-8a75-7d6e0f5d6db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702911907, "uuid": "c18cc5ed-f5ba-4d06-84ae-a27673f60ea4", "value": "c8f4d2973312b7e98830e42f825f8140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5135d0e5-9df2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702937456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702937456, "uuid": "3d9d4522-219b-4fcd-bf71-b355658fc352", "comment": "Malware payload (Mirai)", "value": "e3d3b1119e3bf4d405734323b4c65e0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702937456, "uuid": "20f06313-2594-4c6c-853c-f21d268cf604", "comment": "Malware payload (Mirai)", "value": "6591a0a8397815c3c7e08ee21418449a2fb9305cde6c80b74fcde5fb907820f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702937456, "uuid": "9944b171-1829-4f1c-b1d6-fb8d360bf75d", "comment": "Malware payload (Mirai)", "value": "3d37384154cc0148c0de637e808db5669227e52e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702937456, "uuid": "19a45ea7-4e8a-47ad-b234-6a0186cab2ee", "comment": "Malware payload (Mirai)", "value": "66f3f9dfdf0eab0e180f5faf52495ab99c969767f722dc1e804c692153bcb45839a7fa46c81285a7142cb14fca643621", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702937456, "uuid": "6271f3fa-69b8-464d-ac93-94674a423c54", "value": "T1FFA2E1217F1DE98FCC37B27886E5E9C693D07D24D2DCC9866741C16FABA36846830E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702937456, "uuid": "cac01431-6ae0-498e-8133-7cb45ad56a2b", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtUDlSk:x98o08kxofBE+ZkXaT47C2Epitkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702937456, "uuid": "9b71a10f-46f9-41b4-8c36-a8d57334a349", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702937456, "uuid": "ad2d7f43-fad7-4926-be7b-ccd7fb55a178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702937456, "uuid": "6987dbf9-1128-4a97-8b62-b27f54103ddc", "value": "e3d3b1119e3bf4d405734323b4c65e0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3577ca2-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889490, "uuid": "4872599a-133a-4fbe-9fa4-adfaa06c9990", "comment": "Malware payload (AgentTesla)", "value": "cf1db80b7889dc88956f10ed81940bf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889490, "uuid": "6f5dc492-5895-4729-a48b-d5e02b42db31", "comment": "Malware payload (AgentTesla)", "value": "6819d0ef008f17b3bffc407cbc8e37c43eabfdc39bdb10029afb535f542e4d86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889490, "uuid": "2deb601f-959d-4bce-91c8-e421565da64a", "comment": "Malware payload (AgentTesla)", "value": "1e3ce2251ab998b9720cb09591f59412fbcb05ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889490, "uuid": "91ebf581-5cdf-4772-ac2f-cd6f56c0a06d", "comment": "Malware payload (AgentTesla)", "value": "f0541e0d1123e2af6804cc93ef9dbf9d4b950af63a4d62644c004e7fb73f1a02a87e2b9a2443a1c4c80aa81118197674", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889490, "uuid": "bc0d472a-3727-49b0-b46d-c727a91d20b7", "value": "T1B505D00432B86B8BE07F97F96594212047B2B547B83EE3594DC164DB0EB6F604E47B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889490, "uuid": "58a05bb8-ba74-4552-b3a4-ad631bdfdf35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889490, "uuid": "f6e99d3e-72bc-4940-8b6b-427e1f6079c1", "value": "12288:TfAZfcahsQmSzcR7OF7J0oLt90vmUCFS9cXSx10B8P2bgLOLh2FV16uxYxnhb1AV:TAcRKF7qgD0vwS9+Sxt2ueuQhCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889490, "uuid": "b26ae09b-39e1-460e-8315-1627dae3990c", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889490, "uuid": "c20fc513-9881-48a8-9f6c-2e1611d7d8fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889490, "uuid": "e775260c-3ee0-4e18-8e02-8f1239b56418", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea17a02-9dcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pony)", "timestamp": 1702921507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921507, "uuid": "3b28ac79-6e94-4463-88a7-f1dd3cc2d02d", "comment": "Malware payload (Pony)", "value": "0365bbbde06f465f860a73f5fd7b38da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921507, "uuid": "d727922b-ea6f-4bbe-b7de-c3f931c29715", "comment": "Malware payload (Pony)", "value": "6a581c0c07ceb888ea418fccffd5efba33b9fd6561be1bcf90b0d6ba4deefd05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921507, "uuid": "cfad7f78-0d17-4921-a22a-32e81e235bfc", "comment": "Malware payload (Pony)", "value": "f87e895764af09a96ce7b44cd7a0cc17eb5986e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921507, "uuid": "de89bb87-c240-4a36-85bb-5845ccf279c2", "comment": "Malware payload (Pony)", "value": "78ec37b29d93e42238fc3822b8707043e37b7d782c88bc3591bc135f6501fb2ab7173abea7bb2de26acb1a71ff19cb88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921507, "uuid": "d8c2be1d-4624-416f-8155-8bb44056764d", "value": "T12614DF61B7831893F611C077C25F4FA0DAA1ADB40F99BF8762F4E93C2CD6850AE50729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921507, "uuid": "9e6b63bd-d1b8-4952-9d58-7ee41f591f45", "value": "60fd1f8a4d62b3c300aa0a0b884a4c8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921507, "uuid": "26c05df8-edc7-4079-9823-341c587e40d6", "value": "3072:9orjHktzHeO/3wBP/n61FAMMnVv4L1LW6xfp:yr4Hv5MVv4xL7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921507, "uuid": "3102a6ae-1134-4d3f-9a31-aa0656f7af06", "value": 193552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921507, "uuid": "76ed3b26-bf69-49f4-bbed-22e00339d673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921507, "uuid": "005f1c2b-dfba-4f12-8c8c-d64821a29150", "value": "0365bbbde06f465f860a73f5fd7b38da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cfd92a3-9df9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702940348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940348, "uuid": "4c077d55-88ad-48cd-bbef-81dfc9784b33", "comment": "Malware payload (Mirai)", "value": "63320ff14f0c677cffb23974c5948b25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940348, "uuid": "eed4823a-21c3-49fc-b573-64be45ba88dd", "comment": "Malware payload (Mirai)", "value": "6bab48254faf26e7278c6665ef3500f0dde631de84fbffe8e05c93743e0b3aaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940348, "uuid": "986cd46d-4bc2-49b3-a157-9e30155c44c7", "comment": "Malware payload (Mirai)", "value": "c63741ae41f94b1ec61d61851bb6c9ee8a8ef791", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940348, "uuid": "64c30cbf-a99e-4176-b5fb-cd2b919b4802", "comment": "Malware payload (Mirai)", "value": "77c15238664232f2b4df901eb7b47d147638149ffe4bf7256cede0f4e6f55407ca856f2055d4a6de88bf39257a876f25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940348, "uuid": "47f03ed0-63cc-407b-982e-3f32744f3f77", "value": "T121336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940348, "uuid": "9b4d3a7f-4eba-4dba-88c9-c9be874edf8c", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940348, "uuid": "ad7443c7-94be-4cf5-aefd-16917c67543d", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940348, "uuid": "e73ebc10-d590-4fed-a0d6-a76f9d7fee9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940348, "uuid": "4bf245e1-6ceb-4913-be33-adeb06820700", "value": "63320ff14f0c677cffb23974c5948b25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd0281b-9df8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702940319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940319, "uuid": "cca710d4-cd94-447d-acad-f8eecd78bdb6", "comment": "Malware payload (Mirai)", "value": "120deaca3e457f8425e451f3d733868d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940319, "uuid": "63d131bb-3fe8-47ba-8acd-746f46ba0b5f", "comment": "Malware payload (Mirai)", "value": "6cfeba31925f6618f92fbf6c08a1747c746e93bdb54edd423933850cb0d2175a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940319, "uuid": "b97b4205-6aa1-4f57-918a-b97e12d5c588", "comment": "Malware payload (Mirai)", "value": "e4623fe08ba695645babeddc6b9cf5943d7c20c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940319, "uuid": "1eba2a15-bab8-47de-b448-bc4861e6d4ad", "comment": "Malware payload (Mirai)", "value": "3fd514c1868ae4a6de6c90fb5f92b533ec494b838d610804589e1a4d3f606c657c6d909958fa1801080d8d7ab5bda544", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940319, "uuid": "c8c66849-2a28-42d0-a833-3091fb7334a2", "value": "T1F5A2D11572632D65E3E91C3DC9AA8257BDA71BFC80F632B679445620C90D34A3E3CA4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940319, "uuid": "e4394e6c-ab9f-450e-a219-1507e25db54d", "value": "384:xvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjMf/hymdGUop5hg:xvQn4j+ZO5fKAlxoXs3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940319, "uuid": "9cd2a680-de7c-4276-861e-7a6ac75a9824", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940319, "uuid": "78411c4c-c816-441d-97aa-ffc19b26e9db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940319, "uuid": "8571d753-334a-4e7c-adb6-cf95b7707050", "value": "120deaca3e457f8425e451f3d733868d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0e7b01-9dcf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702922709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702922709, "uuid": "03b2b59c-aacc-4d9e-b044-f96a881c7df8", "comment": "Malware payload (RedLineStealer)", "value": "6ee1132b0c299af41a511637032bbfc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702922709, "uuid": "4b70d98f-d10e-4eb4-8a95-0d375a0e83eb", "comment": "Malware payload (RedLineStealer)", "value": "6f4297025fa48f5f412dd305ba5a03560c1ee83e32e94a461b788c3b42575155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702922709, "uuid": "5bf7b0e6-e99a-4dbd-b679-7c6b330c331a", "comment": "Malware payload (RedLineStealer)", "value": "7394c775575eb698c2e2988fe50e0982de4dc8a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702922709, "uuid": "c5b87d35-cd73-460e-9991-ff4a9ba7fa5b", "comment": "Malware payload (RedLineStealer)", "value": "253e380baf2ad4f8f8883b3d4ed532a9e72ede8fd5f51a49ba2f4b88d788148b6bb150d549fd4f826099346d4757cf3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702922709, "uuid": "0bd86648-9661-4041-b0ef-97e70c716b29", "value": "T12C44CF11BB91D432E56219315830C6A62F7BBCF2EA6542CF33943E2EAE716C11F65B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702922709, "uuid": "875b77e9-06ff-4836-b82c-e5a888bcc249", "value": "5241d7444d4d8584697b8889b03f1a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702922709, "uuid": "85096116-3e31-4604-aabf-343442996f46", "value": "3072:WDBNqJzyIjXEG+W68WP/oGhEC3ZjyHP5FSDqgAL/0vLTzyS9vBHpJ:KqyIj0G+W68WIaJofS2gAroLTzyS9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702922709, "uuid": "3b142e19-787b-4632-9e20-fdee00ac2f8d", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702922709, "uuid": "867c16e3-ad95-4100-9067-e5c99a0e7a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702922709, "uuid": "26396288-3a76-4bc7-89f6-ee091e021940", "value": "6F4297025FA48F5F412DD305BA5A03560C1EE83E32E94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9695508b-9dc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1702919104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919104, "uuid": "b6af4542-d1a1-4cf7-8891-42898843003c", "comment": "Malware payload (Pikabot)", "value": "9a38a22b3bf021e81c96c0a0440de3b9", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919104, "uuid": "ca1affc7-a3db-44a9-b3fe-2ec63be1a8a4", "comment": "Malware payload (Pikabot)", "value": "706869a2ecba309e9985b31f795fc592b0e7f54dd787b3e90b04bb70db4fac27", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919104, "uuid": "fe109efd-cb31-4ae7-bcef-8747764a060a", "comment": "Malware payload (Pikabot)", "value": "18727f36d63da43edfe7e8f1f5bbcfceb1157450", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919104, "uuid": "d43307ea-6521-4623-9e09-c0a48895c3f9", "comment": "Malware payload (Pikabot)", "value": "4721c9c6a3c2bcf13099696ecc1ad2ac300b8254cce6c993014410d2ecffa3dd6464172c0bcce8bb8f0390cd0652335d", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919104, "uuid": "8bc83bd8-9309-4ee5-9a71-e4ba90bf93e8", "value": "T1FF931266396EDEF7EF873D1FF864D94D7F205E0A330076BA50AE541AAF9610092F5420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919104, "uuid": "fe707b76-c017-4071-80b8-029471cc2a8a", "value": "1536:EmENVYQYUOd4LIs21Snv/T60UDPWgxXHy3+Vj1KyADH2LuiuHC9GmPcNDK1oIP/O:WQQDOHdSH5UBXbYT2LhGC9GkiK1oI0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919104, "uuid": "d31a5086-b3c4-477b-8de5-681e28c466d8", "value": 91149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919104, "uuid": "230951a4-474a-468f-94d7-437baf851c0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919104, "uuid": "98ab5f1b-9126-4a97-9cef-8adb8ebeddb8", "value": "GU.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a51770-9dca-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702920170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920170, "uuid": "77e39ecf-57a7-4771-b434-5a359fb0c381", "comment": "Malware payload", "value": "26fdc376df527b03ea89a2ddeee4bea8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920170, "uuid": "91c48591-31ba-4f02-b77d-c645d7b7eee5", "comment": "Malware payload", "value": "70d09760a476f4f0899bbf963245b01ae9f61ffbdfcd2f314c573db4fb086ff9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920170, "uuid": "ec89068e-ae72-4739-b2fb-3ef668db9f86", "comment": "Malware payload", "value": "a58feb362814a1c834f0f4746853cc80d5d10e23", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920170, "uuid": "742a6d47-e21f-4c4c-b74f-d85ba3f56083", "comment": "Malware payload", "value": "b76200cf6922ad07f0eee299ac8b090607271e37468ff1d9bafc882ce3b38650aa5ce5d1274692a9b2f1e4eb8a12cfbc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920170, "uuid": "6add586e-a948-409a-a08d-62032e07feb7", "value": "T122E39B6DD34B01698F6253379B1B0E5442BDBA7EF38512B1306C437933EAC39A1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920170, "uuid": "a45a697c-a8c5-4d95-bff8-01a37f3b68df", "value": "768:WwAbZSibMX9gRWjtwAbZSibMX9gRWjj9FMHACwtwfyzG6JXk7dUaiueILdcS:WwAlRkwAlR69mytwfyztXk7dUaiugS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920170, "uuid": "da2335c8-8e5c-4c7c-9c7e-144af36b663f", "value": 146910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920170, "uuid": "408859c3-bcdb-4aa7-b91c-da72b5a09053", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920170, "uuid": "7491c0fc-36a2-468b-9b2b-25d843216940", "value": "20231218_010.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b07e112-9d9c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702900428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702900428, "uuid": "5b9bde0d-b161-4805-9b2c-17d1e5607b6a", "comment": "Malware payload (AgentTesla)", "value": "a12d331159e0ff3a400326dcd7d8eae8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702900428, "uuid": "48259b5d-cf30-4218-9b55-394ab9bcbd27", "comment": "Malware payload (AgentTesla)", "value": "73d86b4c5e0ec35d75e6d81fa0244f5320a267b34fa37b12f5d548958c9390f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702900428, "uuid": "1fd11729-b5e9-4213-9979-f3eb71b0ec5f", "comment": "Malware payload (AgentTesla)", "value": "eae286e1801408168ce85d70bf2cb42e851d063d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702900428, "uuid": "617d6d73-8bea-4186-8f72-31e5e0e973e7", "comment": "Malware payload (AgentTesla)", "value": "09cd5e8ca087e994c279e0cd796e4a14b44ebb2f42489f9e785794874123bd23a0375cef97964cd5ee534811632205cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702900428, "uuid": "5bcc8051-443c-493f-bbbe-9de3d34a7981", "value": "T1B915A23C587D2237D5B5C3A58ADC8427F26CA46F3151ED6598CA93E603CAF4278D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702900428, "uuid": "d0b2e2d0-a62e-4c5e-b27b-3fd3f92c6219", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702900428, "uuid": "b51cb942-8f4a-44ae-89a2-5e6c12207055", "value": "12288:OGXDY6t8W3pjR5tPXVEjHgsEytY5xsUS8wjqn49:BzD3p95tPXVEjHjptSHS8Iqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702900428, "uuid": "7c86e034-91f8-4be2-a1f4-35bf79ed2680", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702900428, "uuid": "8698e3bb-9753-48c6-b1e7-9e9f45e77727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702900428, "uuid": "5060f3bf-0273-4a74-94dc-7aba689c5224", "value": "RQ-2023-E042.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c904e0-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873247, "uuid": "88905df8-cea2-4135-aefc-12f88d502f4b", "comment": "Malware payload (Socks5Systemz)", "value": "c684ff71b745eeb4c0833e2f728ead19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873247, "uuid": "4a16192e-49a3-4141-9cc7-ec9186975b75", "comment": "Malware payload (Socks5Systemz)", "value": "774a200ece9efd4e149c2c1afe3d06237e53224400db2d8eb04977c91fff3291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873247, "uuid": "7aec6577-f4a9-4201-adb9-45a5995f3d30", "comment": "Malware payload (Socks5Systemz)", "value": "8397f1cb5ed0b6cc7d36e48d46b6dee070d0b20e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873247, "uuid": "c1347b5a-566c-4e6c-9aec-591633c48bba", "comment": "Malware payload (Socks5Systemz)", "value": "91ae994d07f3bde9ba4fa1338314998218d597a3949aa486e4ed50df315f454a441ba90644595fc5653cafc06310ba9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873247, "uuid": "501c5fa0-4feb-4dd6-a4d2-8d4b3f385708", "value": "T1806633D7A3290439E4A241B5D231D14B8633EEA61D63A90D9A9C0C59FFBB01ED5B7FC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873247, "uuid": "40e9396b-f8eb-424d-bf12-fed4eaf097b8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873247, "uuid": "3b36a289-eadb-4c6d-a466-afd9b3b4bc86", "value": "98304:RuBqzPyxslK+oJnlVGZoWYrIBJDmMis4PY3GQHQdLJ5XbWw5jjRGqULvrEwmemlF:MyymlKBbUo/r0wKHQdJwwNRLGzmlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873247, "uuid": "87553cdc-8079-4539-829c-0991c3c86a57", "value": 6770166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873247, "uuid": "40dbb5a7-edc2-4c91-adb2-4160fb3ef544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873247, "uuid": "37d6cefd-53b9-4073-b780-480f951dda77", "value": "SecuriteInfo.com.Trojan.Siggen22.40922.20827.5895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26098a8-9dca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702920466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920466, "uuid": "2e2930df-02d0-474d-8526-85fec6d0ceda", "comment": "Malware payload (GuLoader)", "value": "456e549afb2eaee4c3e0960434f5b42f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920466, "uuid": "feebc2ce-8210-4c05-ad2f-4f9669c97484", "comment": "Malware payload (GuLoader)", "value": "7761a86ad747471c725725f3868bba01c6dc6399e9cc681a9a6ecfca9d97cfe1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920466, "uuid": "167948d7-2756-45c5-a6df-22b737c9a738", "comment": "Malware payload (GuLoader)", "value": "d0bfca79651ed264b3138dc90f30218419cde9a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920466, "uuid": "8ecf917d-f65b-44c9-a298-eb93164e4a58", "comment": "Malware payload (GuLoader)", "value": "ce84d8a09e41ca01cda8c4942a4c2cc65f21967daa024f4992ec9eff98da8b75d25880073abfa49c241706c6e6ca39e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920466, "uuid": "7e39579e-c817-4bdd-ac6b-f9024c640cf5", "value": "T17A2306B1EB56160A880E26B9AFC34B47F1798C161536D01BED9903CE233759CA76F70B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920466, "uuid": "5b34a5d2-d394-48f1-8740-0edbb09a58c5", "value": "768:Rdh/6ROdJZcZFmg1/G6GNxnKinyM53K/wVlqr5z9HpR7bYisJJMXDGe:Rr/6RVt1/biEirhfVl6giqON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920466, "uuid": "4f6f2db5-a47a-4bc6-8bc8-c8bb42cd5886", "value": 46835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920466, "uuid": "a68a61fd-ec42-4913-acf9-17b7f7bbd8fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920466, "uuid": "c5088233-3d13-414e-a461-aec5369b6238", "value": "RemittanceAdviceNotification95002639322.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364f721d-9d6f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1702881147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881147, "uuid": "baf2f7ae-f26a-449f-9177-4c88eff3ee33", "comment": "Malware payload (VenomRAT)", "value": "46fd2b3f3a94dedf52571b13875e968f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881147, "uuid": "befe9d7b-9e77-4214-b7bc-d0d0de92c09d", "comment": "Malware payload (VenomRAT)", "value": "779e2ff480a30df2c39e8bd27061a0cfd4fb0d234cd0374cf92c5dd21b6eeb55", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881147, "uuid": "feed3f72-3971-4ff8-9ecb-85a3ab53e1e5", "comment": "Malware payload (VenomRAT)", "value": "da8012cd64a962f9d24a21b73e43592640b6c4ff", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881147, "uuid": "157a5099-1d00-4b47-8904-da9ae5f4538a", "comment": "Malware payload (VenomRAT)", "value": "f9adbeb9489e1724ba83272fbcbd4fae1da38bbbeea335b48b9a988a696768769631679e54b8f5efcbdef2dc03c9be8f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881147, "uuid": "b243c0d0-25d2-4a03-a2df-bfedc36c8beb", "value": "T1C844BE84D1F1A73707C6BF9925021C6C8689AD975AC1ADB0D409A6F1ABF7FB8CC35C12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881147, "uuid": "fc9796ca-eb6e-4730-960b-944fd09fe2f5", "value": "6144:4gyk7/7z3BzE4si5cAzgnoMqGhdMmCCNdzYCdWB:Mk7psMcAFfG/M/CdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702881147, "uuid": "2927bdb3-fdf0-4c65-a302-31a59ceeafd2", "value": 268565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702881147, "uuid": "2cc90269-75a2-4ed6-84c5-2b95d86bd9f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881147, "uuid": "a916b6cc-6b27-4d56-888a-164236d6f290", "value": "sa.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2930d3e2-9dcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702921497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921497, "uuid": "9da4690d-edd7-464e-b463-98246890f112", "comment": "Malware payload (AgentTesla)", "value": "a5907ab7b2c7c42ffdc9168835d82d7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921497, "uuid": "ebe5b88c-e73d-4e11-b3e0-d2b259f0f65d", "comment": "Malware payload (AgentTesla)", "value": "785bfba7caf951d4d34547b5a4b4143094df0b81cedd9151b82b4dc530b4d5af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921497, "uuid": "c19b8d76-7b76-4ee6-84a0-0ed2f15428d5", "comment": "Malware payload (AgentTesla)", "value": "2208e2e61fd1206f10fd78e36595a75420ccdfbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921497, "uuid": "4168243e-873e-4271-8c90-29938092ed8a", "comment": "Malware payload (AgentTesla)", "value": "0f6a80f9c3c7f171dd39d2224da4ef95526c1897becf4f92413667e2d7b01eb529a2c0d7924961a6f5173c3760390fe3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921497, "uuid": "a7cebb0d-041f-4d07-9fab-57bca4322b15", "value": "T13AA5F1D9A872A5C49C4297734688E9F8ABED20737637E3245948ECD430E88FD87C785D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921497, "uuid": "fdd58ce5-6d44-48f1-989f-38bb20ceec38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921497, "uuid": "639bd31b-8c6e-4a5e-ab47-c7a35e502040", "value": "49152:ELYaYwU+96dwWJDnl1kVV+zkVAAy6uP+Of+IuBBe27/V:ZhwUmZmDnkD+4+KuPx+BTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921497, "uuid": "69400475-6bac-4a7f-b739-d4df8d947f27", "value": 2219920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921497, "uuid": "d3150d41-2bdd-42a8-b723-c89ef64087be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921497, "uuid": "79e87026-76d9-4b21-a044-aa58779852c3", "value": "doc0055687_20231214_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbc5355-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889511, "uuid": "d343e409-0e4d-4a1e-809b-710db66e3ebf", "comment": "Malware payload (AgentTesla)", "value": "5f3048eee066bf0f66e9f6de5b48cee0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889511, "uuid": "97476c2e-4cf2-4b17-a900-62f58b7dd7db", "comment": "Malware payload (AgentTesla)", "value": "7948315565e8321056661c7aabdeb10e01ca73d2425a6f6bd17593a0ffb484ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889511, "uuid": "0d4e2b50-46bb-4771-b619-be871f46bf7f", "comment": "Malware payload (AgentTesla)", "value": "efefbe07bb2e5ccde77fbf7ab7e4336453965433", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889511, "uuid": "8ddb7a1a-76d0-433a-9870-78d532f46144", "comment": "Malware payload (AgentTesla)", "value": "a42ef72c317e500e774305d1ed89a314cb298de4a0595fc8a5f20aef563c2ccb9b873e0d7ccd2c56636bfe83fbbad38b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889511, "uuid": "fd14d901-b841-45a0-83f8-78e7f1345026", "value": "T1D1E4220836985F22DA7F13F26031A24543772D266C21E3CA1CD2BEE779B7B419B86747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889511, "uuid": "5e9219c9-085e-41a9-a200-1e7628415c1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889511, "uuid": "5360659e-ba6e-4c75-9f3e-3e1f32b1ef1c", "value": "12288:S0oLtFAIEnEqiMRONK865X/IAiJJM7es7ViJFyylK7H4zNqnwti9mz:1gmEER/t/I5JM7z7Zm+09ti9mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889511, "uuid": "6a4c09c3-87f2-4d72-bba5-e071ef88e17c", "value": 703080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889511, "uuid": "f473b0ce-1c78-442b-bf89-5bc7589792d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889511, "uuid": "63b4e91e-5b33-4bc6-aadd-a12f34d38bfd", "value": "signed_Nomencla1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ec2f3a-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873261, "uuid": "5296419c-b53c-4993-a137-5b8a96c98a91", "comment": "Malware payload (Socks5Systemz)", "value": "ae5149a230e59eb73619ad6fb4fbfa8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873261, "uuid": "fe8b4b37-1a72-4596-8569-f7d83fcd8cce", "comment": "Malware payload (Socks5Systemz)", "value": "7ab58f3b0c5a7db271f793be8151da17e08e497f8305cb8627a56edd6f459259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873261, "uuid": "410c5e41-b4aa-41d2-8e58-2e1d18d33d23", "comment": "Malware payload (Socks5Systemz)", "value": "8b46578bb5a768ab7f13ed7bdc7e548286de21f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873261, "uuid": "e47c28d4-ddd8-482d-b9e0-9972a2030b5e", "comment": "Malware payload (Socks5Systemz)", "value": "76dca95551020690b0385e1eacbbeb402605a279163950e1db26f5479237d45bf819da2b8b3f3f0f9f535d55bf323613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873261, "uuid": "9a731e27-b0d2-45b4-9415-70b6a98fcb4f", "value": "T1E86633169CABC972D6B346B6ACA061D88DDB2CB23C79F0C830CE45FD9C76FA45684075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873261, "uuid": "2399ca44-54eb-4465-9c01-3fe6ea4361f0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873261, "uuid": "33090f70-0ca2-449f-a6f8-f616763105ca", "value": "196608:71dteqFaqdaBooY4oXlBcoefmmk4D3REdlnF:71tzaa94oXmmmk4rRklF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873261, "uuid": "b247a39d-422c-4e16-b8fc-38bd8ad12e18", "value": 6795192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873261, "uuid": "956ee46c-50f3-4bbd-b348-f3ccbc270d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873261, "uuid": "6e445c9f-3c6b-43a4-98d7-41c605bda25d", "value": "SecuriteInfo.com.Trojan.Siggen22.40920.30396.5110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9945fce1-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702880024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880024, "uuid": "a51d4293-e796-46f0-a509-714930f59a27", "comment": "Malware payload (RedLineStealer)", "value": "1c0b934e8e0c6cf12f9a478a8a7e3222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880024, "uuid": "c83e6e31-4611-42f1-baca-9b3f3855e9ab", "comment": "Malware payload (RedLineStealer)", "value": "7acb1e629b8156ca71dd89cbd19546d1d5084539508b57d00f0710c36e1f8219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880024, "uuid": "cdaee716-b9b3-43f2-b0b3-06ac9885c81d", "comment": "Malware payload (RedLineStealer)", "value": "49816d2bd4d02ca4cb04afa1080cf5265355a6e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880024, "uuid": "fc94ecbb-343e-42f0-b72e-26ca1a24790e", "comment": "Malware payload (RedLineStealer)", "value": "b716fe44211382d4035cdbe6b0be3451c9470078d0bc1a520b9e8dabc87affe244e056da7ce97bb7dfad288301fbe599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880024, "uuid": "a61fcb4b-bacc-4726-8cc1-ad50d51a9c0c", "value": "T18595864ABAC2EAE1C3522F32C4C761207B2D87F65503C26F299633996DC7B7B5789047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880024, "uuid": "e80571d4-fd00-4e5e-9f46-287bbb90a070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880024, "uuid": "54074717-0f5d-4fc0-8b48-0205bf54a342", "value": "12288:BnvXQUj3CEaVipsrCag9YTnY+/MH0wCAVX+lPsU8xMzcZ4yLbGtCD0txP256NGQQ:6w1aY7ocElxKNczmWt7N//JxWEPJ1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880024, "uuid": "6266daec-8056-4803-97fa-251dce0cda1d", "value": 2004992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880024, "uuid": "a8aec7ae-2e92-4d89-8cfd-54df45600a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880024, "uuid": "cd9be1c3-8734-4c80-b0b7-b5024e5cc18b", "value": "1c0b934e8e0c6cf12f9a478a8a7e3222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acae72ac-9d71-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PrivateLoader)", "timestamp": 1702882204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882204, "uuid": "d14f9815-b0a5-4164-9fcb-2e56633c9340", "comment": "Malware payload (PrivateLoader)", "value": "3431392a5cb116c453e2801a65cabf27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882204, "uuid": "9e780d17-5d42-4d0e-8379-8f5c307fd6b0", "comment": "Malware payload (PrivateLoader)", "value": "7afe5d37f9f3935f585fa82a6619031d1d4665906169bab6e72cc14ae6b86897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882204, "uuid": "b07ddacf-a9db-445c-812e-661bbc395b76", "comment": "Malware payload (PrivateLoader)", "value": "50ec212428a6d8fdcc22908cbafabb385ad78802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882204, "uuid": "39aee0eb-9b95-4e9b-b238-bb4b64184920", "comment": "Malware payload (PrivateLoader)", "value": "feaf61e03c95178a99416809592f2d66ca8197cbd04dcf80ad973d8f65f83faa4298e9bca7092106c9542afb7f5ffb40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882204, "uuid": "15df0759-623a-46f2-9cd3-64843cd15239", "value": "T127568C11A9809636FDF305B78DFE6A5E916CAD52071420D3E3CC396E5EB19F23A3121B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882204, "uuid": "ae727b8c-2a62-4d57-a4c4-a30158db3c73", "value": "a362c1d5cd70c00ac4d479062efe6742", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882204, "uuid": "db988cd6-e449-4ea7-8dcb-2609b1ca2fec", "value": "98304:ZxfGhO1xt2uDB5wFpPtEQkg+GFtfnaAGXKpRfHB+IOiV4hUWUn6VnNC/kGA:rfGhO1xt2uDB5wFpPt5HOnUn+QkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702882204, "uuid": "2d21cae6-a2a3-4e15-b849-0d1f96b32101", "value": 6024192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702882204, "uuid": "cb9351ed-19ba-4e2e-b153-e4e8d19f6ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882204, "uuid": "0c9bbf7a-badf-437a-a20f-ded53912da1e", "value": "AK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16b2d66-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702908814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908814, "uuid": "e385aa51-9f78-4f6f-8528-b53134ffb61c", "comment": "Malware payload (Formbook)", "value": "c201272d3ed63b282e69c481abf1f17b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908814, "uuid": "7f6cd4b8-2f53-4346-ac48-2e4105fb9933", "comment": "Malware payload (Formbook)", "value": "7b80aa252b816b5cc6453229d4ecae51a59101bd0d0be34bc97c510586182314", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908814, "uuid": "b062b464-0a81-49d6-873e-7db4c4288689", "comment": "Malware payload (Formbook)", "value": "5f2fc59af313214e6922098b762456d12cb639ff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908814, "uuid": "70c52af3-989f-4171-a6e5-2f5e0985de61", "comment": "Malware payload (Formbook)", "value": "d3faf7e256ea1970f130e39cd09f837a40c6011887e3608d04dfd098df1203c3e3a5d5af9e60ff10953de550f6a49587", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908814, "uuid": "8b0a2921-903e-4b43-b491-6d335c372466", "value": "T1E25522813314DEBAE74443B45CB685C1C3BAE233B5A1E18E7CCDD76F3EA2354495614A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908814, "uuid": "3b26a705-bf23-42ee-b54d-c524c06d900c", "value": "12288:76wEx2iNOXoad2i+hDZeYY8ezIX2D+D1SKA4o1akUSVj8lcGDesHMTqDvK5GQPAD:+wk18XXdPWDZeJYXnJ81akyMTmKIuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908814, "uuid": "deaa0379-7066-4677-aa59-cc4375f83cc9", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908814, "uuid": "34d6ce97-4c1c-4ad8-980f-45653efd314c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908814, "uuid": "ed0e778e-b7f7-45c1-b322-ed56484623a8", "value": "Mokejimas.jpeg_1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af4c55e-9dee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702935862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935862, "uuid": "80a63de6-f10d-4598-b851-02bfc79d78ff", "comment": "Malware payload", "value": "c2aa9faa9573bef41fe90b2df24115af", "object_relation": "md5", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935862, "uuid": "cd110b32-6941-4a69-a969-7835032af76f", "comment": "Malware payload", "value": "7bae29a13839b2ad19368bff6c1af0099c6073302218e59019065852b5ba6736", "object_relation": "sha256", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935862, "uuid": "e109cacf-d13b-40bf-9375-79be26d7902c", "comment": "Malware payload", "value": "07346cf6bea09e8c0ec5413fd87debef85b221db", "object_relation": "sha1", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935862, "uuid": "541fadaf-73dc-4eaf-a8cd-4ae727cc692a", "comment": "Malware payload", "value": "d50825e3cbb72a54475336151508ead6f9f0cc9ec7c6b3edeb8351fc3449b52ffc861fa85e3a5650ac7212096ae9cfac", "object_relation": "sha3-384", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935862, "uuid": "0e5447a5-1f30-4f51-9480-cb557553d88f", "value": "T1FA76337110D0A056BCC6440DAF07BD2DBC227EA4C4774BAFBD7B5AE9E6D15126220BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935862, "uuid": "a1d8fb4c-30cd-45e0-b298-46ea3e9bace8", "value": "98304:OBHv3YU6+CXyS7b7ca49b2rstdedwEamvXIp82xUloh3I5U/OtmyzTl3/jjx2AQp:OB76pymcay6rNayTDlmmtmyzZ3vEtJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702935862, "uuid": "cbc1df37-c904-4f31-9247-77812f0110c6", "value": 7447855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702935862, "uuid": "de93776d-c2a7-4ca7-b235-543488c72609", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935862, "uuid": "ae75d46f-1320-4ffc-8e49-29da47a86415", "value": "BOL_Inv 202312186269422738.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd563f9-9d55-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1702869915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869915, "uuid": "2168be6f-0003-4f2b-a606-b13979eba75f", "comment": "Malware payload (Stealc)", "value": "8af5e918d9cdca6c3c182029186ad9ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869915, "uuid": "42569cdb-1009-409e-ae1b-a7db9008b92f", "comment": "Malware payload (Stealc)", "value": "7d43625f6587b6539d7bc6037dcb8b0eb317a035c5deb69f79e307afa4ac4d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869915, "uuid": "7a5b0ea0-6b42-4a90-bd52-9202ea209614", "comment": "Malware payload (Stealc)", "value": "f702fa2018d66819262b2fe6b9acf669aca9cdd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869915, "uuid": "4212d5af-9824-4401-9d87-4a8ca3d7fd3c", "comment": "Malware payload (Stealc)", "value": "e1ff04444a0a018f59522082254181877d3e95f52e432308928e9f989d9a4a0435fdccdc63d5a39df29d89c45b66a8f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869915, "uuid": "a0e70a00-1e9b-4cbe-a06f-04683fa29182", "value": "T1E206331321C59491D8B42FB061F712434331BDB9A96CC75F6ADBBBEC0CB6CA1953622B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869915, "uuid": "dc4791c3-faeb-454a-8910-2d0b08ff5034", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869915, "uuid": "65d9ab81-1f1f-4c30-9e1f-d57179b9077b", "value": "98304:iQ2VStbl0U6DgsS/Lr1aJQL27E6GxgAfJfgZ:93tblV6DS/L+a249xNlgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702869915, "uuid": "737f309b-2d24-467f-affa-e1a2e5e68d2a", "value": 3778048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702869915, "uuid": "7c1383af-9015-4417-8bd0-87625ef57d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869915, "uuid": "8d31abb4-e542-41a3-a785-0af42390eb3d", "value": "8af5e918d9cdca6c3c182029186ad9ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe55fd4-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702880116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880116, "uuid": "e393a3f7-0784-4a02-8ad0-67bd458e3e4d", "comment": "Malware payload (Smoke Loader)", "value": "c4dbb00a6d70ada06dacc18580884e6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880116, "uuid": "82174a65-0135-45f3-952b-688694e20f16", "comment": "Malware payload (Smoke Loader)", "value": "7efbeb4cfc7acb443082fd1b442553dbdd120a2704f7a2eaa91ce0f71ce6d234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880116, "uuid": "d0ba0287-cc9b-4cc5-b101-c38467805263", "comment": "Malware payload (Smoke Loader)", "value": "b3be3b479524b9b480f5ba8ba775970c01fea835", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880116, "uuid": "a92d24e8-ccb6-4aa8-8915-b72cb630b68b", "comment": "Malware payload (Smoke Loader)", "value": "580d0b4ba328b9a55bd14391ce05b3d68edf63b21345117e34e52d807f8bba873d545c99650cfe30dfe1e81b2aca09fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880116, "uuid": "08773f5f-5105-4792-97e5-a1d8d189d7b4", "value": "T12544BF1272D081B1E22396725A75C3B05B2FB8655F227ECF2BC95A7E1F342D2C67131A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880116, "uuid": "81416342-5a3b-4ce7-8806-308a47df4db5", "value": "25c5b39875f5a4f6c67ff13501770773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880116, "uuid": "b0ac1b57-0482-46a7-a13e-02d23fba0fc0", "value": "3072:ISCiG+AGCFYReIbkac7jI7wsuXhJCquD3AF4XYNWzRntfGyBVPjoaX:33sYRXbwxk3K4XYGRJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880116, "uuid": "c61f4b63-5559-4f25-8163-7099a92aae75", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880116, "uuid": "7f7f48bb-05a8-47c2-b2b7-6ffe6cf7afb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880116, "uuid": "fc25860f-f473-4dce-a2d2-463c9eb9ecd1", "value": "c4dbb00a6d70ada06dacc18580884e6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4017ad8-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702925596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925596, "uuid": "43811cd4-0426-46d8-ac9f-741de0c0f8e9", "comment": "Malware payload (AgentTesla)", "value": "b8ec5b7361b39b0bc5471c3bb23bcf79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925596, "uuid": "c24c3600-1ce7-4ac8-be67-2d27fc8d8b34", "comment": "Malware payload (AgentTesla)", "value": "7f55066e20c9aa6f3568fb142a1a52af313005ae4739d5f378d61991fc2fce74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925596, "uuid": "5111b6b2-2714-444c-9be2-958ac9df3e91", "comment": "Malware payload (AgentTesla)", "value": "681dbc4eb5dac0a19533834a9698776bd46db80f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925596, "uuid": "5fcf7e39-0643-4fc6-9b18-8cc8d0bd461a", "comment": "Malware payload (AgentTesla)", "value": "be934ac33c414e76972559dc8ee8a59bd2b733682a577cb3bf5e6421490461095d9c4580ef12a00d84f79045fcab42c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925596, "uuid": "dbc93340-46b7-4bbb-8198-eb3a1ece3ceb", "value": "T1B225B33C58BD2237D5B5C7A58BDC8427F25CA46F3151ED6588DA93E603C6E4238E322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925596, "uuid": "80883e1b-c096-4b51-b5fd-a046566b99db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925596, "uuid": "fd4f7f85-b2ca-4be0-9b5e-bfb5b6531080", "value": "12288:qGXDY6tPATswYfzBySzmhk8KuyX4IEYVSsZhyX5ThoB5AM0qzpw:VzdAfCNyGmhk8KuyX4IOkMwAMzzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925596, "uuid": "eedbca6c-d3ea-4341-a5b4-422b2f1d6734", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925596, "uuid": "65b8e0f0-ebba-4854-ae32-7eded9dc1aa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925596, "uuid": "569eb3c4-0caa-423a-a925-c140893c2733", "value": "DHL SHIPMENT AWB# 4633817031_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ffdab9-9db8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702912627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912627, "uuid": "d32e212c-3910-4c71-ab1c-cc7688a22ce9", "comment": "Malware payload (AgentTesla)", "value": "0807461cf0e61b1f4c7069785c03a6d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912627, "uuid": "a2b8382d-fcf1-4a09-9e4f-bc3d2bfd77c0", "comment": "Malware payload (AgentTesla)", "value": "811b146b2f6bee669198189c45a30ab94be95a7a74d6ff0b8798d9f828be0aa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912627, "uuid": "6d474464-273b-4a51-9825-0056f159d998", "comment": "Malware payload (AgentTesla)", "value": "44411ce037ef4c1751d3f2f45d978228edb5a0d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912627, "uuid": "03994ebe-4427-470a-b82d-1e0619cc185a", "comment": "Malware payload (AgentTesla)", "value": "abdc8f9737c8f653208c7492c3f85358277f494f91d68e51e83703ea5d9a257245b3b0b18cc19cbab81c6453a0453963", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912627, "uuid": "75e381ca-052e-432a-9f4a-bc30a69f8c83", "value": "T1B9E423C3428117D09A54EC3D232A4A8DEB9AD8CB621E51A88F05C7F99816FFF76D7C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912627, "uuid": "5a8377d7-8ba5-4523-aa59-6cf7941e5e40", "value": "12288:RWDfgvMvI3Ez4X4PwAX3oSF4R89kyt42Y/dQTe9M2nMc2LsIU:RjMiHOwK3oSFak2F9724t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702912627, "uuid": "4e1b2403-b822-4fc4-b5d6-fc50a25bccf9", "value": 697285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702912627, "uuid": "eee1421a-bdaa-4f1f-834c-1412224a1083", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912627, "uuid": "797a096e-1a40-409e-980d-3892d830524e", "value": "payment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d8e86d-9dee-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702935608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935608, "uuid": "812f405e-204a-4e7b-892f-f735f60b6c3e", "comment": "Malware payload (RedLineStealer)", "value": "b6495a9c6a890740db6f41bf37af8427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935608, "uuid": "7cb671c6-d7e1-4a3f-9597-56f04fed73d2", "comment": "Malware payload (RedLineStealer)", "value": "816640f101b9440dc8892bf84720ac50afe8fe11888574fa8b81af8caae19aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935608, "uuid": "a23d4138-6563-4f07-9760-4cc88eca1e40", "comment": "Malware payload (RedLineStealer)", "value": "97eff597d991a62bffc0774952dd9ffb45d7b3f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935608, "uuid": "842a2cec-f89a-47ff-a65c-9640c6433f48", "comment": "Malware payload (RedLineStealer)", "value": "d2b3daeb330e66da0e28add76b7e702bf010c5b25ae13343400b2793c4a63b8d21a8e8fa28f39590c26a137bdfc95f4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935608, "uuid": "d2e9b6d0-674c-47b4-a76a-8a309990202e", "value": "T119F2D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935608, "uuid": "19c0668b-756f-446d-931e-4700af436be4", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702935608, "uuid": "26478e11-f520-44c6-91d4-2df1e51f9902", "value": 37506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702935608, "uuid": "9606b681-2595-4c26-b760-96de173f25bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935608, "uuid": "0712a04e-be02-4a79-9a4c-69d921ca172e", "value": "b6495a9c6a890740db6f41bf37af8427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6742c900-9db9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702913012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702913012, "uuid": "06105a07-421f-422a-a2f0-4e555b96ec27", "comment": "Malware payload", "value": "320269250685682302965d88ab1a6d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702913012, "uuid": "403f6f31-3b1c-4c9a-9357-5c977e81187c", "comment": "Malware payload", "value": "8261e8536f457b9b6997a0ed48ed411db2d1f23ce6ff10a311724d552073c399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702913012, "uuid": "ae16a19b-c438-4b56-9a56-7a54877fa4f9", "comment": "Malware payload", "value": "1b59e0835155fe7258532369c55bdc0f4e215290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702913012, "uuid": "a6ce2edb-3a47-414d-a2dd-c49d380d22f0", "comment": "Malware payload", "value": "5ac4f061630c1b15df2349e393577caa8f9263ad9050fe4a987701580566ef0f2d2b0041157fa509efea22f4480c4836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702913012, "uuid": "d004b2e3-fde4-411b-9045-769af12c45ce", "value": "T17C721748BA9CD233C9BC16BC9CF3470903B1DA3BB983E38AADDC9AA128477C015515F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702913012, "uuid": "9b95cabf-1f0d-41e0-a37e-09a0d121e552", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702913012, "uuid": "8887bee1-65cf-4fe7-bb11-51cb6c4ec1ed", "value": "384:UaEMP0rnT/ka8kNLhf8bXkkxHYAseiEu:4MPO18bGenu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702913012, "uuid": "4c7c66b7-7acd-4244-9351-9da069883bdf", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702913012, "uuid": "242df9c5-492e-42d2-b40e-46b36d823ad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702913012, "uuid": "22eafaf4-c22f-4aea-a7ae-1500416cbc10", "value": "SecuriteInfo.com.Win64.KeyloggerX-gen.2223.4705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65fc479-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1702880073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880073, "uuid": "8f6c892f-09c2-4869-9114-321624e5ac6f", "comment": "Malware payload (DCRat)", "value": "7a47cac75096b77be7d7d36d0e72556a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880073, "uuid": "032cf968-7901-4b16-8231-f68eb5e13629", "comment": "Malware payload (DCRat)", "value": "826c93b5f8974e81c812e7f11c63d33b8cfdc84f45c402ae22e7794dc81e5893", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880073, "uuid": "7fa1417c-dfbb-46cc-b41c-1967aae84dca", "comment": "Malware payload (DCRat)", "value": "bcaf3bf2c9b3c7b244e012e3047e3b8ee5c29ff9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880073, "uuid": "e2665ca3-126e-42aa-a8ee-49c66a58afe6", "comment": "Malware payload (DCRat)", "value": "8f4fd880ac1b95fb483a2afabee2432f404029838500de30b4fde3534cfa60d6437e8b1e9824085851028daee7761615", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880073, "uuid": "da022a8e-8b0c-46e3-b1fe-be75ac245202", "value": "T1C355494BBC9045BAD4BA92324DA251927B62FC091F3223D72EA0F3782F76BD09D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880073, "uuid": "04d6a36f-829b-4423-a920-ef3072fdfa9b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880073, "uuid": "df0b8bc9-980f-4159-bea2-ff62aedd6af9", "value": "24576:xZI+D4Lbj9Abgf7S0X98igyoiMScSYyIyMSsCH3kjK2zlU/guYS19rf6:xZI6IjGbgeYkjrWIiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880073, "uuid": "649d494c-e5d7-4321-b834-957b87ccda43", "value": 1393152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880073, "uuid": "210b3930-020a-4eff-9be9-2810b4521524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880073, "uuid": "af655935-cc15-4ace-bf70-a05df47532c9", "value": "7a47cac75096b77be7d7d36d0e72556a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d2e803-9df9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702940341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940341, "uuid": "1f54285b-4318-41b9-8492-470b9e5f86dc", "comment": "Malware payload (Mirai)", "value": "b73ca178b6509c1a681a7ff35c528b3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940341, "uuid": "a5ebaf02-ac8e-4532-addb-c8f27cf17319", "comment": "Malware payload (Mirai)", "value": "8403ff87c1eb5b50c77bff8ce1bf79240a9e6854632b7b06c00d6bbd96510c8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940341, "uuid": "79f5296a-bea4-4a05-af53-6945ff61d260", "comment": "Malware payload (Mirai)", "value": "cd2ab68a44db431f0f159763f7d40c2b4261c409", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940341, "uuid": "5131cd93-7477-4581-88e0-cdc3b03f9353", "comment": "Malware payload (Mirai)", "value": "a63438f6a026a10c5f48d261d500d6d7b8e5cd21066daa19ae282ec85cc5642d14322558f42abe25b4ccf6a7d8d50ddb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940341, "uuid": "6fa9a6e0-ad20-4829-a6a8-3d747e490aef", "value": "T1B482CF3061AB74F4CBE14434EEEECEC6975A0BF8D0FC36E216586B78CA4550611F96CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940341, "uuid": "5779e539-7691-4d59-90fc-7827ad2612d2", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaohymdGUop5h5lz:6/V0P6+kom0tVAoNvm+to1os3Uoznlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940341, "uuid": "62828457-4a0f-48b1-aafe-9173b8c363d3", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940341, "uuid": "2b3b8ad1-5bc0-46a6-b54c-d3fe7b78c9cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940341, "uuid": "50247265-1857-41f2-a78a-919593901ead", "value": "b73ca178b6509c1a681a7ff35c528b3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60961bd2-9da3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702903552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702903552, "uuid": "7d286cd7-f271-4902-b168-9c90bf41267a", "comment": "Malware payload", "value": "ea6f193cb5059d6cc4c13662836f7a01", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702903552, "uuid": "97fc9361-5310-4580-b91f-9dbc494d05f0", "comment": "Malware payload", "value": "84a0a6a21017efb74ecc35c79e90e6145dbb42434faf86d7060317d63fd733a1", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702903552, "uuid": "ed20bde4-bde2-46e0-93ab-137124a93800", "comment": "Malware payload", "value": "bea4ff037dc8bb965f7e3aae8488ca69d6bc7a8c", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702903552, "uuid": "a9057069-675c-48bc-8b2c-47be2d61ccbd", "comment": "Malware payload", "value": "041b775115ddb32ab852fb92f51f85743841bfb7b436716ad762a85f9e5b2753cda8dd20bcbeb1a802d1499a5dbe712f", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702903552, "uuid": "b6ae559d-aec4-47aa-b728-ea28ce2f0f5d", "value": "T18F959A6ADC048B2FE49A0174C1776F55331AE2DE2B41873B63BA270F5CE9741ACE69C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702903552, "uuid": "b9dc3489-289e-4015-a3f3-bb21eaa64c85", "value": "49152:+Cz/xUweQa3i4oukx4JoWfqI4fJkCkzlmW9h:j/qw/a3itWr4hkCDW9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702903552, "uuid": "6d868ac4-305f-4b35-bfe6-ddd0e54e03e8", "value": 2008307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702903552, "uuid": "6d5b3856-b0ac-4f46-b0f2-53e9eec5bd3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702903552, "uuid": "12214599-6010-4f17-af6e-0285afcfdbc0", "value": "WinScp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09e2d0a-9deb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702934690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702934690, "uuid": "afb4a42e-b700-45a8-9de7-fe43ff2c7231", "comment": "Malware payload", "value": "f094ab59538533c33ecb4a8df7f7b0c9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702934690, "uuid": "e44b3bc5-6e28-4313-926b-0ce0d16903ec", "comment": "Malware payload", "value": "867836b5c7bcd021a61088ac94662c598493a8a10f4c7f7b8fc992f60bedbda2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702934690, "uuid": "b48246f6-4a68-4dc1-90ed-a56cf23e5018", "comment": "Malware payload", "value": "a77ff21c03821cb045ad15571906158499486ebb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702934690, "uuid": "f4860c16-2c42-49aa-bfe1-7f94b2ef38fc", "comment": "Malware payload", "value": "6636a9d70c6b05345461aaf7d750969174ee62926a06556f00c756a3e79a538ad7cb1000fceaca275305769d366a6473", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702934690, "uuid": "91fdbc4f-f723-455f-851a-557564706259", "value": "T18F75BF11F7B1C079D9CA46308A29ABB500F4EF1FCA10A8C77790BE5E6F32CD6D225959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702934690, "uuid": "2eb29938-ee50-4176-9a47-a9388b1ec4e1", "value": "49152:Mv8Uu7k9SFryQ3LZ/grnyZbAJGoNnOnAM9ThwM65XqYq:Mv7u7kcFrXLEJy79V6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702934690, "uuid": "362e4ff4-1f61-4310-959c-61a6b9d635b7", "value": 1675264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702934690, "uuid": "6e63d4d1-0300-4648-b394-0a5a2d35031f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702934690, "uuid": "38f3a160-ab78-4160-8876-1a80e7206ecc", "value": "Installer (2).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243a6aa8-9db7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RevengeRAT)", "timestamp": 1702912040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912040, "uuid": "d432a6a5-868f-4e9f-9b4a-0088827898a6", "comment": "Malware payload (RevengeRAT)", "value": "da7cc032d5880c1eb6d7fb741b66f4e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912040, "uuid": "ef94b4b7-d3ec-4987-b393-129695e8b85e", "comment": "Malware payload (RevengeRAT)", "value": "87315f1e56b06d1ac600c399f30f5dc13dedb1cc2c20bcfe79f71b76b5716718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912040, "uuid": "1c528c84-25a8-4eec-b99b-e325a4a3aacb", "comment": "Malware payload (RevengeRAT)", "value": "5bccbb1e90069078211402868c84a417e4ea3ed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912040, "uuid": "51663f83-68a7-4048-8c74-6967bc979045", "comment": "Malware payload (RevengeRAT)", "value": "3bd554cd7c8d0a67b23a6ce39c06568da5f52cd1b529b3869a6120fea451b2d263c7492dbeca5ede35731a02113d4dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912040, "uuid": "a1cd0c4f-64db-4d13-bf91-3c4411c8bb26", "value": "T110622A09B7EC4339C1BD07BC0DB242256371E5A39A62D71F1CD890FE8992BD55B60BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912040, "uuid": "8fff8fbb-06b1-400b-9222-94b0ed732359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912040, "uuid": "ebb963dd-be26-4d18-b78a-4fea63ef0054", "value": "192:a+8C+EKS0O9ejYTDG8bcp4Ll3FsnieXubWyD9JEBkGxVX/qoNsRJE:aNVjYTDG8gpW9eXTyD3Enx0oND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702912040, "uuid": "b68bdbc0-fdf6-4d47-9b87-7b136a34684a", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702912040, "uuid": "7442e938-1bdb-43ec-bd0d-be881fabce9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912040, "uuid": "7e75311f-dcc6-47ae-b9dc-e03c600bd9f6", "value": "bS2m.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be92a7f-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1702889478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889478, "uuid": "f4ebc541-dc45-4885-9a87-95b9aa3626aa", "comment": "Malware payload (AsyncRAT)", "value": "196c2d75a939fe8301b32bc935be6749", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889478, "uuid": "137c79bc-0d2c-48dc-a19e-32a81762c587", "comment": "Malware payload (AsyncRAT)", "value": "8737b9c5969931c61500427c301c40e635acec433bd4450e1dca9f202e97fb6f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889478, "uuid": "fc85df83-324e-4157-97a6-9a730972694c", "comment": "Malware payload (AsyncRAT)", "value": "c1fce561343e058f1754012ed0c8d43d59f1461e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889478, "uuid": "d431b56e-cb22-4d17-9731-a7f31385e263", "comment": "Malware payload (AsyncRAT)", "value": "9cc13fcb319523ac28852664dcf3d2a1c34c6592dfe8295520c4e95066df7d2e1c70e7f799f02b6d1d69e13976851de3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889478, "uuid": "935349bb-2d4f-4db0-9ec1-7f50968126f1", "value": "T1D2F4813C48BE223BD6B5C6B5CBEC8867F05CA46F3150AD6594DBC36613C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889478, "uuid": "6b0263c4-d426-492f-bff6-a664dbb0aa1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889478, "uuid": "95c25547-8df8-49de-8a71-4173120380d8", "value": "12288:T2wEx2iNMyV/8jCTzNEf8JCLVGnM0x4YbI8b28eV9hzy:iwk1iDjEEkJCL0MA4YbF69hzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889478, "uuid": "89e1c1bc-32de-4e6e-b8cb-22c068a4f674", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889478, "uuid": "15ff043c-55e7-4fbe-93a4-cca3bd1f7c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889478, "uuid": "4be16a98-a09f-46ce-be11-4e956f713f76", "value": "DOC9087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b761a8d2-9d6f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702881363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881363, "uuid": "6b0c28db-91d3-47a9-a4f5-7764b5b7ccb2", "comment": "Malware payload (AgentTesla)", "value": "4a0bdac5e05f41ae7c96f626381aedd7", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881363, "uuid": "6c38e423-4a53-4a82-bafb-d9c7e0e70410", "comment": "Malware payload (AgentTesla)", "value": "87ca7338102b585ba5eef4bd89fb2d24dbce8c7b57ae4d62fd3b7e29988b5e65", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881363, "uuid": "6ebbf26e-6310-465c-9d4b-ea3ad3b2736e", "comment": "Malware payload (AgentTesla)", "value": "99536fe4ebcfc41ba83472c0f5f7a0a57e6de849", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881363, "uuid": "7f7841d4-56d1-4871-b621-e04ec7d22795", "comment": "Malware payload (AgentTesla)", "value": "f144662e3fe598bfe34759282fd56a7db1115ac529e458ae5473c196034c7aa42896bdc3188e00b0ed6cfbc76c724e8f", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881363, "uuid": "2b67c222-809f-4529-b3da-7935970d3142", "value": "T1B4E4339D1282F80B466BA1D371ADA3AE3C6ED1581910F7AB3AAD731763055DEE033D34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881363, "uuid": "6b60f6d1-cde2-4374-b51a-668c61ffc01b", "value": "12288:W/1v2ElbBFaqFFinQl4VTb5WHQ62J2pW1r461G+OLhopsS2gidtIZz6blSlj0t8O:W/1v2EjFDFFinI4tb56n23r4C+FoeS2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702881363, "uuid": "7f196c47-c841-4171-987d-f08c1358e2d2", "value": 713349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702881363, "uuid": "edba7606-2b35-4059-b679-116bdb62fe48", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881363, "uuid": "ddfc91e8-f591-4833-b42e-eef113606cae", "value": "OUTSTANDING INVOICE-CONSIGN GLOBAL LOGISTICS.xsl.exe.gz.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5fa37c-9dec-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1702935008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935008, "uuid": "596d945a-8502-4786-a254-0e8a0414f1aa", "comment": "Malware payload (Stealc)", "value": "2d21304daa82d7cdab065c29dec1161b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935008, "uuid": "d31b1b59-ae8b-4aac-b7b9-336d456f7821", "comment": "Malware payload (Stealc)", "value": "8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935008, "uuid": "f5596f99-94cd-41f6-a97f-b3ca727199b0", "comment": "Malware payload (Stealc)", "value": "afda5cd20e23595a89f7aedef67148bc8cd66f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935008, "uuid": "ca29e999-860e-4e13-8413-74c6c1f4c73c", "comment": "Malware payload (Stealc)", "value": "fabfd9be0e786bc6316b87b844ee492e1c8d09776c6b8bc1e4388ccdfe88f98f3a0f62e94f2bd4991a04777b229e4bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935008, "uuid": "799bafcd-7620-4851-9e9d-6c815bc675c2", "value": "T10A252213BBE094BBDDE5277028F616870732BC611974876B339A99990C732E0A57237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935008, "uuid": "2e16bcb7-60c5-4e30-9ce7-7db4c1471863", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935008, "uuid": "5d992f75-aecc-481e-9b96-0caabdde7a28", "value": "24576:zyJafUWfQ3/Td/4k9Y6oQogOxHLC9TiOmbgf:Gu9fmTdjtL4V+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702935008, "uuid": "971ffa19-5c0f-4ed1-8cbf-c3871a52b8bf", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702935008, "uuid": "7877b303-9dfd-408b-b006-7eadbea89b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935008, "uuid": "6629337c-4273-4416-ab35-9df7faa483cf", "value": "2d21304daa82d7cdab065c29dec1161b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b557b6-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873257, "uuid": "834e2721-0862-4c35-a481-80300e6d5220", "comment": "Malware payload (Socks5Systemz)", "value": "f0da757ea2402ae8e85dd7a68e77405d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873257, "uuid": "9d2a1a8d-367f-47e6-9373-089da6ad31d8", "comment": "Malware payload (Socks5Systemz)", "value": "8bb8ddf4bc1f6d8a8fecadcf6d2ad208c6429092f52cddcd5db77307cdef1de0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873257, "uuid": "b3ff8516-7255-4517-8544-1ccee23493b2", "comment": "Malware payload (Socks5Systemz)", "value": "6b2a56abcd215a45f7950b90d9690c76215ee0fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873257, "uuid": "bd6b9d9d-d68a-41ea-be58-8f6fd5c3234d", "comment": "Malware payload (Socks5Systemz)", "value": "584bb5992917036f4d4740ae90f3653bc5d23da31ee2d6f5459d27455f4c404a03fb560f30543c61072f4621348ab132", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873257, "uuid": "4c0ebc58-f272-494d-a64b-4a52a06671b6", "value": "T1B566335392454DB9F074A97CAC5BE9200BA7B3C2269F21E073CC7D75AF1B6EA14272C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873257, "uuid": "b5141175-e8d9-4c01-b817-4d2648c96152", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873257, "uuid": "0030f7f9-ecb8-437a-bc85-11cdc0973ad0", "value": "98304:/oP7AnGPoDtmRRSVeH5Y5iiKb43obOZjhu5JLMIqYoQxQ+n9mwCrTPSPmA:u50DEb43OH5dtqYxvItrTaPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873257, "uuid": "e5ea5335-3bd7-4686-ab45-1e80b3b20506", "value": 6755423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873257, "uuid": "a71664e8-6994-4c93-8b67-41689df5cbbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873257, "uuid": "c936a8de-351e-4455-b4fa-e8684b026bf9", "value": "SecuriteInfo.com.Trojan.Siggen22.40888.31002.9976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d852962e-9d70-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702881848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881848, "uuid": "702aec53-2b0d-4315-b94d-cf66dc27dec9", "comment": "Malware payload (AgentTesla)", "value": "8fa26a2a72443a0d285f319b1e8ee18a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881848, "uuid": "c2ecdfdf-f9f0-40c5-81cc-42a3de58d6ef", "comment": "Malware payload (AgentTesla)", "value": "8cbc30abecd032f68fb4ac5c152deea6f9351c0c34ad445e9560af5c4ef01a22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881848, "uuid": "670e916b-5cd0-47cd-bbc7-0f3a7279dfbc", "comment": "Malware payload (AgentTesla)", "value": "c372bfca0639b881362c9ef8713a3d372b972bcb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881848, "uuid": "fc1ccf38-9cbc-4c5e-95f1-789bbd3229f0", "comment": "Malware payload (AgentTesla)", "value": "a78aad93504c2d6d55f4306e83bb30be83d13997ce5074ebe0120fbc9040175af571762af3863331c2a59b4e9922eae9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881848, "uuid": "6d82fccf-54ea-4b72-97ff-60411f71c450", "value": "T11CD4238D071F23FC8464F4BEFF4A92A26885D91A731E490DD6B3DE8580C1AFA7D1D258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881848, "uuid": "5a392c5f-f96b-4d71-ab5f-6685fde23f58", "value": "12288:bXC61tbX8opOOAgMgVAOw9PbBdMKj2+NzWZCcxUS67H+te8Oby:bXCOpOiANP7MWbzWZvqeBOby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702881848, "uuid": "f61418f3-e1f3-43bb-b752-5317eba91aeb", "value": 656822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702881848, "uuid": "47f5cc33-dff1-4f88-a45b-4cbd345c1a36", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881848, "uuid": "69fbe582-a8be-4067-88bf-3c97c6e5f680", "value": "PURCHASE ORDER.pdf_________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7412926-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702925601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925601, "uuid": "757acb22-5cf0-44b3-ae4e-8e33de6e6360", "comment": "Malware payload (AgentTesla)", "value": "1909723758fd00b07dead813783e27d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925601, "uuid": "68aa2d57-82e9-45f6-94b2-26c5bcab15aa", "comment": "Malware payload (AgentTesla)", "value": "8d693225be9e1f824c20f3bc2f71a9c21e87a2b32bca274580b7abad75ecacbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925601, "uuid": "cdfce8e9-ae9a-4de3-b16f-e77d1a8b7106", "comment": "Malware payload (AgentTesla)", "value": "6633cd894fef247d830d1fbc428de450a6584765", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925601, "uuid": "ae31ac83-01ef-4f95-a01e-48ab317f2937", "comment": "Malware payload (AgentTesla)", "value": "a028bdad7b373d8f769d99fadd10ea8604ff37ce3802b7ed343aa4cf9c5e5fb707ee1e5bcadcb9806ab2d70080799cd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925601, "uuid": "bbeb732d-8570-4ce5-8fd2-c64c682371a0", "value": "T14025ADC8F540B5DDCC1ADB319975CC3092227DBE9A36910E24DF3E6B7BBE29385150A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925601, "uuid": "dc800886-dbb6-4ad7-95fd-3fb590c03706", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925601, "uuid": "f1737233-8387-4579-abd0-f0593cbb4b80", "value": "24576:tjutzwk1e7mNEEZ8YU69O/RiWcjlkIX1q:tjiEkg6NXU69O5PcjlkIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925601, "uuid": "5fa6a040-d5a1-429f-b23d-6cdf201f288f", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925601, "uuid": "c2e6ebf6-e25f-4992-8bb3-eb1a5dd7fdee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925601, "uuid": "6923638d-e88e-49dc-abe8-7f3ade0bde49", "value": "INVOICE AND SHIPPING DOCS DHL DELIVERY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fedf660-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702889458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889458, "uuid": "9b6f76a7-1319-422b-b106-534882d36813", "comment": "Malware payload", "value": "8b3f5680df2c301abb0e6d1121ba4695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889458, "uuid": "6c426e36-75d6-40e6-9d43-262f5f07be33", "comment": "Malware payload", "value": "8d75ec453d1ff873f2aad8756a39f0c3ecb9addd6ba0a05e771acc9bbe0170ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889458, "uuid": "908875f4-3aa8-4fe3-8c57-8f564094468b", "comment": "Malware payload", "value": "7c42f7cbc09fe30bc6f716c3a0c38c30e1d5d2c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889458, "uuid": "05c7640f-b3d3-438c-9425-de63400ad206", "comment": "Malware payload", "value": "b761d4cc1a29046066d05bd47ebc366650d27e3cbb594efa32b07e09c88fd9cadc88a8af009f6a80cb0c700b1ceacfbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889458, "uuid": "ab85d829-0346-4808-b499-3a5fb4f2c2aa", "value": "T1D8046CE2DA8484DAEC7943B368778C6A11A73D7D9BF0548E5B9EB7311B732D3001690B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889458, "uuid": "fdaa54f7-eb97-4205-9085-713e8ac15e7d", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889458, "uuid": "49b582e7-9280-4098-aa04-39505c70df58", "value": "3072:01E/rS2paccKJTtcFVKVoernu9IDIu9dMGlUQe7N4exXqxDoqYR2A3A6hib:01oFGG3wIHdDqNtNqYIAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889458, "uuid": "1a5971a9-6d77-45da-ab26-cc8e21887470", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889458, "uuid": "ea90ca8a-5eb6-4722-8beb-06271ac91443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889458, "uuid": "58182eba-1b65-4e22-b605-56b73d9527b0", "value": "8d75ec453d1ff873f2aad8756a39f0c3ecb9addd6ba0a05e771acc9bbe0170ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d55c37-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mydoom)", "timestamp": 1702889488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889488, "uuid": "cebc9e4d-6875-4590-8e2d-a4697aff75ce", "comment": "Malware payload (Mydoom)", "value": "3aa484f942ddfeff67d043fafb9877bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889488, "uuid": "0a72c974-4e24-4941-bbd7-90c51de279a2", "comment": "Malware payload (Mydoom)", "value": "8e934dcd46eb57d42712d097deab6ce00ef1ce2db87d03f8d3d8e8c10da7e088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889488, "uuid": "fcb12b06-2a6f-49b1-aa13-dacfe9ec1e41", "comment": "Malware payload (Mydoom)", "value": "966cbc5b018d94b1797ad5d506ca4d3cb639eca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889488, "uuid": "5d3ba2ac-fd3a-4f30-ae17-a99845e16137", "comment": "Malware payload (Mydoom)", "value": "95ded60a71f6e123d087720684053840d6fd376da6bab64896479ccce3ed2f90fb9ce034a2ecef58c4889c9dc890588b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889488, "uuid": "47d41df6-52b1-4b80-87a2-45345465d733", "value": "T14323D1983E4FB942D2850C382A03EE7ABD52FD444D09278BB5B47B0BBCB1F95455CC45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889488, "uuid": "9f1c05ac-68e1-4227-b81a-3fdb32bbf5b1", "value": "98cd465c2ab2841f9fd90d5e847563f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889488, "uuid": "71944062-ecd7-467d-82a9-e36f2bb0f45a", "value": "768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889488, "uuid": "a2274ae4-afab-4246-bbec-fb55f1d062c8", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889488, "uuid": "c252d215-e79d-4509-86e7-bb531c12f3d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889488, "uuid": "b6dca8bb-37f1-4097-ba80-0bc5c915f9ee", "value": "letter.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f3fd2c-9dcb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702920839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920839, "uuid": "4e01498f-f8a5-4318-ab97-c9537da69231", "comment": "Malware payload", "value": "250a7ac14983793ef8ab47ce13a68eb5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920839, "uuid": "0e561038-7459-454a-a3d0-6328e643f81a", "comment": "Malware payload", "value": "9006565cc5b50ef314195bb87606b1216338182b8d0c3335554847d454b2208c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920839, "uuid": "a9549888-b086-4aa2-96fa-e452184cedb2", "comment": "Malware payload", "value": "2fcb3ce8a758df0a800cd5db26ee262304ce3966", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920839, "uuid": "5d131e4c-12f7-4690-a291-84d9ff99cf04", "comment": "Malware payload", "value": "b26e128809624dcfff0251a08e46151eb361ae66c50028434e56181dd30f404cd0cd785965a6a8ab945b5ee0f5bd10a6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920839, "uuid": "053e005d-a7ec-4c28-b5d0-14e37508c449", "value": "T12DB39C6DD34B01698F621336AB1B1E5442BDBA7EF38512B1346C437933EAC3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920839, "uuid": "596bf0f8-7f36-4b4e-9bab-81fe7ec359fc", "value": "768:gwAbZSibMX9gRWjtwAbZSibMX9gRWjN7jrGfwwP85krsbFtpUXtrLtCfkI:gwAlRkwAlRCrGfwwEbpSrLYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920839, "uuid": "8f76175b-e2d3-4442-9e85-f08911d2dc6d", "value": 114322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920839, "uuid": "4b5e89cb-1073-44df-80f6-ee382b5ee371", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920839, "uuid": "878c241a-e163-4e27-9d35-d0e47ba77943", "value": "financeXcopy.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dec6e6-9dcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702921297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921297, "uuid": "e08521a1-9ff0-4d62-a2e9-10625ab2590a", "comment": "Malware payload", "value": "566ad751883ec746767ccf67a981a8e6", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921297, "uuid": "30996026-0137-4650-b5a9-5b6dbbe00c8b", "comment": "Malware payload", "value": "9264a7413d93241f47949e7ea29543c19db2c6929cba182c0c02da6c3943b4bb", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921297, "uuid": "ddd36462-c7f1-412d-bdbe-333eae3a990a", "comment": "Malware payload", "value": "8c9c8ea83fa5129a9e4c6a187d46369bfc2f10b7", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921297, "uuid": "768f59b6-07ef-407c-9a73-a54ad721e4e4", "comment": "Malware payload", "value": "35ac858cead4788cf98635a6ec903c6aa78e712bca87880b1852f3e0b8dc1440122c6c950fd51477c3730a2b883d4397", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921297, "uuid": "57702030-8af4-4414-bbe1-85a1116db13f", "value": "T16A635A778F0DAC501739889370FDB3D41D5E6F232E21AE98BE6C39118BE576A50EE190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921297, "uuid": "184c5fd7-510d-4ddd-9ee4-1a22a105eb51", "value": "1536:FfClBbrW4GEw2Q0ejpr3H8oqyqIvSVCGxxFJy+4lmFM:JKWx0K3H8oIIKVCqHJypL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921297, "uuid": "7c7e5ad5-c7ca-4696-adb8-fe6053379625", "value": 68761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921297, "uuid": "4e1ccc13-feaf-46f0-8123-c3f4807a1aba", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921297, "uuid": "3c7bf030-fb68-4ae5-8d53-bde0995470ba", "value": "2023.XLS.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8cc2ca-9db2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702909986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909986, "uuid": "b92abb58-68ac-4514-bc1c-98280a5c7721", "comment": "Malware payload (Formbook)", "value": "617b4e2337b0fd81b4f153bbfe607bec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909986, "uuid": "58dfd687-6090-49e4-ae3a-0689cdd88151", "comment": "Malware payload (Formbook)", "value": "93c052934438599045e6d9a3177f5d7d57960cad17070bc74444c1e4818bb81b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909986, "uuid": "85e2a463-b1ed-440f-9cc4-2ef585ba72f0", "comment": "Malware payload (Formbook)", "value": "b16ae153c19b0a922164728cdcc711b0eeb24920", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909986, "uuid": "322f4d04-629d-4118-a579-adeb4f32d5c9", "comment": "Malware payload (Formbook)", "value": "caa33cf64795b4285c5932eb005c096fbc53ea579bf8ebe979e0108d3f6d823386408024faf3eb9af9ec7af6709b49e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909986, "uuid": "3f67f9c3-b364-4026-854e-ffa1e7073453", "value": "T15825D33C58BD2237D5B5C7A58BEC8427F25CA46F3151ED6588CA83E613C6E4278D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909986, "uuid": "923b2b6f-9074-4809-8705-33c78060953e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909986, "uuid": "f397293c-2460-455b-b790-dc66b80e4ee0", "value": "12288:aGXDY6tGuoKicTiyb7twQRKumT0EIBDndabfKfMfzMOkSIXAEh9X1+elOO:FzAKikfthoBT0TdabifMfn4A6X1SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702909986, "uuid": "09800828-c981-4a33-976a-2143174103d9", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702909986, "uuid": "377daa62-0171-4ef4-b689-a36d8029583d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909986, "uuid": "972aa4af-0f16-4835-b331-8dd57e61b26f", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0648e85d-9dc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1702919721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919721, "uuid": "0e993cad-3893-4547-8303-f9796a835e73", "comment": "Malware payload (RiseProStealer)", "value": "9fc9eec489f9232fa0351afa06bd9d3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919721, "uuid": "efa10df1-be57-4d7c-a119-31c990d93298", "comment": "Malware payload (RiseProStealer)", "value": "949edc5ede31cf9316dedc155d8d4ca93f8da0464d2ef0d8bff52dfddcac8e41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919721, "uuid": "8a785254-4f7b-4a28-b7d5-1ae82c93cff0", "comment": "Malware payload (RiseProStealer)", "value": "fdf5de8e096a923ea3adad581935a40a795dc40a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919721, "uuid": "1da724e3-db57-4091-9cba-f66cfc9a73f5", "comment": "Malware payload (RiseProStealer)", "value": "d1d4480a5f4b404a08078288928d46cbe6a694b87b445689deebb9df7bd03f9601e6fd0d6f8d524ab9976b4174de652a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919721, "uuid": "cfd02674-d1aa-4c85-9f8e-7e65b20bc0fd", "value": "T194252353FAD1D4B3CEB047B054FA1A831933BC614E34876B6B49B5992C722A4693237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919721, "uuid": "6fa30d57-0890-4c1d-8ab2-28739b4aefcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919721, "uuid": "71a5bce7-8443-44cd-8056-da253f718870", "value": "12288:aMr4y90puOomLG6P4MppP/XtCFM8VCNDjIBW9wh8x/H+L2koVWBio9viPOcuymh6:GyG5959CIdjIk9nZQ3OWHimqn4Me9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919721, "uuid": "8e0251cb-da5c-414e-9826-d4c40d41ef33", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919721, "uuid": "22c7ddfc-67f7-495f-8eb3-abf40b2ef427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919721, "uuid": "89044a4e-d0de-41d9-8ef5-42412858988c", "value": "9fc9eec489f9232fa0351afa06bd9d3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f3ac45-9dcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702921326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921326, "uuid": "63fb969e-d6c7-459a-afb6-41a603cefdb5", "comment": "Malware payload (AgentTesla)", "value": "7dff9b4c1bf9338fc814f4780a7f14ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921326, "uuid": "9e5f4702-3ac9-4d25-9c66-4b3f84a85f13", "comment": "Malware payload (AgentTesla)", "value": "94afbf76b9c59a5e2ae4bc864a78c41f92602c5b37e6771eb29864344b69dbce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921326, "uuid": "ec7d7180-e112-4445-9048-5c00e37fc4fd", "comment": "Malware payload (AgentTesla)", "value": "0eece085a1f0b5d8a2ba98b155614fdce0c414b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921326, "uuid": "b7b86cf8-df54-4b3b-99e4-8baadeb39d77", "comment": "Malware payload (AgentTesla)", "value": "40d72a983cba4b7f56ee7eeac9f98a186c117547e41d3859705431ab582b87dbfd3aed2a1af3f1386a42bae7699513c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921326, "uuid": "272c1da5-08fc-4f90-800f-1fe56d3e315c", "value": "T10B15E00472B86B8AE0BF97F9699011204772B557787EE7294EC164DB0DF6F204E43B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921326, "uuid": "312c6914-5e99-483d-afe5-abca1724e1d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921326, "uuid": "b81faaad-648d-4ada-9f51-2705308fbaa5", "value": "24576:F7z7mgj8kw6vfMovKS+qu7esygxuVLco2CU:Nz7mp6vfTvKzqu7esyg4pU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921326, "uuid": "794608cf-2ec8-49eb-97ef-ed45a6d64a0c", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921326, "uuid": "22507bc0-30b8-48d5-99d2-fc0b008bc688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921326, "uuid": "0b6b58ac-817e-4030-a032-b209ab7e4d97", "value": "PaymentAdviceNov2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b12e526-9d54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702869639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869639, "uuid": "b211b5fa-4025-428d-9c80-e947e679822d", "comment": "Malware payload (Formbook)", "value": "611e4e34401c603b121b903174552dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869639, "uuid": "c1e52872-4a12-44f6-8ce8-d10da1e4a1e1", "comment": "Malware payload (Formbook)", "value": "975a0831f4a98e37833cb7b778e22f45a6c9ddd60e5291ec1f9b5c2c07ddae4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869639, "uuid": "dff24e19-e7aa-4c9a-9a6b-a99c045f59ac", "comment": "Malware payload (Formbook)", "value": "c01fd901268b16592b038748fea9476bc517e1a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869639, "uuid": "1e07a419-630a-44c2-bd82-b5c312a0c511", "comment": "Malware payload (Formbook)", "value": "8b03865d5d31c0bf966a36127a8e670df4993ebf4e3d82b0b32e628d215f7b42677fbe0b0db28a185f9e3edbfc2540b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869639, "uuid": "769f5ece-8f6b-4581-af7d-e51c660a4347", "value": "T1D9F36C1174C08072E573153219F4DAB06A3EFD714FA26EEFAB840B6E4F352C19635A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869639, "uuid": "d2c6e9b5-5f08-490c-a949-8b4190fecbf9", "value": "7b84262346ae10fcd5a6070d7504e7f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869639, "uuid": "42248245-4f97-4673-a747-4e3de1581549", "value": "3072:49lcnxhiBoyRZxhoSXMJSZPk84KA51Q3acyAd2HZKXEr+Vge0eJAu6y:49lcnxqzDxho1SZk731RcTdgZKf36y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702869639, "uuid": "5141d5f0-9752-46e9-9e24-2581bd881391", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702869639, "uuid": "382dd944-a8b2-49f6-93c2-1a55230bba67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869639, "uuid": "393ee32e-8688-48dd-b7e8-36631f2ae1e3", "value": "SecuriteInfo.com.Win32.TrojanX-gen.24593.20641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917eabf8-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889460, "uuid": "bd0fe8aa-24fb-409a-8737-a67cc8571d63", "comment": "Malware payload (AgentTesla)", "value": "e72ad3ea336d4a5ec5571c6a8b19055d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889460, "uuid": "3e755378-0a2b-4fa8-af22-62bc01e96d0a", "comment": "Malware payload (AgentTesla)", "value": "9b2c7cfb8ae4d133e3393a19da516e3209683aeb9aa9b8ecda3b689bb1b60d23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889460, "uuid": "47a3a854-aa59-46e5-86d7-633baa31632d", "comment": "Malware payload (AgentTesla)", "value": "878849583609b571750eb06a6e4bc87940add0c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889460, "uuid": "baad41e6-247e-4586-b863-78a81dab28d5", "comment": "Malware payload (AgentTesla)", "value": "2d78d01714b8807546825a8be26e9bb7d7115341bbc031fad5ca9e669870e6a1f2dce4a4282c4275e265c95f6bb2246b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889460, "uuid": "77a3945a-3a95-4448-ada6-aff97a58c647", "value": "T18D34FE037E48EB15E1A83E3782EF6C2413B2B0C71633D60B6F49AFA518516865D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889460, "uuid": "276e0267-7c91-4a9b-8da7-e427489e8e52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889460, "uuid": "26944cbb-e8b2-44dd-bcba-590990a123f1", "value": "3072:XC/feCmyTxLmfEJ4xbT2nEMfXvZ/5FH9Wor:X0feCmyJmfEJ4xbCnEMffZT9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889460, "uuid": "34dc4934-a0ef-4e10-a1d0-1527b0227e0d", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889460, "uuid": "aaf2f8f0-686e-4a20-a2d6-f48444a2e7ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889460, "uuid": "4912160e-3905-4cd8-a2db-31b7713a95fe", "value": "9b2c7cfb8ae4d133e3393a19da516e3209683aeb9aa9b8ecda3b689bb1b60d23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565977d2-9db1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702909547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909547, "uuid": "c2cf564b-a133-4810-ab13-243bc2ad5d88", "comment": "Malware payload", "value": "1deed30861fbdd1c2398b1853f707c6a", "object_relation": "md5", "Tag": [ { "name": "anawalls13-autodesk360-com", "colour": "#6D7CEC", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909547, "uuid": "88fa8689-71ff-4cf9-afe0-1148e8d20fcd", "comment": "Malware payload", "value": "9bc9334a888337ed0cd68c69e12fac071e535cab7913cad987f1b94e587ad19d", "object_relation": "sha256", "Tag": [ { "name": "anawalls13-autodesk360-com", "colour": "#6D7CEC", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909547, "uuid": "73bddea2-b162-4b49-8ef4-0f2d26cf29ae", "comment": "Malware payload", "value": "5fd8cbb5c0a9e56816c3cd149d7caa021e18770b", "object_relation": "sha1", "Tag": [ { "name": "anawalls13-autodesk360-com", "colour": "#6D7CEC", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702909547, "uuid": "d6255072-992b-4d94-9f3d-038ed1070a03", "comment": "Malware payload", "value": "2eab6d0d78f7c32cdc1e2d4695df89147db49ca0cda2e8f9ee5689e8eff5666f819d26a408aeed6788d862323ccf88d5", "object_relation": "sha3-384", "Tag": [ { "name": "anawalls13-autodesk360-com", "colour": "#6D7CEC", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909547, "uuid": "3d4358af-5812-46e9-964e-b36ba24eb1c5", "value": "T169659E1076C6C436C4BE05703A6ED76B157EBE700BB188EB63D81A2E1EB15C25632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909547, "uuid": "549c7163-7ead-4f09-bcd0-2855a10e2d57", "value": "24576:SSDBNC63vosTi0cNOAqJAkMpYkOIvn9pBo5MTGq5YVJrTsgsFH9YpztdfG8NQGa+:dDeCvosTi0sOAZnWkOIv/BoaTzuVJHsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702909547, "uuid": "9ae4e6c2-9266-4d74-9bd6-0de11e88835c", "value": 1427968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702909547, "uuid": "2903a5c9-d52c-4f0a-9136-5e49f4882626", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702909547, "uuid": "2b1e482b-5522-460e-b1f0-eac3142333b1", "value": "9bc9334a888337ed0cd68c69e12fac071e535cab7913cad987f1b94e587ad19d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82ac985-9df0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702936797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702936797, "uuid": "ca2c272b-9438-4beb-a6e5-01a342610aca", "comment": "Malware payload", "value": "131d1e6446b00796b3689b3672b9a98b", "object_relation": "md5", "Tag": [ { "name": "91-92-245-38", "colour": "#7D0021", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702936797, "uuid": "c49e5a0b-ac4c-4604-b8d6-8834c62530b5", "comment": "Malware payload", "value": "9bca497de15433a6556383decb35868e05268a54b5c382a4cb4fe02651bc1534", "object_relation": "sha256", "Tag": [ { "name": "91-92-245-38", "colour": "#7D0021", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702936797, "uuid": "2945eca3-744f-4f2f-9481-00af8c1579fe", "comment": "Malware payload", "value": "c42c2458330165590cf26f064a2553c4070bf271", "object_relation": "sha1", "Tag": [ { "name": "91-92-245-38", "colour": "#7D0021", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702936797, "uuid": "53f53b98-df9a-4d9b-89c4-3b0293e71f06", "comment": "Malware payload", "value": "9fa464f28bbea23fe107395c3eab593009d69273fb0b680432b3a0929bfa83e1c5cec4f1e72284ab1f934372711e867b", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-245-38", "colour": "#7D0021", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702936797, "uuid": "60249d98-9806-4be7-be27-3f80c3886dc3", "value": "T14B114409290714737114927E9AFEEF6EBFD56456CE821A25EC82467D36144936461C43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702936797, "uuid": "b4db692b-653c-4851-88cf-135395988e07", "value": "24:ZOrODZeIewLTTw0P3Jvx0GqdvUgQV0Jb7DEAHMsvW:ZSODcfwzRBx0GqGV2/wAHM8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702936797, "uuid": "e0a911e4-7813-4b8c-9c54-d1408a9323c6", "value": 882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702936797, "uuid": "2fa1d980-8984-4fd3-9409-9b9eddd407b4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702936797, "uuid": "85b24593-e475-4b9b-b0f5-1f45597190da", "value": "lllo.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9972e0d5-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889474, "uuid": "f7935791-f963-4710-a6d3-e961aae7cae4", "comment": "Malware payload (Formbook)", "value": "fad313f3b947fbca3fc4c7318c943fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889474, "uuid": "44f7d7db-fc6a-493e-b7e1-a6935da33abd", "comment": "Malware payload (Formbook)", "value": "9cf514b4555e47eccf07148c0e961250d108d04d8187a4aa224629f7a0961142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889474, "uuid": "930e0216-432c-4e3e-bfa7-f448fd3dbd87", "comment": "Malware payload (Formbook)", "value": "2afb7ebbdfe5dad0bc48d7d32734c78f8842c5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889474, "uuid": "a165bfe5-f5ac-463e-b80a-bd54815e6825", "comment": "Malware payload (Formbook)", "value": "a73292eb26b48ae5d76f7145c8ceb8c871e4f53a0912fd4ac90149c41b9587a89ce01d0bb15f1971c2d04b67a3d2a85d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889474, "uuid": "ef3b20c7-7b78-44d1-b91d-373e5907eee8", "value": "T1E815F43C48BE223BD6B5C6B5CBEC8827F05CA46F3150AD6594DBC36653C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889474, "uuid": "be36cc1b-5c9c-41cb-819f-7398d2a5dcfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889474, "uuid": "66be314c-b96d-4850-b7ed-b1cbd33048ac", "value": "12288:xtwEx2iNi62XAo2ghP8C+74a2j3cRnBMQxCvpF5v3YryW7:vwk1FoJNQs4R/wzRYryW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889474, "uuid": "21abba34-592c-4c0e-b0c7-bee162c1960f", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889474, "uuid": "4d71f679-68cf-4073-8750-e76a53ad9b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889474, "uuid": "44a89765-0ee6-41bc-a5c0-00ddd4f8c849", "value": "CTM REQUEST_USD12,400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c40803-9dca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702920552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920552, "uuid": "8720e997-8959-4eab-a1c6-3762499ed577", "comment": "Malware payload (AgentTesla)", "value": "6f34012b079006f17de8f1f28ce77ea6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920552, "uuid": "d0e61f2d-21c5-41ce-bd4c-4765c48cc1f0", "comment": "Malware payload (AgentTesla)", "value": "9e434a3d560944475e76627bd7476dd0cea2104d9c14224d154ec303c0e2fccf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920552, "uuid": "47b996c9-8e52-405b-abbc-9938a4a9d678", "comment": "Malware payload (AgentTesla)", "value": "7576da5de573c7f361b17feb0bc6a3f53d477de9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920552, "uuid": "fd6c2e11-4145-4c21-bd9a-042a3cda5352", "comment": "Malware payload (AgentTesla)", "value": "72012220b256b087e2756ba647b96fc445842adc02c3eef23ac446e2ee6ac05ea02667f0e32cf4845c9e1dd5a9b84a02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920552, "uuid": "c1a7eb1e-a819-4040-9b60-14f198dbb14d", "value": "T1A274122672E54DF7C292477019B35B72C2A6A76060313FAB53985FBDECA03C74B526C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920552, "uuid": "648416d3-c8b8-47d7-9a09-93d7e899b9a7", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920552, "uuid": "0de7e586-db51-4663-b946-9579e2955d1a", "value": "6144:bhjmb0T5z3qHmiotZUIoXDer06wd4RLBBjX99okpr0R4rna6fRPFsqf0oTaCof:c0T5z3Hiot+oW4RLDjXlr1rTfRtsqcoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920552, "uuid": "b837da40-2e3a-4cb6-8f1a-1bab84fcafe8", "value": 352353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920552, "uuid": "6e7a3cf7-f6a6-4cf2-a6e9-7f8c64bfb91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920552, "uuid": "2f4090f1-8183-4120-9203-c775ea8f9527", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d24f87-9dfe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tinba)", "timestamp": 1702942770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942770, "uuid": "eb0c70ce-2450-4664-a1e8-1fac99648609", "comment": "Malware payload (Tinba)", "value": "0411c0706f66b49aa6bef1528606ee31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942770, "uuid": "542111d5-4892-425b-949d-1129d64858f3", "comment": "Malware payload (Tinba)", "value": "9e6e9d8eabba4b886fa84170137e3a72c35cc7b360a5cba1a08cbc6b6f468a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942770, "uuid": "1362eddb-ca59-4b4a-8771-56cd1a2610cb", "comment": "Malware payload (Tinba)", "value": "bdb8cb7a8aa380138ab9220075bb08b03a5edc28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942770, "uuid": "9f8b9074-37ce-47c9-b7c6-31856ff1b5cc", "comment": "Malware payload (Tinba)", "value": "76054e1093c289907dd17ecf4a397f3dc85f2d65fe041b6cf833da823d3006cde745592d1175c9fbd5e12f61d2eeed30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942770, "uuid": "f2a025b5-e1e2-4513-b3db-8876110765a9", "value": "T164B34B62F204E89BE817D8F29919CD3164A37DBC88A0455E32D97F6D58B3AD30859F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942770, "uuid": "ef6a6f75-72c7-47eb-83c8-035f9def4d6f", "value": "d39aa71a62356d5bd05b3ccf2dfedd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942770, "uuid": "47fa510e-5af4-4f24-b9e3-7c632c04ebd8", "value": "1536:jiLOvRmmQegJfBbmAQ256/ZrwWhwqjhurmKFcbL86WV0E:jiyvRmDLs/ZrwWjjAqGcfzWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702942770, "uuid": "a7df2867-00a8-45f0-b740-d6d77e0fd069", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702942770, "uuid": "b82db426-f98b-4e3e-bb71-32fc95c74f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942770, "uuid": "b8e76f76-d4d6-49cd-840c-5b6989139630", "value": "java.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f00dde6-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889456, "uuid": "02bb5ade-036a-4f98-ae2c-cd7cb03ac99a", "comment": "Malware payload (Formbook)", "value": "aacabac7d4d4a9ecb798000418ad25b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889456, "uuid": "dc5cfb0f-5e25-4807-b834-95e21de0a8ec", "comment": "Malware payload (Formbook)", "value": "9e8236c0031bc36b82d7d6964a8f46ba037bc826c4eb7a23ea74e4e1f4f6b643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889456, "uuid": "7426c589-d53e-4cba-9d6e-92df5d812dff", "comment": "Malware payload (Formbook)", "value": "5235641d70560d94d000b9f2e48edbd37d177fdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889456, "uuid": "f8a8bce6-9d08-4e62-9659-df635877e225", "comment": "Malware payload (Formbook)", "value": "5b6b5951a85a1c7614ad6b89aee0c4329c095507251b2b3c00d0fc2b8621d2183198c4334d3b5ca54273041ea3467073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889456, "uuid": "5b595dfa-3618-4456-9b8d-f2c7f3c593b9", "value": "T1C805BE3925E2CB96F16DE639CC1C42394778AB00D35FD68A2998B3E52CEA3504C4E777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889456, "uuid": "a490aedc-a0ab-407a-ae61-e441b4618042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889456, "uuid": "98a16a06-18ed-49fa-a897-fa4f3d385b70", "value": "24576:oJwhfTD40dBuLnI31fHJ/KzhvFK/tzL7se:omFq4HJ/KzhktzL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889456, "uuid": "2ecd13cd-eb3c-4afb-a24e-c832942abaf9", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889456, "uuid": "4a898c82-3847-46b2-9f6b-d54a0f10ce89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889456, "uuid": "7d893ab0-287b-4674-9eca-ebd71a9254d4", "value": "4500379220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cae21b6-9dff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702943112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943112, "uuid": "2a26f2d3-19c5-412e-be30-3115ea113e1c", "comment": "Malware payload", "value": "54b34c36efd4417cbcc35e2ac2c3e67c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943112, "uuid": "0a6d1abb-972f-4479-b50d-0f6115f1ab27", "comment": "Malware payload", "value": "9f88f8dba6df3a1116c8444e9b03812fcadf4d8bf9f67d6cfcfb42eaae819e70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943112, "uuid": "961f8c4d-f00b-4ce8-85d6-57056341e17e", "comment": "Malware payload", "value": "1e8515d94951bdf686fc5e2ab33885fb99efbaeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943112, "uuid": "c3d2d890-5b32-4d00-9fdd-e8e6da34e9be", "comment": "Malware payload", "value": "152c918733475ce48bfcaa067651e12c740237698a0d0abf2214df32b2cc1b5207b4815f06dacd5180c91890113eb223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943112, "uuid": "356b1a6d-86f0-4981-b230-80296da51b90", "value": "T1AF5408D3A2E17D54EA264B73CE1ECEE8761EF1508F19776A5219AE2F04B05F2C1A3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943112, "uuid": "558da362-1203-44ac-b839-a9cf0ed43bde", "value": "20e678c23f163ab833ac83984c9c31f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943112, "uuid": "3cc4a196-b788-43d4-a7c8-c1820b74a444", "value": "3072:9LJYk6t5eTZuuC3rYFwHV6nRKgB2k3zjdCZr6TN8TiuFxAXc5OUZdu8HVZO7:9LKlsTa3rYfB24Mr2s4jUTu8HVc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702943112, "uuid": "9ccdf26c-3e1d-4a9d-a25f-e336bca7adbd", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702943112, "uuid": "e6b6cb60-351c-4bee-b560-9c26766a66e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943112, "uuid": "8f4939e2-3413-47e0-8fa0-3814cb2626a8", "value": "54b34c36efd4417cbcc35e2ac2c3e67c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c600aee8-9d70-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702881817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881817, "uuid": "43c12e0f-aaa6-4f7b-a3fe-da7bc06457ac", "comment": "Malware payload (Formbook)", "value": "422e5564794772875d98af7d2b1548f9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881817, "uuid": "a43f7b01-9e82-4dc6-8b3c-5e751130bc43", "comment": "Malware payload (Formbook)", "value": "a044c7a7ed6d74bd186f5dcb18ca3dd1e75d3a72f434beeb973c994f6f2f1a15", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881817, "uuid": "a9cfbe4d-84cf-43ea-a6fd-c6fb8f07d8a6", "comment": "Malware payload (Formbook)", "value": "a14289cac7055dea5db7b8b591649685398e82b4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881817, "uuid": "b5d653ff-af7b-4ad2-be61-81876665f7ed", "comment": "Malware payload (Formbook)", "value": "8cbf5dd390fcd53b6ac90df55b61f334cc97b848321051252703e197ce202422634a5d22ca0533f1c1f3698c3951941b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881817, "uuid": "a8388499-dac5-443b-8903-35b5457c1845", "value": "T18722AF28E7A1D699C34601B713364ACACF179E38D3FF48255F8B52E14AB1C292C55F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881817, "uuid": "30d06e58-e4ea-453a-ab20-1943d3264ab5", "value": "192:tj0eo7Y4UXqcaaccHWvRaeUMqWmYkGPQv4Z6nCsSW:twRxtaccqaeiWmOH6nJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702881817, "uuid": "083b16f4-b439-4992-85e1-6bd61358b5eb", "value": 10086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702881817, "uuid": "f2012fd2-9248-4e30-aaff-3b529a6f0dc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881817, "uuid": "fbce789a-aea7-4388-b824-4d6cd36e6c3a", "value": "Swift_Copy_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbbceaa1-9dcb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1702920992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920992, "uuid": "7ba5ded9-901b-41fe-af11-64fe1e23aee5", "comment": "Malware payload (Loki)", "value": "012ba921b7d9f12671e476fbd91d1b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920992, "uuid": "1dbf7407-acae-44c6-a308-a378cfce2d9b", "comment": "Malware payload (Loki)", "value": "a2e10236dab3013a041ead462b2b280af3f4e9f96a3ca878579dce7d8fef23ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920992, "uuid": "35b50429-9805-49c4-b24b-74f96d2aec83", "comment": "Malware payload (Loki)", "value": "ea8bf14e6a59e72d0f2345f62b562f446f14f9be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920992, "uuid": "cd4e5617-85e6-4028-9a3a-c15bf0226547", "comment": "Malware payload (Loki)", "value": "2a7aa45b6827dbc7c87f989f56e16e71e7c9433ee2a880866c4e119ef53a939be4a07e5b1553aba84ea3dad5a16479e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920992, "uuid": "78130e0b-0d80-4bd3-9e86-ca85c4a6cde2", "value": "T184B4236037FC4BBDCD2E63F46E70046613B6158685A1FB984ED916EE28E1F52C3113AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920992, "uuid": "313bbe6b-cd68-414e-af11-ec21d186b9b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920992, "uuid": "1632a442-1994-4463-92b0-209196fa2108", "value": "12288:Q2iNb0oLt0gSLJ6ElEfCb+lVbNrc8nj2J/BWPGdTdnDwPgg:Q16g5y+42Ndc8nj2LWPGdJDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920992, "uuid": "a0e0f9d8-caf0-4477-bd07-6f2819a310aa", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920992, "uuid": "16b51826-0ce9-408c-be5d-5aab34946cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920992, "uuid": "b1b6961e-0e82-4787-95c7-1562e366ac83", "value": "PO_CW20188797-A & CW201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf55dcf3-9df0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702936782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702936782, "uuid": "2dfc47b3-bb2c-4c19-8906-529a8cbcd9a5", "comment": "Malware payload", "value": "295d0fd8403f40be0bfd5474fe67bf39", "object_relation": "md5", "Tag": [ { "name": "91-92-245-38", "colour": "#7D0021", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702936782, "uuid": "d3ecd21d-162c-4fac-b0f7-5e40c480a841", "comment": "Malware payload", "value": "a3d54fba807a60c9c3388aacac8e413ee68d2a985c1f2b8880f4799864e7814b", "object_relation": "sha256", "Tag": [ { "name": "91-92-245-38", "colour": "#7D0021", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702936782, "uuid": "4e0ccf3e-89b5-4cc5-898b-cd0a0a19ce0a", "comment": "Malware payload", "value": "cf31c7554e22087207ba16cc4c21d98cacb9a2de", "object_relation": "sha1", "Tag": [ { "name": "91-92-245-38", "colour": "#7D0021", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702936782, "uuid": "0d9d81f5-d58e-4f84-a424-1ff90d74b50c", "comment": "Malware payload", "value": "c4e7484fdc60d78e723b6eeade1b23b6fa2ab0fb45a43a6a572034fd384038ac653bf4c85edf6fdbc0b4619394739b34", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-245-38", "colour": "#7D0021", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702936782, "uuid": "a98ee540-6f70-4cf8-8a02-3e3ec47bce62", "value": "T1B50165E18B57D40D420B03E528D647A5AB76C2EDD8C1C495941463549AEBE9789C2E70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702936782, "uuid": "aa446037-1b8f-4d38-8435-11dd907208f1", "value": "12:oEOrn6Mn/EimhHA1HU4JQmVF8A3PAQ7nhFXmYA+tQ7t1ymsHkfLiD5TgN7nPPdkw:ZOrd/wVAFU46mVF8WASnhF2KtimH6iDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702936782, "uuid": "e24a2815-3db8-4100-9d82-3846048d03ea", "value": 715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702936782, "uuid": "cbca54ac-a8dc-4d80-863a-8e68f79d36ca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702936782, "uuid": "b1cbddf9-5bbd-4994-8d6a-0bd8b22c40e8", "value": "newasz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926ab8fc-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889462, "uuid": "efbf84aa-86a6-4a2a-af18-f09f1746516b", "comment": "Malware payload (AgentTesla)", "value": "5fa59954f2089e0589458ab5c5ebb242", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889462, "uuid": "d894f7bc-f960-45f7-a173-2c3fa29b8261", "comment": "Malware payload (AgentTesla)", "value": "a525a7fabbbb4d69c4df152d74e0aee17b70b975ae41494ab2f182ec38a20813", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889462, "uuid": "82d6ddb7-0a0e-4a3d-8d4b-db8ab4a7f52a", "comment": "Malware payload (AgentTesla)", "value": "8726d53b04830764e225a20398a40c3c859e9ca1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889462, "uuid": "7e24a3d6-b34e-4673-9d49-a0156f51f956", "comment": "Malware payload (AgentTesla)", "value": "2f149abfc843bb67859dc013da8775553cc0ed75a5ea162281873d914610eeb3e5354908aed0005a1681d84679ed0725", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889462, "uuid": "4e58f3cb-5ba1-4cdc-805a-10d24fc31191", "value": "T194340E037E88EB15E5A87E3782EF2C2413B2B0C71633C60B6F49AF6514516926D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889462, "uuid": "2ace80eb-ec38-43d1-a7c1-a4dd540800b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889462, "uuid": "b77a22d9-5c0d-45a7-ad72-10444ba12406", "value": "3072:sJKSqS6lFp78qQQsC1W3Kj++H5CXYx8yt:sJKSqS6lFp8q9DAKS+QYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889462, "uuid": "7aacdef9-3687-407a-88dc-ab9c4476f292", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889462, "uuid": "3efd387d-3b54-4c5f-adf9-120bdb076de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889462, "uuid": "09ec8bb7-0851-4585-bf83-07af7b95d921", "value": "a525a7fabbbb4d69c4df152d74e0aee17b70b975ae41494ab2f182ec38a20813", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43b81fd-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702880096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880096, "uuid": "29df4132-6606-4217-b397-fe24684a164e", "comment": "Malware payload (Smoke Loader)", "value": "ed5a5f921f1475e715abf99fdb5927a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880096, "uuid": "6278fea1-a326-4bb2-b788-854b60fc305e", "comment": "Malware payload (Smoke Loader)", "value": "a5784ef4e992a0c7c3582778de4dce4f71d8bbfe58d52bda6f79a4d2fab3ace3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880096, "uuid": "7ebc71c5-d1ed-4158-aa0a-d31c79219d50", "comment": "Malware payload (Smoke Loader)", "value": "50ded54b381506281b6076bdb3dcbfe90661f3df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880096, "uuid": "5899e00b-3e15-4af2-acba-c0f021317f5a", "comment": "Malware payload (Smoke Loader)", "value": "3d066fb145cc4c85d83da2f6f16c18f6634e42036da042a0e52720f6c197d01ddb8213b5a3bbb836c0357268ab2b9d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880096, "uuid": "7e107f25-315a-47b6-a0c3-59604a924980", "value": "T17344BF1232E080B1E12356765D6AC7B46F2FB8654F22ABDF2BC95A7E0F342D2C671315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880096, "uuid": "7002d619-e94a-47e0-9fe4-8f4531b49cc9", "value": "25c5b39875f5a4f6c67ff13501770773", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880096, "uuid": "39ddbbd6-15da-4c65-8162-b7fe37290b9e", "value": "3072:kQw+GP1GJf250I6wZccwzixmmDEqhznSD39pD5EaRIww4F91wtqxdX:+QZ4o2jdBK9p1ZF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880096, "uuid": "9891bef0-eeab-470d-a2fd-48e3c8c37e0b", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880096, "uuid": "6a460e91-8dd1-4482-81b0-6642f7f5ac90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880096, "uuid": "06201b83-fdf7-472b-b7c8-461b6137d135", "value": "ed5a5f921f1475e715abf99fdb5927a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505f93ad-9e00-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702943468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943468, "uuid": "801c712d-e9e0-4e94-84ab-acd49654e051", "comment": "Malware payload (Socks5Systemz)", "value": "ebf7a4cb5da695f3f377b913c17467e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943468, "uuid": "e7d54302-38b9-4435-87f6-c6141136d97c", "comment": "Malware payload (Socks5Systemz)", "value": "a58ffa444d6514a0b092f8fa84c0a15853f5141c86abcbcf0c5b4dcc312aaf3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943468, "uuid": "142f7f64-c05d-429d-b4d4-ba82b8293563", "comment": "Malware payload (Socks5Systemz)", "value": "bb001e8f911a94e4180ceba2dc81ca60c20fb8d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943468, "uuid": "71add44b-8dcb-4f83-ad94-1a49bf127772", "comment": "Malware payload (Socks5Systemz)", "value": "3d06f5a1c32ba54741e2dd19ef730184a0d240ad391aca02b0f0406d06661ffcc07f63ec3f6652ab40a09456c9b1608c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943468, "uuid": "33b976b3-b811-4be2-b8a1-b12cc16d79a2", "value": "T16D652303A7D944A2D8F13771A8FA169307357CE72C74C7AB7B15E9A94C32294297233E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943468, "uuid": "42652c29-f3d8-47d1-b8b1-35fb0322718d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943468, "uuid": "8c5ff0c9-c3f4-4197-99ec-df53370d72fd", "value": "24576:qyM9LVCaHQVdLobROgyy5NcZklJvGjgH8Solf2rZQnfdTT4w3Hzn4rjb5obO7ac:xWhCaHQvG5NXTGg8SSfBxp3HLe5o67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702943468, "uuid": "8d636f2e-96e9-4f9f-a222-32d93895278b", "value": 1513472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702943468, "uuid": "401844d7-c5b9-4cb6-a47a-dc7a647861b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943468, "uuid": "5cff5a81-79ef-40ed-be95-93f5d287ce23", "value": "wextract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ff0adc-9d6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702880200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880200, "uuid": "8fef9875-0f61-463c-b3c0-17c996818023", "comment": "Malware payload (RemcosRAT)", "value": "ea0ec6a991e9088a9d1a59dc0a88aebb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880200, "uuid": "f11db319-3025-4602-8804-b1a3f85b3415", "comment": "Malware payload (RemcosRAT)", "value": "a5fe6c5f1e7e5fe67f8d142239c7cccb0cccc36716f3ccce480d6bd2f96c0c48", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880200, "uuid": "2fc6f97e-3195-4434-b7e8-8d32cccd0c21", "comment": "Malware payload (RemcosRAT)", "value": "21235976eaa20ba5d0341e7a1c75ad63ea4f5619", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880200, "uuid": "7d0409c0-fc50-4a7d-a5bd-25f7b6a5babb", "comment": "Malware payload (RemcosRAT)", "value": "ecaca63cbc5d9c23df91c862797bf3e9c50fe30335fa9b5bae9b32eebf0df960e378ac3c4b149828483065ff35dedb24", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880200, "uuid": "f81a5d7a-02ea-44cc-af17-ee6e45d21467", "value": "T114840100774CAA8EE597A6FD2ABA718F900CBD7236D561C77A90B70E0431FFB591B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880200, "uuid": "bae443bd-f7e0-4ae9-a133-7121fa423a6a", "value": "6144:mSgun9Q4YlLSmmeHZMhD6wM3XALQuEyZNYkCTbJlS+Efa6Be6An6kEw9Xf8Eka+8:mS59WQmmme6v3QLQuEyLYNXEfa6Ba6kK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880200, "uuid": "9dac9f6e-5290-44a1-8763-c859a0cec8b6", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880200, "uuid": "b8c73694-e9be-4928-be92-cf0b55e04a62", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880200, "uuid": "22637845-9540-470c-b11d-b3fe710b75c0", "value": "SHIPPING DOCUMENT.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426b90f4-9d6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702880738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880738, "uuid": "3c54743d-81e3-4996-a2b5-3289ce2c60ff", "comment": "Malware payload (Formbook)", "value": "8ce3eabda5536cb8e78490f6708336ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880738, "uuid": "dd921116-c762-4076-9171-fd3cf54ca460", "comment": "Malware payload (Formbook)", "value": "a67ac35317e5e1e57ec1950202c4f547a2cc01816d00ba32176653b2ab6a2669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880738, "uuid": "20814606-671f-45e1-83bd-f02150db5dca", "comment": "Malware payload (Formbook)", "value": "46ecfe9de0950db8e8818c854ac56fb0ffd69102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880738, "uuid": "c6df4552-913c-4e02-bd3e-c429750cdc9a", "comment": "Malware payload (Formbook)", "value": "975ddadd74a44f54ef4526c1604c4d0374132ec5634babbe330e29379ebf9e9d8f70895ffe304768277cdbb451e4bc2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880738, "uuid": "57cdba0f-5a09-432c-8a56-d22cfadcf22e", "value": "T16D7423387EE59F27C6F442FC0432695C87BB3187C5A1EADA2C86598727FA7640036E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880738, "uuid": "6259aada-2006-445d-a91d-26eac65f279b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880738, "uuid": "0d4cdee1-2e10-4748-abf7-9f14e81bcaa7", "value": "6144:Q2Hb6O84eMtxP+c8P9FoA9/nNqb4bfCTl6qtGgTaiLDyJwciXp8GmQnuQ:QaL8IxP+nP9Fo0Nhbf1RaayOfO8Gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880738, "uuid": "912b907c-8de0-4c50-a7d1-a6af94cb9f6e", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880738, "uuid": "9965849b-afc3-45da-9073-63ba54f3776e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880738, "uuid": "174454f1-a947-42e3-9622-ed11fa669ae3", "value": "470000 TL Bankasi_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398ae6a7-9d8a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1702892749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702892749, "uuid": "dd0ada15-8c2b-4993-af61-857ff92b94bc", "comment": "Malware payload (AsyncRAT)", "value": "c161eac186f0923095e250aa7b0896f1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702892749, "uuid": "1598d87e-8997-49d9-a530-9409d68271ec", "comment": "Malware payload (AsyncRAT)", "value": "a6b1b7d8e053732c2666794d0cde08b09a30470e004a5de78f4ee70d471fbde1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702892749, "uuid": "b12334cd-46e9-4dbd-858d-b76e5ded720e", "comment": "Malware payload (AsyncRAT)", "value": "b11bd8e15ba5c4c80f3ab9320a0bafe4a1ade685", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702892749, "uuid": "601ad7d2-3d0c-47c3-b004-fb7166e84aa7", "comment": "Malware payload (AsyncRAT)", "value": "59c53ddc0f55d2de991bf997e0a343c03ace3ed55dcbeea309b8e28137f400ec48dd399e42b0e71c238950c46a710a2b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702892749, "uuid": "7e6a8c2c-a711-451b-95ce-d102e6e2566a", "value": "T104854B8BBC9515B6C0AA92378966A1917B31BC481F3123C73E90B7BC2F76BD09E35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702892749, "uuid": "3657e3cf-639c-43fe-b791-d466fdf11969", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702892749, "uuid": "29275686-98e7-48cb-8a66-e441aba81ff4", "value": "24576:poipzrNGtW2m1d7tkZjOvzARoUS8JGG42K:ZfNGQ2akZj2Ehn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702892749, "uuid": "d8aa4460-f456-4d69-a20c-afa03358a88a", "value": 1736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702892749, "uuid": "d86c2f3c-e8e3-4ad7-899b-42d0d7c099b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702892749, "uuid": "e310e859-02d9-4554-8255-1425fc50b27f", "value": "c161eac186f0923095e250aa7b0896f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93814d5c-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702889464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889464, "uuid": "35150b79-696f-49a6-9b0a-6460df996bd8", "comment": "Malware payload (RemcosRAT)", "value": "2ba2baa0a9f2917074f70a50f10ddee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889464, "uuid": "03dbecf2-6a94-4b5d-9d3d-43a45329929b", "comment": "Malware payload (RemcosRAT)", "value": "a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889464, "uuid": "381f613f-3f8b-461b-9c48-76a8fb4f0856", "comment": "Malware payload (RemcosRAT)", "value": "5e32eb53c8ff82ef5dfe9fa41158af2c131998e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889464, "uuid": "163918a4-5a12-4cbf-a49f-43a38a78b7ef", "comment": "Malware payload (RemcosRAT)", "value": "39f5c476147e47114ec37c2145fa039e7853d7bd2506abca2b855b990616e12baf4df2d9274b6d26905ed273c1b5ceb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889464, "uuid": "967ddfe4-4bc1-44a5-a1fa-5d3257bc64d9", "value": "T1F7B49E01BAD1C072D57514300D3AF776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889464, "uuid": "8bcd6968-af54-40f5-b313-fa81fe021fc7", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889464, "uuid": "88bba732-ec81-4326-a60d-169893e9231a", "value": "6144:yXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cN35Gv:yX7tPMK8ctGe4Dzl4h2QnuPs/ZsScv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889464, "uuid": "3a502d9d-d046-4be6-8730-043804b44eb3", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889464, "uuid": "2a2f6ef0-6da5-4c48-8ea9-d33bad66468f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889464, "uuid": "3153400a-ab33-4664-bf67-1375a151de41", "value": "a739f75be90696d11429b7b5003af6ae0318009bdabdecdcd49b18d80c60d946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73abd219-9d8e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702894564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702894564, "uuid": "1cf453a5-cbd2-43a2-9924-7d1d434d607e", "comment": "Malware payload", "value": "8539418ae015b4d935417ced1a676872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702894564, "uuid": "85b17b03-e4c6-4811-a0dc-e6267a3837e3", "comment": "Malware payload", "value": "a763f8bd67e0f6ae5ad3674846bb2c4769d1751d8fc9f5cee7a1625038d4e1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702894564, "uuid": "ee642776-a6d7-494b-ab30-c22b9137de76", "comment": "Malware payload", "value": "a61c77f7e07fd3c53082ec858923d43698bd44b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702894564, "uuid": "9f1e5188-b540-4779-80e9-cb408aca668c", "comment": "Malware payload", "value": "2815c62528ebbeccc6d2f0512b15c285bb51a0e3d45e259b6ed4dc0a36560fef1b59bfaeb94e700ddb8a33459ddfa156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702894564, "uuid": "d1598623-3562-43ef-8658-0d37b850832b", "value": "T13044763C49BE223B56B5C685CBEC8827F05CA46F3151AD7594DB83A643C7E4278E322D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702894564, "uuid": "12033468-b3f9-4148-b483-2f8402c20aba", "value": "3072:I5+u5oiJsgIQXsJnTQZUDsiSeCzyir/YrSrSaLUWtueJvO0ADtAY3c5:1EZ/DhvCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702894564, "uuid": "8c62deda-ba72-4513-8e32-047f09dadf49", "value": 263804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702894564, "uuid": "5b76f1be-86a3-4906-a577-e0bf4dd5deca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702894564, "uuid": "d242f5f1-74d3-4534-bdbe-c0d22ac832da", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.14945.29224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44b6d89-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873251, "uuid": "118e75c5-4d03-433e-9c50-16735d536216", "comment": "Malware payload (Socks5Systemz)", "value": "8080f53e735ad9b954e4c3909ca6551b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873251, "uuid": "9e5fdfb2-ef63-4298-be4f-45dca508ffd5", "comment": "Malware payload (Socks5Systemz)", "value": "a788a04bbccf52d38945044ac5aaf8f001207f186001bf3f6944689c8ac6c165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873251, "uuid": "e26613ee-db6b-45cb-a858-746061067d9b", "comment": "Malware payload (Socks5Systemz)", "value": "d079eb27841c69a5133e7394ecfb5ef20916bc88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873251, "uuid": "6c8a319b-3606-478c-95e6-b40991c0be80", "comment": "Malware payload (Socks5Systemz)", "value": "9b7cc24b70a2722dfd45424456b82647b5d42924d6518a3846ec0e3f62705bc85bf140a9ba947cc156884742a2459b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873251, "uuid": "e0890671-834f-48e9-9b9b-bd82bb3efb87", "value": "T1476633D2D42A96B6D351D0B0BD666145DA29A66F11A4F21DB2FCDE073F1702E0203BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873251, "uuid": "3d79d6e3-8ff6-4cc6-be37-2a5cdb1a9a6b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873251, "uuid": "971e86b6-313a-45ed-8fc5-5cd1cab804eb", "value": "196608:iKjyHX7FYU5W8Fre+Ft8yO5C3Pfr+YL8+v9w7F:iKjyHrFYkRFre+F7dnr+YLNv9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873251, "uuid": "60214ffa-2d9e-45f4-9afa-dcabb6f92adc", "value": 6800960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873251, "uuid": "21463943-778f-4e69-b123-d9df8332b2b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873251, "uuid": "3e51739e-c846-4302-a40e-d97262c185d3", "value": "SecuriteInfo.com.FileRepMalware.17564.26341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afe2855-9d94-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702897127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702897127, "uuid": "3142ce37-8eba-43e3-bca7-dcb84fbd94f3", "comment": "Malware payload (Formbook)", "value": "17b74220db47633b61742559ba5b5396", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702897127, "uuid": "5f5071f1-2505-43ca-894e-c3001798257a", "comment": "Malware payload (Formbook)", "value": "a822221c7b4e21680d9df8ac35430d7d426611604fa7dec4bbcb8e8e7fa82622", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702897127, "uuid": "0023f67f-367f-4c6e-8381-0f69f2d3916b", "comment": "Malware payload (Formbook)", "value": "4dde089d51bf6214cd53158ec4234eb016d4cf6d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702897127, "uuid": "9142e2cb-36bd-429b-b132-137157b38cf5", "comment": "Malware payload (Formbook)", "value": "310002bbe3e493f8596fdaf1237f3d9a461a22b3a00e7c59fb1cced40ce4829fac4c2d18938e2fb71b2b2179d72a9756", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702897127, "uuid": "e0d99a70-fb62-4f48-9ef4-9f233d4461d6", "value": "T186E4331D763DC6F336B5291A02F78FB28F72D7700C8E0A1165B950668C6229BCD9A74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702897127, "uuid": "b4f1d42d-b715-4e44-b1f1-020c2755fde5", "value": "12288:setOUe3HCDYAhdZt6pKdPIaSgHAfU8JL4XlSm+rDJ96lZw1XhHH9rGoE72:setDaCY43tfFIDgHAfwlSlDJ9xhHH9Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702897127, "uuid": "237ced14-b92e-420d-a202-3ef065923203", "value": 694951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702897127, "uuid": "31f9d669-4ea4-4416-b3db-2656b3e5b2d2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702897127, "uuid": "c64dc5a0-6392-4625-ac55-3d6e61e8cbf3", "value": "SLIP-full amount-50006654455339877322346689377782.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0445c381-9df9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702940333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940333, "uuid": "aaee6b6e-7673-4e30-8b81-e2db3013d5a0", "comment": "Malware payload (Mirai)", "value": "cebe09a51fbf647ef144e3fb4ab36eea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940333, "uuid": "9657db7a-d95f-491f-961d-d60223225b8b", "comment": "Malware payload (Mirai)", "value": "a9069aebc77eed84843e05017c86bde6f5dc5dae422317d8df171cee38df20d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940333, "uuid": "669b5b5c-b2f1-41bb-a88e-fc5aa20c2c87", "comment": "Malware payload (Mirai)", "value": "2e53756aeead0da1adac2b69bee71d618ad3ce31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940333, "uuid": "d24a0992-aa13-4b6b-838d-faf2b31c3cda", "comment": "Malware payload (Mirai)", "value": "dc38ab32d4b5367c855a2ca3a4cd6cf612653e2a95b6056dec14d77d1e327bb4f9138a2fef6fed661a31ffaf0e3a992b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940333, "uuid": "a41a3752-fb65-4d28-8410-365027211ffa", "value": "T126C2D0A07726FE31C420AC3DE52B4C8A3A51167C90FE393764258D359FC165B63F84E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940333, "uuid": "f02b3b91-0045-430b-b573-70d41696f5c1", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwriF9q3UELuP:NKy4qfqoeJdXWgZLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940333, "uuid": "edb8d361-c4a2-440e-9fad-617ec2d43af1", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940333, "uuid": "1f4170cf-cdb0-46b5-9db8-9b67d82c246c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940333, "uuid": "77fb2475-d052-4370-bd2a-ef0b1b67c257", "value": "cebe09a51fbf647ef144e3fb4ab36eea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d5772e-9dc2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1702917012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702917012, "uuid": "420122df-d47d-4e66-b2cc-335900fbd31e", "comment": "Malware payload (Stealc)", "value": "67cb34c40a86ff7074c3f2fc9cfd1340", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702917012, "uuid": "879c4517-e29d-4035-810e-418c01b65c08", "comment": "Malware payload (Stealc)", "value": "a9a03cdf425639c8598e0bb4acab4689a2efb8798dba64ca73a887db877c897a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702917012, "uuid": "ad70b908-aeca-4ba9-865a-f48905b403fa", "comment": "Malware payload (Stealc)", "value": "e3655d80389423cd9271944086ebc397cf1bb049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702917012, "uuid": "947210ee-d92b-42db-af08-0c17e3d8eb47", "comment": "Malware payload (Stealc)", "value": "8b2a08f8f9afb5c492b7f29ce058e7b5f314f058b7c37802aff8e87e45151c242b5dd1d37a63c9ab24b01bc489c362eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702917012, "uuid": "0f192c87-7635-4444-87f0-260d4d1d5c3f", "value": "T18C067D027B95DE61F90A113BD6DE131443B5E4202FA1EF5B353D723C87263D2A887AB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702917012, "uuid": "c0034fa4-a030-432a-9b3d-c501de9294a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702917012, "uuid": "7218b1d0-2826-4734-bbeb-77a11900c166", "value": "49152:M24KHZbsm4eDWM6qO3D0vDmnjLXDL6f0VuM4GGGMOh+x89Ij:PHHZbsm4e5IKOLXDCWuM4BGMi+xTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702917012, "uuid": "7d322ac6-d955-427e-b5ca-b5162dd6641c", "value": 3904232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702917012, "uuid": "bf76db0b-df2a-4e37-ae3e-50517ac7db20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702917012, "uuid": "b56f78d2-b606-434e-9bb7-001467ed4812", "value": "67CB34C40A86FF7074C3F2FC9CFD1340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64faee0-9d93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702896797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896797, "uuid": "34269dd2-9987-4197-b302-2e142ae1d16d", "comment": "Malware payload (AgentTesla)", "value": "bfbfbe3d395b944474c79432ef47b433", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896797, "uuid": "62c0097b-2f9e-4d33-b782-63a86e9a15b4", "comment": "Malware payload (AgentTesla)", "value": "abd4a743c4aa8fb625f1af14edc51606fc1b8e1a15396d9db706c1fd3cf41395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896797, "uuid": "b9c2dde7-6528-4c02-a820-582dd667d7ca", "comment": "Malware payload (AgentTesla)", "value": "51780ce1ca221f893441330aef6ed8ba2d9d7fc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896797, "uuid": "ab6c01e6-4826-4161-8b52-88c4677fcf5b", "comment": "Malware payload (AgentTesla)", "value": "ef63a24afc31d49bf788e2d55bc9c442f9c4295757d395ff5d08fc5b975a61bf56de32cbda38fa7a4fc01dd223028f4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896797, "uuid": "f9ad09ff-6019-48cf-8a84-09f003108bfe", "value": "T17B05C23C49BE223BD6B5C6B5CBEC8827F05CA46F3150AD6594DBC36613C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896797, "uuid": "ae7aa29d-0baf-496f-8dc3-830fe5d47ab8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896797, "uuid": "b5b0972c-9268-4951-a894-75d29724f16b", "value": "12288:KCwEx2iNXPTPxgQDuxG5c5Xur0HVq2FsSw/xIDX5VQvlZ1crttGQiOkUZv8Ta:nwk1JTPxgZOEV9Fg/iTLGKttGc3Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702896797, "uuid": "a4763f68-8b28-4eea-ada0-37418712a388", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702896797, "uuid": "6ca71f74-d498-41de-a558-9ec0076eb0b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896797, "uuid": "70cee237-e28d-4271-ad16-d81d2f1fa4bb", "value": "\u3010PI202211385\u3011in US dollars.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a087a0d5-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889485, "uuid": "e645aea6-33bb-46ed-95ed-d50ac820abe2", "comment": "Malware payload (AgentTesla)", "value": "7e88243109162631ba36fa65329cb94c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889485, "uuid": "4f7f6785-2e64-4f00-8784-0096d8e77da5", "comment": "Malware payload (AgentTesla)", "value": "acd371f4c6a6939b850dfc4adb7207b2e034ee31ede92d0bd176d8d74f0de971", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889485, "uuid": "c6a79c95-8e3a-473b-b5dc-4bd781d86f2e", "comment": "Malware payload (AgentTesla)", "value": "35242e84b033358526bbbad7992355ba8620d36e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889485, "uuid": "db39f36c-7ea0-4bbb-8d4d-444601dcff1d", "comment": "Malware payload (AgentTesla)", "value": "17a47c9542e2f53067cb63706eee467cfcf0788a2767f99aaf4e610fca79d89ca1217fe51b492b2c9c4e949bfc16da56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889485, "uuid": "33236da9-41e3-4139-afae-3896f101ff76", "value": "T1DF159D2B6B1E8D6DDB933731E7675A000B20ED615117E70F62C9326D37337AB3A99602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889485, "uuid": "35d932d1-71a2-4345-beb8-427de273ccaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889485, "uuid": "d023f616-916e-4140-836c-2636486a5db4", "value": "24576:7WxCT9k5UY8h/H887qbDTMiHuPHw3sGGPdpgev:gCTDGuKkBPa3MT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889485, "uuid": "53d72804-8d02-41cf-9313-fb173cc3c88b", "value": 918392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889485, "uuid": "02dba591-bce9-4952-84c5-d913b1ebf467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889485, "uuid": "cb35bdf7-533c-4844-91ed-2bd08d93972f", "value": "IMG_2986331200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ef4f84-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1702889411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889411, "uuid": "7bb3d72d-5fd4-4d89-b3a5-d6362f2f4534", "comment": "Malware payload (DCRat)", "value": "b82d2ed605e69199736839d41d70929b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889411, "uuid": "2e7bbf1e-9c0c-467c-af0f-2f02fedcfdf8", "comment": "Malware payload (DCRat)", "value": "ad8d0a3ab8f11580116ce343448a27a1edd276e1abad7fe4bf840d76be1e6c8e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889411, "uuid": "01489be8-882a-46aa-8d94-eced7c1335f4", "comment": "Malware payload (DCRat)", "value": "1922cc78d57ce3e6dd813f66957cac5ae83669f3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889411, "uuid": "e665b905-e24e-4c4c-9e79-4ff3cf6f0846", "comment": "Malware payload (DCRat)", "value": "ff9e6aa714ab33b6ed2e94ca51c760fe9ce4cb3077cf4eaa758993e43a2a0d88bdaf4392e43d2946343dda424946f9a4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889411, "uuid": "406f5cf0-0329-41a5-9332-fb28432edf8d", "value": "T1C505D5027E46CA11F4091233D2EF854847B1995166E6F32B7DBE376E95223A73C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889411, "uuid": "76baca13-7cfc-4226-ad9b-f6394ccfa009", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889411, "uuid": "9f5e1b9d-4750-416c-9db1-145cb8d05660", "value": "12288:pb934eNAA2+CK3W0SxA0Sa+6Dmtp8r9DknKTX4woG+c:N93HNAAGK3NSO0Sn6Kv8BZloZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889411, "uuid": "bb5bf7ef-6a10-4d93-aa0d-3251f59b1b29", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889411, "uuid": "c56cc145-c160-4616-809e-fc2d87936579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889411, "uuid": "6476f65c-f2f0-4f41-985e-711f946f24c3", "value": "b82d2ed605e69199736839d41d70929b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55cbd1e-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702880125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880125, "uuid": "6375212c-8db2-4599-a1a5-a5a8f70c7626", "comment": "Malware payload (Smoke Loader)", "value": "e0b145b98a86b3f0c0c8915f9e3fb088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880125, "uuid": "a0cc5aea-3b52-4992-9bbc-2e99e9875385", "comment": "Malware payload (Smoke Loader)", "value": "ae4665e8da5e0c1475bd0d19251ad1cc408ad2e53f9cf46a1d24a67b337d3dc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880125, "uuid": "9ce10386-62fa-4a26-9a43-cfa4ffd86d03", "comment": "Malware payload (Smoke Loader)", "value": "6faf23a8a69aba3c4f845321b8ffe3bafb5b71f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880125, "uuid": "bde261ba-da37-4699-9ac0-4301ec7326f8", "comment": "Malware payload (Smoke Loader)", "value": "1dd4ad92e54d745c4a504640d31d3bbcf6547da9d645afedf1028805197428b58eeef20ee4a1649268de3f56afac9155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880125, "uuid": "ffdef1f6-1a51-4f6f-8aad-27d7eb6fb6d1", "value": "T13824BF0273D598B1F2135A319E25C6E56B2BFCA48F616ADF3784692F0E791D2C271303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880125, "uuid": "4c239a4a-337f-4fee-b3dc-13229b2d0772", "value": "45c813e04f030d9746e6fe86deeebeae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880125, "uuid": "aee6a688-4d1d-4478-88b2-3cce0c8ed42e", "value": "3072:lL2fJjAfA69+o9QiAb40o3ju+Oy71H2BSI58:URe9L9Q9u3jujyJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880125, "uuid": "d774eb02-3a3f-40fa-a582-67b9f993d99c", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880125, "uuid": "47d34853-02c6-4685-a978-232309b61a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880125, "uuid": "ba76de02-e56b-4330-8b4c-dcdf77680bb9", "value": "e0b145b98a86b3f0c0c8915f9e3fb088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d5095f-9d6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1702880227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880227, "uuid": "0ff93052-58f6-4202-af35-f57b0ff05fc9", "comment": "Malware payload (XWorm)", "value": "4ba0816d674e3a239fd6e12e45435250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880227, "uuid": "eaff39eb-3511-4e2a-bb13-301e53d8a211", "comment": "Malware payload (XWorm)", "value": "afb0a01f30aa1239f85e2eb465e374c49a274383caa52d3c8dd46c67b17be519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880227, "uuid": "fb5ece08-8658-4c17-96b7-0199c27160d2", "comment": "Malware payload (XWorm)", "value": "3a9128e54fc893a4b449c666012826fd20b6fb45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880227, "uuid": "bc45c346-5d5d-4ada-8002-8d5a6f75545d", "comment": "Malware payload (XWorm)", "value": "293d6787516b4076a0e7abf902f32786dbd57ecbe9f7d3c99fc97a67799316cfcb89566e0c34cfad7cc9a6674ec00578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880227, "uuid": "e5d505ce-5182-4fe7-acc0-1cc3db41c3a2", "value": "T136C5D39A417AD5DCB962DDDC3F2863A0B6D26D3D44E78F93069CCC3A80153BFD694882", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880227, "uuid": "c82a396a-cc39-4380-8ca2-b0228a6f2d8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880227, "uuid": "ecb1d5df-47c1-4fd2-952d-471ba0db22a7", "value": "6144:tVc8BFglvy5vr+w5j6jcYvHKNAe5vTWv+cVtF2GfqwjpyyDSs3GcyBb40nMyhPej:tV5BWSg1SJ0JLyXCx0rPGxFZ2ZIM1db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880227, "uuid": "f206234c-80b0-409f-9dc8-bbdded5160a3", "value": 2587136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880227, "uuid": "b5fde34e-904f-42e1-a929-e447e95c1b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880227, "uuid": "7f3c0b68-1639-43dd-b0af-c65566d7f065", "value": "4ba0816d674e3a239fd6e12e45435250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa17b0b-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702925642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925642, "uuid": "9a44a982-0c09-449a-a977-ed2a865009b9", "comment": "Malware payload (AgentTesla)", "value": "9628c58d0b5718705294311ff1afb295", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925642, "uuid": "0e53ab39-5177-4197-9ffb-6998eb69902e", "comment": "Malware payload (AgentTesla)", "value": "b091bf4326241b1053f88a1a47618fee3f87ccdce873a9bb79e653670b7e4948", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925642, "uuid": "518cd119-f5c9-4ce1-9037-a46d56066d11", "comment": "Malware payload (AgentTesla)", "value": "04283973b9536f09e8ff4ebde9d11af333f94a94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925642, "uuid": "b1cface7-c538-4b7f-8371-401d7142d387", "comment": "Malware payload (AgentTesla)", "value": "ececdcaba00f2e5fba06c2ec4983914c05d71ab0fabd2058fa0d447464eeb40d04114eb7d707021e4de2542637a085a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925642, "uuid": "f84200d3-f111-4cbd-bd3e-056e00190d1b", "value": "T1E415BE88F54061AECC1ADB719A35CC3092227DBA5A35D11E24DF3D6B7BBF2D399140A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925642, "uuid": "2f7b0622-5cf9-4458-acca-30b21d402813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925642, "uuid": "cc8f9f05-84e4-4925-94d3-f8b766c0eaa4", "value": "24576:2BJmV16g7on6obapfzAm9Cny2Cz+mYRLW1q:2BJmVM96o8zbmyh+mYRLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925642, "uuid": "7eb82ec8-df5c-4d31-aa37-ec2d4d34bc2f", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925642, "uuid": "0c441e80-2952-413a-a38e-a64c1efc6eaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925642, "uuid": "e899f862-0f59-4d31-b489-7b9047c7f0b6", "value": "PAYMENT TTSWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbe2e62-9d70-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1702881533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881533, "uuid": "55a6c384-2262-4d9a-b3e9-bf115a021b05", "comment": "Malware payload (Arechclient2)", "value": "7759bfefbe1fabc4b15e01f42dde615e", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881533, "uuid": "978f402b-129f-4e99-b3c1-42d06204f8a7", "comment": "Malware payload (Arechclient2)", "value": "b197825e4e9e2777e58f0162d90a18d1e98c294df5b3b29f5bc622edec1526e6", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881533, "uuid": "626626a3-7d4e-47c6-8972-c46369703705", "comment": "Malware payload (Arechclient2)", "value": "0caa6ade52a9c1bfd194b00465f183fab365f27e", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881533, "uuid": "c0570278-c95a-410a-8e16-3d86f5dd9e97", "comment": "Malware payload (Arechclient2)", "value": "bf4ed742e44d01c9cdc056845ecd18e9c742598f4d96d56fcc9e653b321ff13b879edf39455193e796fb8a48e6aa4cf8", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881533, "uuid": "ff4d29e0-4e35-4d97-a463-dca0d513d46b", "value": "T114E533E6576D8370F51E5DB363E0CA9DB3A8E30F4E6D1797A807CB360B052450AA58F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881533, "uuid": "c1aea7c5-bb65-456e-8dcf-723c30c7e32c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881533, "uuid": "ee41beda-a7a6-4dd5-8107-12e3efb3f6ab", "value": "49152:Lu0BplM5tL6htjbtje6zBMpAMWb0ci9z+ptR1tHw8A1pnszV60LAFJ14/DwKBxqP:LHvjAe0t94R1t414JAO/+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702881533, "uuid": "4db3b667-978c-4341-bca6-c4f2debce2f3", "value": 3315848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702881533, "uuid": "d9b8134f-a2e1-4fdb-afc6-4d9b604a7c45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881533, "uuid": "ca2657a3-3a91-4eb3-9533-c60453c8dc2a", "value": "Slackens.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce744aa3-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873242, "uuid": "7f554e6c-c52f-40f2-a843-c8fa08b19341", "comment": "Malware payload (Socks5Systemz)", "value": "7cf4b2607698c52918f8ce4ac4bfa22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873242, "uuid": "78a3eaca-8317-4953-8534-954022aa565e", "comment": "Malware payload (Socks5Systemz)", "value": "b1acde71bca75579ea504fa6a7e00a7c1f38da713bb3b95ce91e53d38c46739f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873242, "uuid": "3125fa63-54d9-4c4f-9cea-a612583895fa", "comment": "Malware payload (Socks5Systemz)", "value": "080d7ea4648ba64da1988d715c34acb2a21192aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873242, "uuid": "597b5081-0477-4c2b-a9dc-f452e24f924d", "comment": "Malware payload (Socks5Systemz)", "value": "d6abc44e503f7821559d261d39ea63f5c4bfc79b0c30c72da745c5177d659ef506b473ec42d0136d97961a5aafd624c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873242, "uuid": "77b4fe60-5f55-4f1f-a23f-f844fe22c9a1", "value": "T19E6633D7A3290439E4A241B5D231D14B8633EEA61D63A90D9A9C0C59FFBB01ED5B7FC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873242, "uuid": "a5d9ba6b-5195-4bbd-be3a-6c1038a364db", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873242, "uuid": "45cb080e-64e4-4b5e-9321-a9348b4d6752", "value": "98304:/uBqzPyxslK+oJnlVGZoWYrIBJDmMis4PY3GQHQdLJ5XbWw5jjRGqULvrEwmemlF:GyymlKBbUo/r0wKHQdJwwNRLGzmlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873242, "uuid": "86ce8e88-3c89-4c93-8a63-99c86b3c8c0c", "value": 6770166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873242, "uuid": "2aa51ca5-ef00-466e-af1a-2433ccb10e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873242, "uuid": "b5765eee-0454-4b8e-831a-ac04059f30f9", "value": "SecuriteInfo.com.Trojan.Siggen22.40922.29866.19302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c240afd7-9dc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702920036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920036, "uuid": "c5f6120b-1912-40c3-94b2-6704d37d01f5", "comment": "Malware payload", "value": "4d85d4d48734b6a26d601ef62d1527ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920036, "uuid": "624fa784-865b-4c19-9e19-092e05255ff3", "comment": "Malware payload", "value": "b2617dccd3165177226a7c23effd6dd4e51e0c06c7ad57818ef1461ecaaa13e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920036, "uuid": "1dfc4c49-1c44-4a8b-8134-39d9efcc6b4c", "comment": "Malware payload", "value": "c3e5b6b551649693d7def507c007149fa26a5da6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920036, "uuid": "1c379ee6-93e4-4685-9a67-26ebaa5258c3", "comment": "Malware payload", "value": "436727b4fa1bf58132d8fc5bd14a7632e5ea4ebd730b7dad0a304640b197a1d32358d5dc6b73af405ecc0227d95dd78b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920036, "uuid": "2dc9bcc8-2c06-4ba7-ace0-4e726bfcf4d5", "value": "T12505C23C48BE2237D6B5C6B5CBEC8827F01CA46F3151AD6594DBC3A653C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920036, "uuid": "6afe8785-4ac7-45c6-817b-7cee866d8c24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920036, "uuid": "5090e967-b431-4633-9c26-64a21e914dbd", "value": "12288:kQwEx2iNS+uCiLdS5/uhJf285cO+KrNDORFlNw3IyMAyMBsfiW:Twk1V+oyN5cMkRb+Eusf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920036, "uuid": "13e62193-7cff-446c-acbe-4fcba7c73d07", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920036, "uuid": "b4dffe45-247b-4d09-954f-290b85bb2bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920036, "uuid": "865d470f-83c8-4cff-98c8-463715b1d7e6", "value": "PO46723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a2a7e0-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702925577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925577, "uuid": "373354d6-44de-4686-a915-9c05dfee3edf", "comment": "Malware payload (RemcosRAT)", "value": "49da121e2690d66a85d5b2b4eb9a07d9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925577, "uuid": "91620b9f-fb7f-483c-8124-703862d751af", "comment": "Malware payload (RemcosRAT)", "value": "b434a92f906fcd81718268f7465ea9a5ea3c6fdc5662bd8347fc52dd7984b3f6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925577, "uuid": "b3dacf24-d26e-401c-af31-317bcab06263", "comment": "Malware payload (RemcosRAT)", "value": "aa63e9a462c19efbb1f83b775e6fbc35bf997255", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925577, "uuid": "3839b3fe-2e8c-4743-ba93-e6c3e9ed4f81", "comment": "Malware payload (RemcosRAT)", "value": "b362766784ca17be90068649808a2a496e5f36b9c61a9f073ef7e0a0a1d8d4c5e7100f9ff20872a2774201c1b76cf281", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925577, "uuid": "344452b3-1f4a-4b97-9db9-a916a6e7de16", "value": "T16F8401007248C89DE2975BF969B7B19E500CBC733BC691CB6A88F70F8435F6B461B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925577, "uuid": "24418739-8d16-42db-87df-1f942b559f14", "value": "6144:ASgun2Q4YlLSmmeHZMhD6wM3XALQuEdxp7qXHdCmoeLk4jFUBsCBsuN/xdkpre9X:AS52WQmmme6v3QLQuEdxRq9Vp/RUBseR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925577, "uuid": "dfda6f15-a110-46a3-a32a-b4e83ae8f0f0", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925577, "uuid": "4b56568d-5cf9-4441-8e69-41c9b335f620", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925577, "uuid": "b1b3ac0d-3dc5-426c-a495-2399ad407650", "value": "PURCHASE ORDER1 & 2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe489be-9d75-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702883921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702883921, "uuid": "9c198c1a-8954-40b4-9eb0-e21d3df6dd1e", "comment": "Malware payload (RemcosRAT)", "value": "9c0944dc238631d0847d2e9137e28dd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702883921, "uuid": "66ff9b1c-9fb5-4539-a467-451154f3c332", "comment": "Malware payload (RemcosRAT)", "value": "b447cfa88f6896a02d8aee885d8803b2cb0c61f0a5934d4017f372bb8bc3a2ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702883921, "uuid": "1324a916-96ce-4a34-8221-ad698a0e42ee", "comment": "Malware payload (RemcosRAT)", "value": "0bc7bc23ee378cbfd909251a99b7c0492ddbbb0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702883921, "uuid": "ebba32b8-c1ef-4aa4-bc33-25451a08bf9e", "comment": "Malware payload (RemcosRAT)", "value": "ec3eddc243909a1b8163856d865e4fe14d8019af90901ce5dbdf41c0b81bed7d6ea2503a86a342c2be215ba3162f0f99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702883921, "uuid": "67aa52b3-8cb9-4284-87e7-24226452286e", "value": "T13E74231712B05777E0D741B22D3A15AF9FF946262D180B47AB204FBBB9782C4D92272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702883921, "uuid": "09934118-908c-4b86-932f-44002f6adc93", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702883921, "uuid": "89c6137c-3b7e-47e5-afea-373db38a5e3f", "value": "6144:bhjmbz7D+yqLQeUCiKJZ1PrmG6E/nc3PrC2grR7DnK3qaW5Z1uX0rLvg:cDpxCiKrFiNE/ne2xljK3qDhA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702883921, "uuid": "111cc193-2ac3-4a89-afb9-1a7e02fbf7c2", "value": 363107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702883921, "uuid": "50eac5c6-1467-4385-9671-a10781a95809", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702883921, "uuid": "7a13a501-bacc-4827-9683-2afac20757ac", "value": "9c0944dc238631d0847d2e9137e28dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a68c34-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873245, "uuid": "ddf2efbf-4916-4f70-8173-46a64c0523ba", "comment": "Malware payload (Socks5Systemz)", "value": "1303b27cf4a52fc3093633c984705a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873245, "uuid": "bf83663f-d75d-446f-80ca-7bd60a74260e", "comment": "Malware payload (Socks5Systemz)", "value": "b4f6e976703c22e6004411dca6d035ccd4ea34e0ab3f43ddd55adecc0f76293f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873245, "uuid": "fb47e011-3902-4eb7-9f48-e0ecbc2cdf00", "comment": "Malware payload (Socks5Systemz)", "value": "81be78421c0f57ad7e7d5829f1a48b0f71d397de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873245, "uuid": "83fd163a-86bb-4271-adea-dbbf46465d7a", "comment": "Malware payload (Socks5Systemz)", "value": "933df29f176dee9a67e176cc02e57148e2a49281768871e04181b35b8af104c1684808c4f45fbea0001e855b6daca0b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873245, "uuid": "f67aa06e-1a25-484a-b540-ccd1259baeab", "value": "T11F66335392454DB9F074A97CAC5BE9200BA7B3C2269F21E073CC7D75AF1B6EA14272C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873245, "uuid": "34952178-a350-4bb0-a391-777cb5204e00", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873245, "uuid": "74bbdb73-dfc3-465c-a5db-009a3b8f3f3d", "value": "98304:woP7AnGPoDtmRRSVeH5Y5iiKb43obOZjhu5JLMIqYoQxQ+n9mwCrTPSPmA:x50DEb43OH5dtqYxvItrTaPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873245, "uuid": "dd8ad434-449e-4e4f-ab19-e5f867464f9e", "value": 6755423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873245, "uuid": "885b61c5-06f3-4504-8032-ca6bacee3429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873245, "uuid": "119e1838-15f1-4126-8759-ac54d7aa6dea", "value": "SecuriteInfo.com.Trojan.Siggen22.40888.11234.29256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacfc549-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702880081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880081, "uuid": "7d9190b3-52e9-4f0a-9626-d9278d6435a3", "comment": "Malware payload", "value": "b3fe17e6d7d2cc7ae1e22e5d03e1401f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880081, "uuid": "9bde0b2d-ff8a-4d75-91a5-2816414a2b2c", "comment": "Malware payload", "value": "b78cf9512911f62384003ba32340d819f6f3ccb3dc15b9e4f1c4b5825fa357b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880081, "uuid": "a41b1ffa-adb9-46f6-b77d-3511772aa9af", "comment": "Malware payload", "value": "2de80b76fce64450c5a2500ccdc529d4a99070b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880081, "uuid": "240eaa30-c405-43cb-9cb1-12aebf1b1075", "comment": "Malware payload", "value": "cf637bf8063b17f524892df93a3d686121d6bd2a6f2c23aca63965fecd9b5523b23cc178e8a3c2cfd73b2c9c275becfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880081, "uuid": "ab6dc8bf-52f9-4eb4-aa3a-c295471de509", "value": "T1C1D439486D0A8673DBCB8D3B8CE31BE607574C6BCAA264B184715DF78CBADE1B94540C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880081, "uuid": "11602f15-b2cc-4dd8-a6b7-37f013a3a4c5", "value": "ec29083df1aec6a6221dd2d98de08acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880081, "uuid": "881184b6-57c1-4c26-9b92-f6eff101dccb", "value": "12288:APjN6lnnYfuJdr9kqsqVJW8wE4p9AEvdDpPpvi06jK4t9xUbMzA8A/5i2:2N60uDJ9qNpi06XQEA/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880081, "uuid": "1c3a9a58-f0d7-4a6d-ae15-2d27b7d88669", "value": 653646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880081, "uuid": "b7ea5c15-69f8-4cf3-94d3-754434636df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880081, "uuid": "d08a780c-cac7-4780-a991-946aa7e2fb7a", "value": "b3fe17e6d7d2cc7ae1e22e5d03e1401f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188206b6-9dc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702919752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919752, "uuid": "fc3bcaf3-ddb0-4634-878b-e1075df4d598", "comment": "Malware payload (GuLoader)", "value": "e6c4a6f65389d0d2eb811f651be932e2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919752, "uuid": "bc91e763-24d4-4fe3-8569-e943303a816b", "comment": "Malware payload (GuLoader)", "value": "b91aa73e5c563f638eebeeb8a6348357bdc852638816ca0b13434a78fb03d1e2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919752, "uuid": "7aea0b4a-cb3b-48b2-b4a7-5500615d3a3f", "comment": "Malware payload (GuLoader)", "value": "3434b8a9405d93430d15e512b124acee5734f382", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919752, "uuid": "16ecdfcb-9396-41f5-afc5-dadf2d951bda", "comment": "Malware payload (GuLoader)", "value": "d72d5479912fdab92375d623f50243cf3f5172a061af119c574e743c48feebca2acc072530f5ba475597053c62362d2d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919752, "uuid": "65c41528-ef47-4f96-995a-cc8975c4cf7b", "value": "T164236CA0FA55D71D4B0A267DD8854CC08168841ECD1350B9AFB9F78E60CEDDCB2E96CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919752, "uuid": "1073d8a6-d8f8-4d19-9a72-611fb3b1d4a3", "value": "768:nWh/cCY9lC8ZjgbiG/gDMbrKyM4eYnmoie3ftsEyfZ23GUYrptTmnFsr+7PQDPzp:ny/cCQjgecZmyMs6eV5yfZ23G5mnFsqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919752, "uuid": "5a35a688-0539-4325-bc6f-037c0781d4ee", "value": 48201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919752, "uuid": "9e3c1345-a782-473e-a6fb-190bd40ae461", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919752, "uuid": "588d5134-424c-4ae2-8e55-5b254d8829af", "value": "FV23-8165.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28f69c5-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702889489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889489, "uuid": "d8cefe04-03b5-40f7-8490-fbeeba106b79", "comment": "Malware payload", "value": "6c4bbc25f63c2fe49d9d65fd0e555df6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889489, "uuid": "7a4a53be-ee01-423b-a9d2-9f50f2788c13", "comment": "Malware payload", "value": "b94ee893b88a91440ea16bdfb6d64bcdcb2b2f234ea7f7b7d6ca1598eb35bb25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889489, "uuid": "b02a9b4f-87e5-46a1-a91d-2ef4ad260b87", "comment": "Malware payload", "value": "03d281ef4e0659dda41f189eae0462d128bf0c84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889489, "uuid": "a2b18349-59b6-4a45-8d79-f1afe48559b3", "comment": "Malware payload", "value": "30831d0e70fc77520d4dbc92287316fbc6fd1672015911525d9fa61ba59f270c562cf26ae69f7a24a888f56e3a650ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889489, "uuid": "d41de59b-0049-4ddd-a8d8-b39cba9014dc", "value": "T12C234B0C379D4713C7ACE5BD99E3254907F4BAF76602E396DED093692A43BF1500AB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889489, "uuid": "0b1e10a3-b4bf-44e2-b955-ea1bd1016894", "value": "768:kwbxm5pYe+oRu5CJxueVH+6vJNau85FQKDhEbO3k4o040JGAmAwJWPrN:pbxApYeJRpDueVbJNEDXJ3k4hLBmtoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889489, "uuid": "18923f4d-6431-4229-aa1f-ec2bb5e90b80", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889489, "uuid": "c6953ce7-1a1d-4cb8-9eeb-3ee3bd831ec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889489, "uuid": "e2daafb7-682a-47cf-8674-aed4234b94bc", "value": "NOV SOA - USD 17550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c6cf38-9d6e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702880742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880742, "uuid": "2ebaeb39-ba60-432d-a207-a0d29c4d671d", "comment": "Malware payload (AgentTesla)", "value": "4d0b2fc2fd1de73919c079ef11a6c4e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880742, "uuid": "3f8f29f6-64db-49a4-a129-f4280c9bfb73", "comment": "Malware payload (AgentTesla)", "value": "b965df83cfeec960e1372166cd73d936ebfb3be2986db0bf953bf2b67b5209ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880742, "uuid": "e7308d0e-4141-441b-95a5-44472c3ccf08", "comment": "Malware payload (AgentTesla)", "value": "42797037e6ffb00f40190aac91fe88e93b2f7ffd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880742, "uuid": "061b8a52-1bb0-4f81-8188-fcb9900e828d", "comment": "Malware payload (AgentTesla)", "value": "b9f8758d4e1fd7880ce298be043085feceb974f6ee3f2060d1932f853d9962b58af11f971a176e43e06e76614011c8ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880742, "uuid": "c5891b0f-eee2-457b-a6f0-f11b85cbc8f9", "value": "T15B15E43C48BE2237D6B5C6B5CBEC8827F05CA46F3150AD6594DBC3A653C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880742, "uuid": "7022429c-bebe-497f-872a-360ade46ddb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880742, "uuid": "afb02a2e-8ba4-496c-83a6-1dcd909b0184", "value": "12288:+HvwEx2iN6KZfsPFXMnDdTdu6YPcmhOOE7DblZA7l0I2s2nJPKb:owk1AKZs9X4DdTz0cmAnDQ7l0Xs2nI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880742, "uuid": "cb0b368c-0aaf-4260-9338-3e75f6cbf69d", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880742, "uuid": "257b0bcb-27ba-4991-889a-82bd94f750ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880742, "uuid": "d70721e8-3479-454b-a73b-3ea3dd8e5818", "value": "DHL SHIPMENT AWB# 4633817031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb1d792-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873264, "uuid": "1e1483b7-1665-4062-a1a2-8ef5f9a71f43", "comment": "Malware payload (Socks5Systemz)", "value": "6e9a3dfc04b5716143be9a1d3b29a2cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873264, "uuid": "dd5a4d78-7bac-438e-9f50-f9b4ea16d50a", "comment": "Malware payload (Socks5Systemz)", "value": "be42f59c3dc81a27bef94f17883529726a9391c75ce16b064f12c90f9b3a5cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873264, "uuid": "f8825b15-4234-407c-85d2-b6b7a2cc9eb1", "comment": "Malware payload (Socks5Systemz)", "value": "e38e20d08809907a1ae163c190f6033c525f8ccf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873264, "uuid": "8f73fedb-1e7f-4b1a-b337-3bdfe55dd8bf", "comment": "Malware payload (Socks5Systemz)", "value": "82fa8847a74868f458a229705c2a0e9fa177876ad3431ae8e8930b534136852f97b6113be5444865ef6045540f232c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873264, "uuid": "825dda87-9844-4b6f-abfa-96635b8da0c5", "value": "T1EC6633169CABC972D6B346B6ACA061D88DDB2CB23C79F0C830CE45FD9C76FA45684075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873264, "uuid": "993c66fd-4ff6-4ca7-aff7-a2a52f78bdf2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873264, "uuid": "af01e123-2f10-40cc-9d17-d0e988049d01", "value": "196608:w1dteqFaqdaBooY4oXlBcoefmmk4D3REdlnF:w1tzaa94oXmmmk4rRklF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873264, "uuid": "7a6a94b7-20dc-4fab-aa43-0fbc2b3cdb1b", "value": 6795192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873264, "uuid": "314235cb-0fba-4f27-89a8-5ae339c4ce97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873264, "uuid": "96eff393-db2f-452c-8acb-58d879f863b5", "value": "SecuriteInfo.com.Trojan.Siggen22.40920.19202.199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0aa485-9df4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1702938310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702938310, "uuid": "4bd19ffe-0cc8-4a8b-a142-7d0357c5f575", "comment": "Malware payload (Stealc)", "value": "0194d0d6488ca775087ababc0a290b8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702938310, "uuid": "cd03a2a5-c66f-476d-b8f5-658c11c358b9", "comment": "Malware payload (Stealc)", "value": "be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702938310, "uuid": "f0642a51-3836-4ea5-af76-3e60a382daf6", "comment": "Malware payload (Stealc)", "value": "2b99e13868f51f3e81d7677c528d75fc1bca2102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702938310, "uuid": "ef1c3bd6-65f0-4ba9-9acd-29c012ef2a4f", "comment": "Malware payload (Stealc)", "value": "338102b4a7a961e3391bf24fe2d8d961009fca767519ab55073fe711dbeed4facf1df33441a950405de6b642c1bf1985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702938310, "uuid": "fdb5a03b-3378-45d8-a1b3-1cf194168ff8", "value": "T1CE252313ABD45177D9A4377064FA1AC30232FC620E358737778AA99D0C729E4B6317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702938310, "uuid": "71e9b92d-c522-4379-9abe-46d67b6f218f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702938310, "uuid": "df7150a0-dec7-47d2-80db-09563f55cd2b", "value": "24576:vy2t9VZGekdBSk9EiEwxCu/jGRVaQMNF3:62Z9kdn/lS6QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702938310, "uuid": "1227a4b0-859c-4190-b6fe-adeaf9f391c9", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702938310, "uuid": "4c737f44-f537-4d4f-962f-85549e5163c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702938310, "uuid": "9dece850-ebee-457d-8c39-c89178e1e7ed", "value": "0194d0d6488ca775087ababc0a290b8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8af6031-9d62-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702875755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875755, "uuid": "88df00ce-05c3-4be7-8e85-836cc9768e90", "comment": "Malware payload (Mirai)", "value": "b698ea50b852e683c833dbe8ad292be7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875755, "uuid": "1d47a86b-a2f6-4dbc-a1c0-ef7398e96529", "comment": "Malware payload (Mirai)", "value": "be7debaf79620c42b1c21e30230c4078cf602b4db614f4f860de8a7e123651a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875755, "uuid": "be4f454f-e9a2-4890-ad44-3cbc18990615", "comment": "Malware payload (Mirai)", "value": "cf678aab3e1b941684015790bb83643eb05364af", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875755, "uuid": "dd5623b0-3e34-473f-8658-76445ac62dfc", "comment": "Malware payload (Mirai)", "value": "244699e8c635f1f84346cc059653c90f359c17e3108bb9e240a59abeaaebc6f27f73cfb4b976d13037473af58445c4b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875755, "uuid": "2fdeb763-9857-4e14-ad7a-9304785c9a33", "value": "T1B3B3B61E6E61DF7DF768833047B78E21979837D626E1C681E2ACD6001E6034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875755, "uuid": "9d4ae504-809b-47e4-93b7-dc8ae4a289b5", "value": "1536:dDaVvjGiBwRpCOsVIce9OAOLY3yl6FObo5HN8k15KVryAqn16pib6eLc0mIZ/oc+:kVvjbBwRpLcUOAJyyObo5HLnAiZZ/Jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702875755, "uuid": "a60bc626-cb84-4842-9afe-61d99935fa6d", "value": 113924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702875755, "uuid": "6c9da2f1-3609-48e0-bede-33f1473d8052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875755, "uuid": "f9a8e592-f154-4b81-a27e-e24fe4bc6862", "value": "nig.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6abdebd-9dee-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1702935908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935908, "uuid": "70507e3e-09f6-45da-a32e-e7ddd5f904ad", "comment": "Malware payload (Stealc)", "value": "b67151e07936533f3b38355566e47650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935908, "uuid": "378e5c28-ba94-44c6-81ef-625a57528f0c", "comment": "Malware payload (Stealc)", "value": "bf4e0ba12be5590ba80c2d595c166a8c2d36d6baf2770c8d1da20e64ea898367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935908, "uuid": "19b2db6e-e320-48a5-8fbe-942df82b3d8b", "comment": "Malware payload (Stealc)", "value": "35010750b5dff68aef030d410ef98e0835d682a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935908, "uuid": "c5e1e0dc-ffb8-4d0a-94fa-1631909eefc6", "comment": "Malware payload (Stealc)", "value": "8d07297a28e5371fc4bc98eedace2ae4874e2dffa7b34df76f81881e1ee678978af34fc6eff2d02350a1347c0446d3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935908, "uuid": "6ec583ef-428c-444c-9af6-d307833f6884", "value": "T108F2D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935908, "uuid": "91b55cb7-d67c-43ff-abe5-151345679d77", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702935908, "uuid": "71c7a478-bd99-40e2-96a8-b54ec51252f8", "value": 37575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702935908, "uuid": "a5e126be-3204-47a7-a262-9f01c78159cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935908, "uuid": "60f85c2c-987e-48f2-8e1d-07c5d7b833a2", "value": "b67151e07936533f3b38355566e47650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6fa185-9d76-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702884140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702884140, "uuid": "c80ccccd-50cb-4eae-b9b5-36db01c10d31", "comment": "Malware payload", "value": "f4b40538056902aa7d6f206be518ffa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702884140, "uuid": "094edc51-3378-498e-933f-4e7384dc9fe1", "comment": "Malware payload", "value": "bf56add609e397a7b147c59c7e70551996070321b8244a9c41b2cfff5ba62d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702884140, "uuid": "7fa5fa5c-d205-42fd-be23-9a94a171708e", "comment": "Malware payload", "value": "93188fc7755b282c8efa46fd428147d67567f76f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702884140, "uuid": "674344f4-246f-4a3b-b980-d9624c4e11bf", "comment": "Malware payload", "value": "3a9ce348ff4c93219f4f030da14fbd1e7d669249609780ef04883e96b9ce436948f1dd25466a1b08bc4e1c0782a7539e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702884140, "uuid": "88bffebf-2cad-481d-9075-8456bfa85876", "value": "T191F35C1174C0C072E577153219F4DAB06A3EFE714FA25EEFAB840A6E4F312C19635A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702884140, "uuid": "b7b263de-5ecf-4a09-8ffb-6fbf3b7bd0aa", "value": "7b84262346ae10fcd5a6070d7504e7f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702884140, "uuid": "e59a0576-ef47-4788-a859-02bb6bc19f17", "value": "3072:f9PcnxhiBoyRZxhoSXMJSZPk84KA51Q3acyAC2HZKXEr+VrewXsNuutJAu6y:f9PcnxqzDxho1SZk731RcTCgZZBvt36y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702884140, "uuid": "8b853837-a1ef-4de0-8521-dbfc28d4f64e", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702884140, "uuid": "84d5b3ac-3641-43e8-b046-32c1b0fe7bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702884140, "uuid": "559bda42-7e54-4705-a342-b65ceeca56f4", "value": "SecuriteInfo.com.Win32.TrojanX-gen.6686.21555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56dfd53-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873253, "uuid": "7d12e0c7-a2a3-4c54-84f9-fb87bfa00bd7", "comment": "Malware payload (Socks5Systemz)", "value": "87d9f7b952750fd04d59cb5904db8456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873253, "uuid": "d6b67bb5-4d9d-4faf-a917-1f9c78464bc9", "comment": "Malware payload (Socks5Systemz)", "value": "c0356ca6ad8b4c83fae4d3d944d7e6f23591e0c88c1ad8b1e9357d717610f3d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873253, "uuid": "06ccd883-0d08-43ea-ba3a-09693237b1cf", "comment": "Malware payload (Socks5Systemz)", "value": "1fb6747c8ab5379dfd18b7440b11281227e7456b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873253, "uuid": "42b7baee-fa54-4f98-8d20-95052c4f6d06", "comment": "Malware payload (Socks5Systemz)", "value": "73093f56855122cf5275c6e801503fa036ea99a550b29ba8cd361da673cba6fd20778852ae820f61463fc029639d025d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873253, "uuid": "59b3ef93-9b53-46d4-9949-adbd60964b26", "value": "T18666331C84104D64D390AD3EAC36BA67DFBB3E698A350D20BD14D2FD46EB07D958AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873253, "uuid": "e0d7e7df-934a-4c2f-a66a-fd0ee1e4be5c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873253, "uuid": "4da5ea72-0f5a-422b-95d8-bfcfbe3a38ac", "value": "98304:wSPB0eTXOYDXPIGK1GZcFad2F1B5Kn4gi8FGVZ6wD2isox3HJsAkzGi7ppmA:dzT++TK86EeMLGLD2A3pshtpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873253, "uuid": "3aec48ee-580c-4524-bef3-2d458f14b55f", "value": 6765329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873253, "uuid": "f310e6dc-e0d9-4499-945d-6e81ea8e1983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873253, "uuid": "4c31b78f-652b-47e7-a94f-2d62701188c2", "value": "SecuriteInfo.com.Trojan.Siggen22.40889.6199.15025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe855bc-9dc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702919818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919818, "uuid": "e099d330-ec84-47ed-acdf-c42f40050bcb", "comment": "Malware payload (AgentTesla)", "value": "3dbe26e4b1ef033b30a80f74a8f55a90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919818, "uuid": "37067662-0c25-4122-b00e-3dbb50ebf9ef", "comment": "Malware payload (AgentTesla)", "value": "c0f3f5dcf04f837c47a8cc7af07becee311c061f2ae59735c11bbc6c980d306f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919818, "uuid": "aa66f0a8-c699-4da9-8afa-7036d9407631", "comment": "Malware payload (AgentTesla)", "value": "8e4b0379bc8b023bf8e7aeb8b2f58e7b6e6af6db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919818, "uuid": "62147e22-a8c5-435c-9fa5-816a9686c106", "comment": "Malware payload (AgentTesla)", "value": "e2d55ab2163c619a5d15706be27764a63326ee6e11747a1b6c34078cf8c7640a12454fb8eb9fc5bf7b7cc71066d92025", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919818, "uuid": "164d5291-2457-4db9-a9ae-9ad566359bd4", "value": "T10C25B33C587D2237D6B5C7A58ADC8427F25CA46F3151ED6598CA93E603CAF4238D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919818, "uuid": "23dc4449-8809-4c81-a67f-a956da53d78f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919818, "uuid": "d66fc970-0ffa-4a6b-9dd7-8aec68861ce8", "value": "12288:8GXDY6tW0LYXIXyY7a25uiDsHSdA8HfIc6BfRfxXdNQ2T7JlyE9:3zk0DCs492AgIfVxlv+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919818, "uuid": "af4d64fa-2fd8-4b91-b688-6e03a5c3b00d", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919818, "uuid": "65a33ae3-0b86-400a-b899-a64a492ceafc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919818, "uuid": "1b48856f-5720-421c-9f25-3c6f6e254158", "value": "Fiyat teklifi Istegi 23070 PER 1000 Adet \u2026scanneed 00101.xxlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdabf8df-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702925639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925639, "uuid": "75ab2df5-2090-464e-a61e-40d60fa812a9", "comment": "Malware payload (AgentTesla)", "value": "f4fbb83419718d7de8f63a144cd28127", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925639, "uuid": "de61b565-4f38-4ffc-9034-922596445c5c", "comment": "Malware payload (AgentTesla)", "value": "c2167ea941d144ad0e3f95bd58c350cabfa94c52578ee2e265d2ed6d4a81147d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925639, "uuid": "80302c2d-4f66-45ed-b2a2-1bed34740264", "comment": "Malware payload (AgentTesla)", "value": "3bb2aa267e3b61f27141b462e6348a8c2eede2ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925639, "uuid": "7682e171-d428-43c0-b687-3bcecd930b15", "comment": "Malware payload (AgentTesla)", "value": "47031d1ac7ec256efa93cf0a1c7079153cb39d7d8ca7310d3350336330f1cbf3264245d1dd58053cc7344ca099105c7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925639, "uuid": "3c80d534-340b-4578-b99a-4c03d045cb15", "value": "T1E485CE87ED4445A4DC0567B6EE72C8B5231A7CECE97C692D28EEBD233BF67871200506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925639, "uuid": "9376b0da-2ec1-49a6-a55d-0d4e6ed21f6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925639, "uuid": "d057d208-8829-4fa3-8d91-91c0262901d0", "value": "24576:2Ih0ApaF0sgxqpjiI6pqEk9A+XUnZv8AwGptKgyfcExSN8i7ww1q:2Itpu03xqpf6p4nUn/wfcExSpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925639, "uuid": "0fcb5548-81b5-42ab-bc5b-304586b9b8a8", "value": 1854976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925639, "uuid": "44610037-47a0-4d91-bd98-50bb700b8a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925639, "uuid": "5d25bfed-c159-49a1-9b54-71c8c1e659ce", "value": "Mix Skirts # pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1616008-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889514, "uuid": "72f273c9-8f89-4d95-a2c4-e10fecd036cd", "comment": "Malware payload (Formbook)", "value": "23260728a86bed399a3867f146fa3be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889514, "uuid": "7d9bdc8b-ba38-44ec-bd52-b930f112d828", "comment": "Malware payload (Formbook)", "value": "c3b34b4331bd48a449fcfc5057c62916bba0f12dc78a65767938e9fe5bfb55bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889514, "uuid": "e644f6b6-db31-42dc-8217-9147a06c1f5d", "comment": "Malware payload (Formbook)", "value": "aa1ba4ef91849f57399bf804af3c4c17fd728f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889514, "uuid": "d560beae-e87f-4ff4-a552-11dcbc5ef135", "comment": "Malware payload (Formbook)", "value": "d79b37e071a7a6f575d17efd84eb8dd2bac7ddd993c8a54627e649e19e11ee0025cbe99b9678c203f6d24f739118f897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889514, "uuid": "841151dc-8a3d-47e1-93c4-188d4e2fb94e", "value": "T15984223480D151F7E0FA2B30ED6E9E87D2BA44491FA2638F639D5F661938BC3540E5E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889514, "uuid": "12c392d8-72d0-498c-8f2a-2dd01e7d96f8", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889514, "uuid": "a06fd451-805c-43eb-8c04-de54e2d8f8c7", "value": "6144:bhjmbnUMxBGtTuF6oS9Vu+c/30PxyHueUvbP7vrf4KHLBTIJ+gjzfwjlRwy+:cnUWchu290tvZue0P7jLHLBT1qfQwy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889514, "uuid": "bb0f7eaf-75bd-4290-8c0a-36735585936a", "value": 381941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889514, "uuid": "f4fa3c30-f3cc-4b4c-935b-397f291ce01f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889514, "uuid": "82cf48c7-e13b-4e67-97d7-2cfe50a0c306", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4f33e1-9df9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702940402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940402, "uuid": "3cd4bffd-c773-45cd-a3cd-e408f581b447", "comment": "Malware payload", "value": "2e70726cc7cb4633092706324696ca5d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940402, "uuid": "fae1a74a-eb87-4394-b401-79628a6d02a1", "comment": "Malware payload", "value": "c421b589bb93a8a6d8ae544df8733e1062ddf469a1a7d822ecf42cabd166a3b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940402, "uuid": "fd0cf23a-9feb-4ddc-8cf6-6a90d94ee72e", "comment": "Malware payload", "value": "4223786eda3200f0758aad7ab6d719b58b68e6cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940402, "uuid": "0b434022-9fc6-4657-8a0c-7697de6a5368", "comment": "Malware payload", "value": "f14b8d5c26d6f53ddbd847a688bf48a93fda25d8f563b538f22d1ef3bad07ba1c5e82efaf40d2b55054bb7c1b8158b8c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940402, "uuid": "9fad2c39-5f4f-4b07-909d-1abed6a20b63", "value": "T1425623B97A44E153D0D422762D50C2DA20893BB3867844D7BBA9773E27F49C1D923FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940402, "uuid": "ab95d8c2-c6e1-4a3c-b399-4c75c3d62b7d", "value": "a7f348c831c8eac975016423ddab7f84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940402, "uuid": "4468b16e-435d-4685-8132-ca236496795f", "value": "196608:h+FbhUlZSURTEpBF6EPJodYFWWICa4BK:cksCYCdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940402, "uuid": "2cd52e6f-a5b6-4aa4-8087-d28b004e1675", "value": 6371328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940402, "uuid": "3efd24f9-a2b5-4abb-97c9-c32bb47c313a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940402, "uuid": "77d15b5d-3fe5-4650-a45c-64610406af5c", "value": "yRfooBc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1983335c-9d5a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702872079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702872079, "uuid": "228b9f0c-d201-4a11-8501-1631ffb19b84", "comment": "Malware payload (LummaStealer)", "value": "2e4e7673a769c8ca39609bb6973f8a1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702872079, "uuid": "247453ae-3b1e-4ff2-85e6-cb5680244d3a", "comment": "Malware payload (LummaStealer)", "value": "c6930d431982ea0094f33313a2d2c373fb169478d3d17cae706012620d679242", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702872079, "uuid": "a8209fe1-65f5-4f24-9f9c-186773ec9133", "comment": "Malware payload (LummaStealer)", "value": "64cc68e8b7f74d7cbb5e0bfdf4bf6687310d922d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702872079, "uuid": "a09f812e-0fb4-4e07-9bd0-50a38d49a05f", "comment": "Malware payload (LummaStealer)", "value": "6240a0b0c42e1b4a6b150d14727b659e573b4dc28a1cbd018e23ba2c2ea24fc5598f01fa764c3753d7e0dcb7f12ecca9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702872079, "uuid": "0fb09633-7674-4699-b54f-757d2755374e", "value": "T12CB47DC4BE8360B7C8242C300466A6B72E741B615325DDFB815738D2E7F6E73A2725A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702872079, "uuid": "50268e15-8db0-455f-ad88-70a9acf6c782", "value": "87276645a61980fa58d8085fc4df7bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702872079, "uuid": "1cfa8f20-420a-47f5-b8da-86b358b5f8fe", "value": "12288:i4bZS+74XGs0vyBTbjcA2usBmdOcDbNbzIG1bK6q137vOXDCpcY:i4bZS+70Gs0g4A2us/ezIGm6qx7GWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702872079, "uuid": "f7b06e3e-9ddb-47fc-8056-018a8bc375b8", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702872079, "uuid": "fe7068b7-2c3e-44df-a0bc-82d35d64f33e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702872079, "uuid": "fd68ebb9-27c7-48c0-8630-14d570d5a69c", "value": "2e4e7673a769c8ca39609bb6973f8a1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84bc457-9dee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702935884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935884, "uuid": "fba0585f-42b5-4d62-87ec-1c76dce0453a", "comment": "Malware payload", "value": "3f567ec828e89143a8afe12b1315346b", "object_relation": "md5", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935884, "uuid": "c99b93c3-3d29-4d10-abbe-ab0092b5d41f", "comment": "Malware payload", "value": "c6bc86a956c779ebf8333dad76ccfdb0cd9b4a18b24051a426fc0cec78e18814", "object_relation": "sha256", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935884, "uuid": "3f1bbb43-be78-4c97-884e-e2d01bae0d85", "comment": "Malware payload", "value": "70d67ab21fa87a25f5e73922f6baf7d89a01c229", "object_relation": "sha1", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702935884, "uuid": "a4e33bc3-aaa7-4b1a-ad21-32d30406d254", "comment": "Malware payload", "value": "5732cb591473a44bd3030e682c750ac26ce6ab77005b038a2c9a474e46cdd523ec1f43e49296915ff85516a2458eeb90", "object_relation": "sha3-384", "Tag": [ { "name": "WikiLoader", "colour": "#264CCC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935884, "uuid": "66a23b67-d270-4123-9585-429b562914f9", "value": "T1BD86335BC99B099CCD1B3A3EBCC51716436005F1723996BB71DA049C5CEAADE4FEA203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935884, "uuid": "f6687cee-cbec-441b-921a-017db79e2b9e", "value": "196608:zh9WKqkGTSOwUDUUni2/AA/jXrItQ73XNONeBl50Y1OC8M:zh9b9OwSniXsktQ7tOm1L8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702935884, "uuid": "8c6716ce-430c-4ab7-976d-7aff35f86bff", "value": 8468543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702935884, "uuid": "98733f5b-6674-43f7-86cc-041436c5eb1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702935884, "uuid": "044574a9-f64a-4d73-9d7c-d0307207ae4d", "value": "v5b2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303ada59-9dc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702919791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919791, "uuid": "b209a98d-30e6-4904-9fe4-0a04caacf91e", "comment": "Malware payload", "value": "615d2d920ae934a5c2e8f563ae735b52", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919791, "uuid": "2505fdfb-8a6d-4897-b8b6-1884db7349b2", "comment": "Malware payload", "value": "c9106c0dcbfeea2cef4a387a5e80f7cdbf24cf1535cf54e7dd9f2267e79234a4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919791, "uuid": "13446b0d-e793-4169-bf8a-afbff1f73562", "comment": "Malware payload", "value": "6fed297252da1eecbc6b6a915c52c6fbcbaf3787", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919791, "uuid": "d45b5460-73e4-4376-8d84-65778c812bd5", "comment": "Malware payload", "value": "54195c89aeee963de511eabb794b2421bbb8f301b8fff69e6d443ed59a5915731b27502f3b8a4fd32251646ca05edc85", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919791, "uuid": "4e78a668-e8a7-4a99-9e29-32a96a145b9b", "value": "T1E5D3AB6DC34B01698F625377AB1B1E4542BCBA2EF38452B1306C437933EAC3DA1256BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919791, "uuid": "0309d1d1-1d3f-4fb1-88ab-ea5e60a6445d", "value": "1536:6wAlRkwAlRJrQBHSWT6denpXvlkn5eV5anL:6wAlawAlbWSM6dYpX9WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919791, "uuid": "765a6115-c49a-4b81-bf29-2d0a63047712", "value": 142698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919791, "uuid": "0a67492d-84db-4771-9233-a47327d70d26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919791, "uuid": "38d34e15-f351-493c-b577-7c6e58029ec5", "value": "16250_2369_0_0D2_4.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f7b081-9df9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702940637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940637, "uuid": "13a7481b-5567-4f69-aaf7-757e6e17dda4", "comment": "Malware payload", "value": "2474cd63cc099d0fbc665a608a444d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940637, "uuid": "28416e41-6a61-4eb9-8f50-a76c5b63fe01", "comment": "Malware payload", "value": "c9685b75e4112119a86ed9f60296935d575cffe909249ea037f7d9ff4a010d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940637, "uuid": "a4a65b86-7b37-4e6d-a2ce-8af7bdcf0394", "comment": "Malware payload", "value": "cc737eb96310f3651204f5cd4a0bb2a9377bac33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940637, "uuid": "9b6ffb48-e1e9-4ecc-8ac9-c561cf400c41", "comment": "Malware payload", "value": "736d808805be4879fc0710952498354bdeb38c714c672346d53e3cdd46495234c5e38b3c72825bca993532a6e0cca3db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940637, "uuid": "9fe50de9-eb38-4279-a884-b2d7b2a8f2c4", "value": "T15D13A8CA73A88A13CBBDA37588119345D3F2B1871D62DB5E0CDDD8DA1F3B6440E8B592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940637, "uuid": "a11429c5-272c-4832-a1a6-a2a68194e6d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940637, "uuid": "6f02ba6f-5f1d-4c18-ac35-3059445191d9", "value": "768:YNJk2M+qPpXC67sgLZj3EfQE96LtGGTZ73SGD7:QLM+o7sgZjUqGeZ7j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940637, "uuid": "e6226728-8a17-4e29-a80a-6ab0c9bed51d", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940637, "uuid": "7873ec59-4d71-40d0-b631-daf094516f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940637, "uuid": "3c37b1ea-7fdc-4524-9aa6-a3abc6760748", "value": "CMD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499f9b0c-9d4b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702865717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702865717, "uuid": "eb9de136-f239-404a-ad78-7ad87d762829", "comment": "Malware payload (Socks5Systemz)", "value": "a0e70d25b481156c594e03a0e1770f1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702865717, "uuid": "705c9fd0-1672-488e-ae79-35d718fe5ecb", "comment": "Malware payload (Socks5Systemz)", "value": "cb49d40d2a4356d1fba321d831f0b98fc2bef5b681c90e240662fe15ac8a9ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702865717, "uuid": "b36baac0-9acd-4e8d-ba6a-b7d9e18f0bf7", "comment": "Malware payload (Socks5Systemz)", "value": "d840a571cbfe0e190816ecd00967a3c5afdf104e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702865717, "uuid": "0b9be501-9e13-4f98-ab21-d8d44c3f0e1b", "comment": "Malware payload (Socks5Systemz)", "value": "6023bac1b4f010d2e75ba44a5486658f3fd8c74d14213d5f0b571b0bb65ddc54cfc23c05fc038587d1ba7f0db88b92b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702865717, "uuid": "5ea62c06-ebfa-4dd5-88fd-4fd29da4790a", "value": "T153F2D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702865717, "uuid": "10b5b604-fdf5-4e55-bf01-bac9411b7586", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702865717, "uuid": "79e2b97a-fe8b-4f2a-856a-80feba0b47ad", "value": 37480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702865717, "uuid": "2ca8f7ca-30c8-4018-8738-062d6488c7cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702865717, "uuid": "dcfa58cc-79da-4c94-8744-34be208bd1ca", "value": "a0e70d25b481156c594e03a0e1770f1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbba58a-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889504, "uuid": "56475ae6-3374-4117-a0db-da8f2ef18ad3", "comment": "Malware payload (Formbook)", "value": "fb7de37281bdea423044143509b21dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889504, "uuid": "0629059e-fd01-440f-9483-b5df0639b8e3", "comment": "Malware payload (Formbook)", "value": "cb761968c0e203fa52ce8ac615bf4093f17d557c2abe8b640debbf53a1c76ccb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889504, "uuid": "f7ae4afd-e53c-4c30-a79c-31a9e88191f9", "comment": "Malware payload (Formbook)", "value": "c9a71b7904235645a3bdf3a2c431dd7e5d006bf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889504, "uuid": "6e539370-503e-495a-a571-a8cfe0773236", "comment": "Malware payload (Formbook)", "value": "85f0fb678a04618a9e55a480057b38e2e1608d477088ee9aca3c0cbd7bcb40b00ec51b5a12e49ee7e0522f8afe4cdac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889504, "uuid": "e4ab812f-5248-4d86-a466-b2a8713d4635", "value": "T13374224051D2C4F7D0D79FF11D37E579F2B46AA46600E90B0B288DAF2D719A79F0B1A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889504, "uuid": "bc60a43c-e386-4a69-b16f-cd7108ebc7b6", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889504, "uuid": "b77af252-83eb-46e8-906e-aa37be6bdc2a", "value": "6144:P8LxBq7ie8p2X2Ep6wMgkwDxkjH0iW4Ck+OYQxpO++UpFYDsMI6VAkFTpDbZ:j7H8pW20IgkKmHfd+O9pO+ZpqDsMIFwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889504, "uuid": "72af988d-c3ee-4fa1-8134-15f328bb0256", "value": 348930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889504, "uuid": "de77fb29-0434-4757-8200-6fa6da4f4cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889504, "uuid": "45030323-e6de-4223-b01f-4da57565d15f", "value": "RFQ DATA AND PROFILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c741ae61-9d92-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702896422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896422, "uuid": "f17266f1-d04d-4334-8ea8-ad627664f9b1", "comment": "Malware payload", "value": "7bedb6f33e74c84939b3300de4e9bcc2", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896422, "uuid": "d07843d1-b8d6-43d0-a092-e41a5d6daa77", "comment": "Malware payload", "value": "cc8a675e3a32339bca0f816f86ae4951130bf4b81062ebb7d91e044dfbc4fac4", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896422, "uuid": "1bf52725-a4af-483a-bed8-54f402d8ebf5", "comment": "Malware payload", "value": "f29ec27c472b83b0cbf3c8495d841b742a413003", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896422, "uuid": "df10a51a-f08c-4796-a597-777d3c832a4f", "comment": "Malware payload", "value": "19b8c6b16990dd92c2f3b2e9f9562c828d06ef249bbac1d504c87c69033a27668494374c3c2bd96dcbe39019290d3047", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896422, "uuid": "2f22c49c-9e7a-453d-921e-1f1cce814db8", "value": "T1D4036C13BAE85D00D909CE39FAE795141770BE826553C69F324D13820B3278BFE9729E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896422, "uuid": "986723e1-49d4-4d36-b1c6-88f4d2862701", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896422, "uuid": "032ff1f6-cd3c-471e-b4d1-d699cd1c6d14", "value": "768:s6xtfX0EtLpaTkuTbhG/SYSyDBHkYi6yZdAMxkEv/y:smfkq4kufgPfVHk7Lxby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702896422, "uuid": "a65368e5-a9ab-4ce9-854e-acd7043b7cea", "value": 37936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702896422, "uuid": "7abb10d3-3994-4852-b936-e6470c671fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896422, "uuid": "7ea7d691-3614-4326-a39f-4c7ede500295", "value": "Dunning-Notice-1016.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c88128-9da9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702906171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906171, "uuid": "9c02c4bd-779c-4fbd-a797-2fea39a2449b", "comment": "Malware payload (AgentTesla)", "value": "70fac030623deb6181201fd0ca321bb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906171, "uuid": "54a8d644-c366-4142-a451-d12fdac85677", "comment": "Malware payload (AgentTesla)", "value": "cfc1cd526a745e9154cda0c23f0cce1999ec4325af86fc79d3b1072631b17329", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906171, "uuid": "00ed3b23-6273-4c72-8e2c-a49a31c9c55b", "comment": "Malware payload (AgentTesla)", "value": "f76fa53071642b4af732b2388408a8c8b8ad15f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906171, "uuid": "3c6d38a7-f691-448a-90f6-d15968cf2569", "comment": "Malware payload (AgentTesla)", "value": "5ea194e5c31906105ead56ce15f187657577ac2c072e14008816845d57ac7a5848bc4a979e62fc291e11cbfc9de3cae7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906171, "uuid": "2471ce18-d17e-4bb3-a019-b5952ac7e8f6", "value": "T1BD7219087E9DA223C5AC167C98F317050375DA3FB982E38BADDC9BA62D837C015516F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906171, "uuid": "b6ea54f0-e79f-4b8b-a0a7-49e40ee1b40e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906171, "uuid": "d014bc2b-00fe-4da0-8f88-2734aaff5694", "value": "384:xlNEv0rnlMTxHqigW5R4+kon45b9b5LkkxHYAscjEl:av8gR4+kvpbgcYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702906171, "uuid": "c23463f5-8fda-4f89-b8a6-b78c9db98f20", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702906171, "uuid": "1efbe426-861a-41e7-a4a4-5e3f094aeca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906171, "uuid": "a0b767b7-ef7d-4bb8-b0ca-f9f2da8077a0", "value": "NEW ORDER 12-18-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b721d6-9dcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702921354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921354, "uuid": "120c2494-ef7a-4bdd-bbc8-576f1a9fe51e", "comment": "Malware payload (AgentTesla)", "value": "d4ba5e2982463378357486b8d7f656c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921354, "uuid": "31577efd-50cc-4a66-8181-bb6656ba1063", "comment": "Malware payload (AgentTesla)", "value": "d13bebabc4063d86102cef3bdaed105d826ee3f604986eebefa2e8be3620f29d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921354, "uuid": "57ef03f8-4524-4beb-9a88-6af7afcbbaf0", "comment": "Malware payload (AgentTesla)", "value": "dd0502d38ad2bb63e57bb71956bb02b38f825c86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921354, "uuid": "6e867e03-07d9-40ce-8fb8-0ade814c57ee", "comment": "Malware payload (AgentTesla)", "value": "ee83ce6c247e0c49ab3142fe34af2162a92b3aa816a358c3e14d5eecf22a93a5e2e561f4336faa6d71075b0f9a4350a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921354, "uuid": "b371ce0a-3821-4f45-890c-4d42b918bfdf", "value": "T194230A27B55FB5B1E6857B3AC59B410C0360E792BAE3F74AB84B236619033F9CA4054F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921354, "uuid": "dad46f90-9d88-400f-8c5f-e0dca180c67d", "value": "768:F20/1cyCPJmQcsmC2+vdiS8hYo8gk4nFYiBIuSWC93hxb/xeFe746FCi:F2s1bwJt2Lj8gfii3hC93hX4E4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921354, "uuid": "ad8a7a08-2204-46db-828c-d56b9a0f594f", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921354, "uuid": "0083af31-4181-4e1c-a59c-910a6107c048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921354, "uuid": "fb1334d7-2c50-468b-a649-a6185efc29e2", "value": "Sysiq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a813d9ef-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702908825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908825, "uuid": "0a45485b-bec5-4f98-9566-e803d34dd237", "comment": "Malware payload (AgentTesla)", "value": "cd36f4be70583708c0e80edde4b6b994", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908825, "uuid": "3da6b7f2-af3a-46c9-9176-6bc8a902e3a8", "comment": "Malware payload (AgentTesla)", "value": "d2312c82b0ef97a5bfcf73173a4b72a720c2194278d6a7815091e4f4727e6a61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908825, "uuid": "7cf1208c-08ce-4435-8dc9-79e9c16c78fc", "comment": "Malware payload (AgentTesla)", "value": "3654f7b854bba2ea82f17d2d1f4e570c5af8ca36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908825, "uuid": "36aade00-e5de-4f7b-99c3-1b9f3b4b0122", "comment": "Malware payload (AgentTesla)", "value": "42a44689f4ef174af828ddbef5638370fcb32cad2c502047cf01e427535dc490189a9d1b7fd116e7e1f8dfac845ef7de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908825, "uuid": "02b4e2cc-5809-41fc-a683-6fa464938e31", "value": "T18D15F53C49BE223BD6B5C6B5CBEC8827F05CA46F3150AD6594DBC36613C6A4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908825, "uuid": "41d56836-0083-47f1-b5aa-875b5dc2ecf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908825, "uuid": "f8990282-b855-4368-80e2-33eda42d91ea", "value": "12288:ZL8wEx2iN4b0lA2yLSaypgmwpYNkL55sjOd7r6cWD4UbKJ3o/cv6Hn9J9/cuX2EQ:ywk1abCiLIpgv9EjY7r6i4MAhcumEKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908825, "uuid": "38e7d151-acbc-46af-a5ac-7d423c2d3a23", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908825, "uuid": "8ec24105-f4a5-429c-a277-f81b57d5b723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908825, "uuid": "45ac0406-728b-4066-b136-9535a2441095", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00097ef4-9df9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702940326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940326, "uuid": "1ce5bbdd-1133-423f-b0b3-475824c58e9b", "comment": "Malware payload (Mirai)", "value": "50095b55e26c473aad688c9fc54e7886", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940326, "uuid": "cde98073-fc2f-4e68-9dd1-2348ed1ed5c2", "comment": "Malware payload (Mirai)", "value": "d3f9d0cfac6f3ca2a3bdcc12299102d1893c58c09ecad114b0858b2084d98026", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940326, "uuid": "379ba379-f311-4235-b649-b1f840a1bba8", "comment": "Malware payload (Mirai)", "value": "3c8771171da4c9633de08577b6872f289699fb2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940326, "uuid": "2405c2c8-4571-4e9c-ba4a-4322fbffa723", "comment": "Malware payload (Mirai)", "value": "ccb1b5a6c99ee54885f4ffaf18bb600913cf3769fb57befee267082153ffe90ed09c6b416884cb4b6e12da38d73c66ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940326, "uuid": "019cab69-2f60-49a1-ae96-49554363d5b7", "value": "T11A230271890E9DF125303C72DA95E793B6F12AB1C6673013DA290B382F75B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940326, "uuid": "bf1e3f5e-ae81-4a8e-8421-775f77a88421", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3Z9q3UELbUXfi6nVMQHI4vcGpvU:gECFd+A6YHAxMLRQZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940326, "uuid": "48159acc-4320-421c-bf60-2153ae54d949", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940326, "uuid": "ec55d9a9-3942-4eaf-af86-ba78632a356f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940326, "uuid": "f2bcafc6-3b30-47da-90d3-c2826e01868b", "value": "50095b55e26c473aad688c9fc54e7886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc396d9a-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873238, "uuid": "781c4a6b-2b6b-4275-ae08-74a7546dc678", "comment": "Malware payload (Socks5Systemz)", "value": "ded7ac00a8667583e69d9870d79d0391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873238, "uuid": "ed52fe28-0167-4508-a0fa-fbe255fd4f45", "comment": "Malware payload (Socks5Systemz)", "value": "d40a739a0ca76f1b451877024bbf2662a7d3be4489454bec63af23ada24bd892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873238, "uuid": "0c5c6548-e02a-4fda-bc9c-3b12f4ee28a7", "comment": "Malware payload (Socks5Systemz)", "value": "2ba52b6980e5cc3cfeca215135f72bf5f1c9db77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873238, "uuid": "7bd6675e-24e1-4deb-87f1-32fc9486363f", "comment": "Malware payload (Socks5Systemz)", "value": "26e649151e622885469271b8aae9ec4538ab2b978b6042a3637b55fd22bbe34ef534b07d0142a2cc5ac56192fb06c698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873238, "uuid": "e593d3db-e270-4534-bd5a-c7dfdcb5a3cc", "value": "T1CC6633D376F56812E1738AB95866D0584BF6CFD9042E30889E4F5C8E8B7F709893AF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873238, "uuid": "4b1c9ef0-5283-43b9-9076-5f40756271ea", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873238, "uuid": "615459db-5bb6-431c-9417-80537fec642c", "value": "196608:vHY3srNMVqtbLF3Npk+VLnikPQRqupe90bKF:/YeltbxXlniMhupe9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873238, "uuid": "eef41757-30c4-48d6-b62c-024b5a6b6bba", "value": 6742792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873238, "uuid": "ed6aa0a3-e12e-436a-8499-b1a9c4d71e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873238, "uuid": "994ea694-6215-432a-98cc-17d9c900bf70", "value": "SecuriteInfo.com.Trojan.Siggen22.40921.27608.22557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af7e35c-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702889476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889476, "uuid": "8977ef5d-c472-4eac-9747-e57e6c933da3", "comment": "Malware payload", "value": "0f4f3e1c46760ee3b5185b3f3d950c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889476, "uuid": "c01a20ce-7a88-4333-9398-46e2b1b87899", "comment": "Malware payload", "value": "d42d1e2ec975994e61e9e88ab74555d2459011e10939a713c5fb8a8ed35005e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889476, "uuid": "981d4764-cef6-43ee-97ea-31e560548c1f", "comment": "Malware payload", "value": "4f08aacae22fd56cd054fddc63b1a49ce964b1bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889476, "uuid": "6613c331-23c0-4031-a457-8bfd58a3b79d", "comment": "Malware payload", "value": "084856b7c473b5ce93bc14e1b49cb46db1e0aee90df68ce5578294d4ea767917deeba113588c88764d84a195b53091b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889476, "uuid": "77824dee-debf-4667-9b36-df5fb9684796", "value": "T11FF28CA132A0C4B3D63307710EBF5F56DFFAD62120A5564B2B905F5A7E22682D90F353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889476, "uuid": "8ec5e2f4-33a1-4646-b9f5-efc3bfd6b4e8", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889476, "uuid": "34232f2a-62b7-48c2-a5b0-a9c440b60abf", "value": "768:ZKRtX2+z9G7RxfqkvOcW4s4rtCnvuLtMuOuMNdAcIqb:wl2+o7Pf2wssEnvaMzScIqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889476, "uuid": "06c28133-c818-474f-b330-4c9621b57236", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889476, "uuid": "cf6d797f-1e19-4162-ba11-fe57a89bb37d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889476, "uuid": "5d63bd78-ef03-4bb0-aad8-e9101fa2cf3e", "value": "d42d1e2ec975994e61e9e88ab74555d2459011e10939a713c5fb8a8ed35005e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da98571c-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702873262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873262, "uuid": "fb2ecb25-9b37-4b68-a9dd-6260c7024d55", "comment": "Malware payload", "value": "27e98240e4b54aac160a0db5bc5647a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873262, "uuid": "b919dac9-dbb3-412e-87aa-7c7fbb044dbe", "comment": "Malware payload", "value": "d7f21150886e107756aa3085c7f6939613fdf4f4211466da2c9bf8561327df98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873262, "uuid": "1c89dd5d-0122-44a6-a04b-a2982d982499", "comment": "Malware payload", "value": "8e5404feff5662dcdbb19df4fbeb9e5e08ac7195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873262, "uuid": "71475cde-2da4-4cca-8ddc-ad07baf02710", "comment": "Malware payload", "value": "8235c4ed636985c69cd593aa62c15e444b11fc9e55247f9f87da6955990a3d4f5683101e0ff6a829f358b3ba5f77edee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873262, "uuid": "b155a6c2-ad21-4f39-87de-4d3d03076e31", "value": "T1F7441252D2D08479E062DFB11C735029DF337F622C78246931AD9D4EAF3B9D6A40E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873262, "uuid": "673031d6-b075-4080-b2b4-978440d93213", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873262, "uuid": "60e5a890-c67a-4e3e-9680-00939b0cfedb", "value": "6144:y/na4SodPuC084/uC3wOaIxaxi5ClBAttK3i8rdX5IsH3k4B:6naHodGmC3+i56At43p16s04B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873262, "uuid": "fd264ee3-4e6f-40b0-bcd7-3d2e35e34fcd", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873262, "uuid": "5333a8b3-2728-4d6c-b2c2-1d9b46103f57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873262, "uuid": "bafff208-29ca-4f6b-a493-13f1606b21a2", "value": "SecuriteInfo.com.Win32.Malware-gen.55.21398", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309ab992-9da1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702902612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902612, "uuid": "5276f659-531c-40fc-b1a5-74f5a0b29a7a", "comment": "Malware payload (Socks5Systemz)", "value": "6b8ddbac4e5ffc9db3f78ba89b6041ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902612, "uuid": "4ef80943-e1a9-49dd-a074-3a347ea30d82", "comment": "Malware payload (Socks5Systemz)", "value": "daf509b87e48e580e61942ee42b9b7c99f5eb09656f1f02c8bb25bdb862b4c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902612, "uuid": "7098c766-4ec2-42a1-9561-c2707fa9a84c", "comment": "Malware payload (Socks5Systemz)", "value": "ec3b7ac6c40caf09c691ec821fe1a01364f15817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702902612, "uuid": "5d207d84-ba95-45c6-857e-05726221da97", "comment": "Malware payload (Socks5Systemz)", "value": "7613c18dcfe7bf42884766a7121139c892def7bf6d6263fb3b26f0768e32ae58731703cc32a373f22954466f9e4f0cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902612, "uuid": "7ac972c6-497a-4893-a653-b3966ff7c6fe", "value": "T179542A5383E57D94EA264B729E2EC6F8B71EF5508F59376E2219AE1F04B04B2C1B3710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902612, "uuid": "eb14507e-43fc-46d8-8fbd-c64f226477a3", "value": "e0dc07002fbf5e2ad2a1116b5c525f81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902612, "uuid": "afbcd046-6171-4ea9-982b-b201e3f85d1d", "value": "3072:AqepL/2nrLwrHFDhAzhczUMHJDdEN0uChZ/Zv5gAXZd5K8ez46du8HVkO7:AqepLur0rHFFNpDdMiZ/BEVNu8HV/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702902612, "uuid": "96814591-c80e-4580-8248-99ddc44ec038", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702902612, "uuid": "fef1818a-54c7-4e2c-8db4-c94442ec3587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702902612, "uuid": "132dcdea-42c3-4ed2-8a0d-20cab17f348e", "value": "6b8ddbac4e5ffc9db3f78ba89b6041ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ab538c-9dc7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1702919109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919109, "uuid": "b21cc2a2-1b26-4c08-9651-4d38b127aa39", "comment": "Malware payload (Pikabot)", "value": "90fdbeebf32be11c8795af19815bbd83", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919109, "uuid": "5fb7198a-0f84-4458-b49b-3185b22b8925", "comment": "Malware payload (Pikabot)", "value": "dbac385861b0ad73cf2839b1789f7fecd166be170538d3788c7e32d06b1e22a8", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919109, "uuid": "633b5d14-8a18-433a-b3fa-610d6aa9f2ae", "comment": "Malware payload (Pikabot)", "value": "e4247ab7f00f3ba62d97613d43e71f5cd4b29a06", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702919109, "uuid": "f152ba50-aadd-400e-aa48-ecc7d379193a", "comment": "Malware payload (Pikabot)", "value": "a74291f480091f5940f827ce947423a31c61579cf2b2119820e454b87a45f4c0e90d434d864c73ea7ef19a3161851033", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919109, "uuid": "3f609086-c05a-4b35-8517-d2dcd1b6c7ea", "value": "T1ECB312F01CDA58F5672E361A649A4B8013852189740669AC53FE82B06FBEC5F3FD3DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919109, "uuid": "08288978-0a27-4074-af46-79d3e2f39a36", "value": "1536:w2LMfbIL5ObUnxxQmaJXpxrTSncT61/fp+/Z7cNd7mrtTanmw+oD9ssf3N:FQfw+oQmMhT9T64amw+oD2s/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702919109, "uuid": "5ae9193a-4529-49ec-af76-a17e42f68955", "value": 110907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702919109, "uuid": "b4f8b588-ab5b-4ef3-8e11-ad893e0d3d46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702919109, "uuid": "377844a5-7d80-493b-8f8f-86da90858727", "value": "GMA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b79961-9dca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702920502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920502, "uuid": "2894d594-c82c-4d02-848f-1e5d69584d4a", "comment": "Malware payload (zgRAT)", "value": "55b2683198df5ccb9f1abe080dde6519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920502, "uuid": "50e82ae5-281b-4781-be05-82d8d62002b4", "comment": "Malware payload (zgRAT)", "value": "dce0b953b9201d59cd92a30bce45190f9c763690a09a7a279024d8cf4b8ce171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920502, "uuid": "a1b72acc-326a-4b6c-aee1-3a31efeffba6", "comment": "Malware payload (zgRAT)", "value": "2af89a1481476946f0e6666399b8183efe72c4cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920502, "uuid": "aaeb6df5-ac9c-47ec-a6a5-b33ff40fa243", "comment": "Malware payload (zgRAT)", "value": "01dfb443a443b23929ef2458f5c51c4b8648cb454af0e7917a1d2408a565a43853de6edeecccf38682f11a287467575f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920502, "uuid": "d899882a-5ef3-4aaa-a2c7-ac19a86cec72", "value": "T149B25A5A7A4F3621E62BC73EF863E4504FABE9464913C66F705B0397081339FEE46912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920502, "uuid": "e90e4100-1cf4-4319-8d79-31b3bbb55a78", "value": "384:u/eolrxBYQD7eJvamAFZ5aMNlG6PRewOrAWb7yR8zfVET1mANNwhpm8:Wl9aQ/eJvWn2AWb7yqAzkQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920502, "uuid": "637c4bb0-1535-4976-8ece-90bb0d0162e3", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920502, "uuid": "d83d235e-29e7-4565-af14-233ea2cfb51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920502, "uuid": "4ae89071-b7cf-4e86-adb8-4e9b7484d80e", "value": "Purchase Order Number 2312001458.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3c655b-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889482, "uuid": "0852aae9-e7b9-4f56-ab19-c87a3024c12f", "comment": "Malware payload (Formbook)", "value": "f7bf488b2d9b7b098475ef3e91363da1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889482, "uuid": "d7b698cf-8c9d-4940-a2a2-8c2ee9390722", "comment": "Malware payload (Formbook)", "value": "dcecacb443e9c0b8b94a6ed95253bfbf184488b23a9f28eb2b4a24ff8de3ffea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889482, "uuid": "4de67730-be89-436e-8d24-57a224d663fc", "comment": "Malware payload (Formbook)", "value": "7855ee55b77004584de0ca3af59462bf5544474b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889482, "uuid": "d7e15d22-d654-4a25-b216-65077206b0f7", "comment": "Malware payload (Formbook)", "value": "4c46e34e771e4ff347831839937029dbba4ea73e464968ac610e4de72878e04e0653f8494c041ece6f0077c50d25a612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889482, "uuid": "64c4f74f-a588-42d8-9fe6-7dc7d73dd4c9", "value": "T1C5D4C078E4B5657FE1EF90728D51F3EAB23220533702EA5ADC84D160741E9DB8EC48E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889482, "uuid": "78ca66ca-333c-4c7d-9bd5-2c89506e7996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889482, "uuid": "040b28a3-b566-4c8f-9372-5606a7a9235d", "value": "12288:58r88ssKHjdNVdeOCsbmVxuXkB3jIIrQiQRZJsjbo3K25s:ZjnZ/vCq6oUZMJyjkns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889482, "uuid": "7f5bd6b9-67bd-422c-928c-52416285dfbd", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889482, "uuid": "ec099095-0dbb-4e34-829c-a41333f1e9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889482, "uuid": "a5d28542-af55-474b-8051-09e9c8f597de", "value": "EFT INV HST-859 BL-07585900[1139360] Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabe588f-9d62-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702875759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875759, "uuid": "03eef912-b9e3-4ac4-9a17-893023f004ac", "comment": "Malware payload (Mirai)", "value": "cd645cd6542521bf76b2cffde10abb6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875759, "uuid": "c741d0ad-053e-4b25-b653-9c25c9b2cd54", "comment": "Malware payload (Mirai)", "value": "dedd0ec13beb2038fdc649584e8505c95bc7e342003023218bd2299d82bafeaf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875759, "uuid": "58a10f9e-9359-4f80-8ce6-0d718c96b08c", "comment": "Malware payload (Mirai)", "value": "e56b070cf5a1650d1064b6d589aa25dda2de5e18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875759, "uuid": "7db363aa-87f1-4b54-958b-26ae6faa027b", "comment": "Malware payload (Mirai)", "value": "e4b9d467314939bb9a7272b79ed040d514bf13438d16f41e9d8c2aed08e174e63771fe412a24121217c4f30d514c4709", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875759, "uuid": "37da372c-65b1-496d-9692-f08f14da90e4", "value": "T186833A85BD819613C6D022B7FB5E428D332653A8D3EE33079D266F20378B82F0E67655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875759, "uuid": "32598722-f86a-480b-837d-b06c417c4199", "value": "1536:nqa0/MNCmk+eVOGNqA54fjC1X2XWO4RQOeiU5duIncDjd:nqaZNJn/fjC1mhhiUvmjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702875759, "uuid": "2bf2e4d6-90da-4b0e-81f4-4db1827848a3", "value": 84184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702875759, "uuid": "6e40f548-7694-4416-a273-f061c2dfea11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875759, "uuid": "40b059c5-63b3-471f-a6bf-e8f07aa26baa", "value": "nig.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152be44c-9dfe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702942509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942509, "uuid": "8675b78d-5a87-4685-96ec-b8690a482957", "comment": "Malware payload (Socks5Systemz)", "value": "b333502d7915bbd0911087435549fd31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942509, "uuid": "4bc3cbac-ef1f-4ae7-b2ed-8772ec0073d3", "comment": "Malware payload (Socks5Systemz)", "value": "df09728a6383db0b8bb9f28a04ccd0c358e3f525c1d340c94d481fe8c97b4adb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942509, "uuid": "f32e9e09-5b22-469c-9f91-38a7cc49b1c6", "comment": "Malware payload (Socks5Systemz)", "value": "b450eb89d7ea250547333228e6820a52f22babb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702942509, "uuid": "e917fe23-2142-4e83-bace-9292e160eaa5", "comment": "Malware payload (Socks5Systemz)", "value": "4bd0fd85f9fec7d464c4150fcab5e73a34d079c345805937c376d373a080daa366af9a76514f37ca17f366c31af1a726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942509, "uuid": "1764e411-4f44-4357-aa77-e941cce14639", "value": "T10BF2D08A1C219A78FE1542F7169C8FD4533DD8CB61F3AF4D4A36893764CB7B482342A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942509, "uuid": "5c2b7cd8-1e13-48b5-b8fc-f68d53ca1227", "value": "768:3E45SLnQpEhOB/hAGflc5xOXhr7gvexzv36:3E4EqEhOPNfqStgvexzv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702942509, "uuid": "95099a61-750a-4632-8fbb-4c91e6c19adf", "value": 37490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702942509, "uuid": "d64eff00-0dd9-46b3-8a67-031f594b83a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702942509, "uuid": "82e12235-ef4c-4539-8ef3-11138036e1f5", "value": "b333502d7915bbd0911087435549fd31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7ff221-9df8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702940317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940317, "uuid": "9d4e0765-807d-4a3b-930b-e994599b7282", "comment": "Malware payload", "value": "e29e2a43de1978c3dd5224f84d5a6dc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940317, "uuid": "02478314-454d-4b29-9db1-f7d80f0dd038", "comment": "Malware payload", "value": "dfd7d6ed753ec58f05c27ebc97c41ef7826a4dd518d3ea545e56ef83b0bae58f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940317, "uuid": "7d77c3b8-08ae-421b-8e9e-bbab03cc01e3", "comment": "Malware payload", "value": "99dc6c9892ef2ad54485315158618c108830cf4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702940317, "uuid": "5ebd88ab-454d-479d-843c-2cf8df34c1f4", "comment": "Malware payload", "value": "9b10dfd3f082ba9c78384163081c744ad17db6e6f0ab1aa396f85ab6c8f61efc06db0804b2e9e77037bc62a0793184c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940317, "uuid": "730a3e56-1e4d-48b1-98ec-946124e40b06", "value": "T10D032A4D7BE18168C5FD0A7B06B2D422077AE04B6D23D91E8EF5649A37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940317, "uuid": "83a60527-5155-40e8-8f38-89d29bd2148d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940317, "uuid": "2aabc68d-18e8-418d-84f3-bca347b811a3", "value": "384:pDKbZ7LsikL9zNf/1uyU7LMvrBs2sfarAF+rMRTyN/0L+EcoinblneHQM3epzXxy:MbBml1lU7LMVFsSrM+rMRa8NufP+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702940317, "uuid": "e54962c3-147a-47dd-98cb-4150216a3623", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702940317, "uuid": "d8c43429-cd3d-4a2d-a044-846f1a80a033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702940317, "uuid": "f35382e0-22e5-4632-97a4-bff2a7d32844", "value": "e29e2a43de1978c3dd5224f84d5a6dc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d88f9f-9de2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702930800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702930800, "uuid": "63f1110a-e940-4a47-99da-309c8fcaf427", "comment": "Malware payload", "value": "811fd3065e4cf3a00c379176baa36623", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702930800, "uuid": "1c701db2-c692-41ea-873d-8f07acb1dfa5", "comment": "Malware payload", "value": "e06ab88a57c9fb5c32a12cdfcfc4945f00f4992cf715b1ef051835f39d1ff6d1", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702930800, "uuid": "b4ed4a68-a8fe-4ee0-b0be-ac60bf90a901", "comment": "Malware payload", "value": "284c6e959c0368e62e7a730fc3fe0cf1df6a61f5", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702930800, "uuid": "3b4e0733-7f96-4d8f-9485-053d2ca6f685", "comment": "Malware payload", "value": "1bd2ab85af1614fb7fbcd13aa1d714d06e5608915162d975c5cba9c7fbf6812c6c58efeeb2e5e4fa70dda15cbe03a020", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702930800, "uuid": "14d3881c-9ee7-4d2b-8241-a3a3807983e1", "value": "T13F23F118C36C213CC5C3483E61E56FD0EA1C9315D245955B54289BEAEBA03EB277BFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702930800, "uuid": "302a3c4d-918a-4d2b-bef6-894f56213a33", "value": "768:BB7RlspPS3yiJLwgqd+k+wRaNKk9oY0jysnamfys8RGkDrLfxl1x:BFYiypdV+3Ak+XN+4SLfxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702930800, "uuid": "54a81972-2cf3-40f1-9988-d579bfa3d262", "value": 48164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702930800, "uuid": "8990ae8d-6079-4eec-9cb7-a0ce6f103c5e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702930800, "uuid": "8578c759-0d27-494d-a0b1-6e514f2273f5", "value": "Normal.dotm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880955d1-9db8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702912637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912637, "uuid": "79a3db18-802a-4b91-9778-e50ebde0183b", "comment": "Malware payload (AgentTesla)", "value": "c29abab6768852ca893ad2ddf7243e40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912637, "uuid": "2e784f18-7073-4eda-b5d6-c4f324333e6a", "comment": "Malware payload (AgentTesla)", "value": "e0b8c5c5f1fcfd52dffabc78f9ce5dedc8598ec30736ec30308cf5b2d4dc4801", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912637, "uuid": "3415089e-f906-43ec-8f01-4136ab9c0ce4", "comment": "Malware payload (AgentTesla)", "value": "eedb50fc8f501104eb81f2389994b79c7c6e1c98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702912637, "uuid": "93360e9b-361f-46e2-b9f9-9f76e34c51f1", "comment": "Malware payload (AgentTesla)", "value": "ff04fb9738cf24fcf84cebe2e4d3ed477cccdf34c0af5a5e090a321f4b72930b72efdc4f9c61698ddcc13abb63004834", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912637, "uuid": "72d050e9-78b9-4601-ac03-bcddbc24965c", "value": "T10F15F43C48BE223BD6B5C6B5CBEC8827F05CA46F3150AD6594DBC3A653C694274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912637, "uuid": "c7e65402-746d-4785-9af8-e3b9e93e3e5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912637, "uuid": "24bb2f19-6cc4-4299-8fff-375d8c3d3191", "value": "12288:rBwEx2iNC9iugguqTDrFU+Mu134WMtgSKzaUQiJL:lwk1E9icuqTHyu1IDa3zsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702912637, "uuid": "51c93897-892d-41d0-a359-e9d1eb891adf", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702912637, "uuid": "b6cf4949-7f8b-46d1-b6a3-d623c47d4b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702912637, "uuid": "c2378ac8-96b0-496e-851c-f68a0385f157", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa90abe5-9d71-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702882201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882201, "uuid": "ab2ee351-3bea-479c-90eb-9f964a246a7a", "comment": "Malware payload (Formbook)", "value": "b929987be980a33c1dfab05c03cbe15b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882201, "uuid": "4a98c865-8e07-4b38-a6eb-b96a2cc0263d", "comment": "Malware payload (Formbook)", "value": "e43c5c967a283769aca8d70f96608f6417f922cd1a9c924f7729c919a556a073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882201, "uuid": "4e22c347-e3be-4bd9-a1cf-d472bbc937e7", "comment": "Malware payload (Formbook)", "value": "3c731ddcad6b33f0788e76abfccf25094490072b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702882201, "uuid": "89efa9aa-ce39-4ae9-bc4a-cb90de04d14f", "comment": "Malware payload (Formbook)", "value": "b1e325f175a60d7538e5c8766d85862404b8597851221ac11c6038c1b1855f0ee06a0cf33199b05d0e4b84c50cbc6a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882201, "uuid": "5aac2abc-e632-41ee-9061-42402e48aeee", "value": "T1CB05D33C49BE223B96B5C6A5CBEC8827F05CA46F3150AD7594DBC36253C6E4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882201, "uuid": "66e261a2-1afa-4cc0-bd53-129b32dbabd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882201, "uuid": "816f910a-9fa7-4c77-bb53-850fbdff74a4", "value": "12288:Q5nl7IdyM0QQkHhsjU06kiF74wqx3EL9fDAiB7xJ/lXXsekL2O1wvj:0lEdl3h+KBN4wE3ELlDhB5X2PA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702882201, "uuid": "0b07c865-59be-4940-830c-e9d19e53e0fa", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702882201, "uuid": "f307f64b-34fd-4f42-91be-3fcb2be17b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702882201, "uuid": "fb8a6c7f-6d95-45c1-b816-9728a9d567a0", "value": "\u041a\u0412\u0418\u0422\u0410\u041d\u0426\u0418\u042f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a080e349-9d93-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702896787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896787, "uuid": "fb8f07f7-b5c7-436d-8322-d819e82169e1", "comment": "Malware payload (AgentTesla)", "value": "f1f09a45cf1d5bebaac7d3c44821bbf1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896787, "uuid": "5ed6a474-f669-4236-bf50-f11ae38e4c5d", "comment": "Malware payload (AgentTesla)", "value": "e586364d2f3a4cda35c4b5a80a2650a719f0358f08853be35cdc467580a94ff1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896787, "uuid": "ccc4a4a7-e0f7-4fa5-a4a5-e48bb1915fdb", "comment": "Malware payload (AgentTesla)", "value": "43aff8a2fe9e809ed22fadba74b3a7a816e8c71f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702896787, "uuid": "1883f2f2-afd8-487f-8cb3-21ed0d009db6", "comment": "Malware payload (AgentTesla)", "value": "2bf6a12d16f7f4e4f130a0bc690d5c3f697787fbd7573e115f66e3b5b5fe85c9478da206285586f936f6987d7f87c857", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896787, "uuid": "1989877b-ddc0-4e8a-951f-44c21775ec1e", "value": "T12CD4231B74947AC417029B8A3D28FB2FA1DA0742D750F88D2064757722AFE3F229DF65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896787, "uuid": "cebb3d12-8281-4a0e-b647-026743d09d06", "value": "12288:ON7Nx4eGaPqkJRpgxVw//Guz/gPwHkfGMVAEZVH1eM74MvU:ONz4eNfRpg7w//GuDgQKG8bZVVfEMvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702896787, "uuid": "32647806-76ab-46ff-8fd2-452a4b845ae4", "value": 613786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702896787, "uuid": "2f67ee07-9e3c-4bfb-b529-15f6724c5811", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702896787, "uuid": "7bd43822-a477-47e1-8d9b-87f1c69a214c", "value": "\u3010PI202211385\u3011in US dollars.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7719f83e-9da9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702906166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906166, "uuid": "423ab487-e3d7-439a-9862-07bd18d0f081", "comment": "Malware payload (AgentTesla)", "value": "03325fa2f8f7af9148a1fe6ad95a3a35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906166, "uuid": "1c36b784-1a5f-4b42-bf13-df57dfb52669", "comment": "Malware payload (AgentTesla)", "value": "e5ba53de1a80eda27337da32ad9bf522473c542fc42a434fff3fc843cbdf88ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906166, "uuid": "ac76ac50-79e3-4026-8991-35b65c44c7ed", "comment": "Malware payload (AgentTesla)", "value": "e9f3548ed7c49887e7989c5e26ecda4d0b38e883", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702906166, "uuid": "ea0e0c30-11e1-45ee-bbc4-279fd17fd781", "comment": "Malware payload (AgentTesla)", "value": "93fc5085a1642d741b997869cbd5a8ed7033470fac930e0968dd80a134069881c1ddad061117e467293b2eb1c7aa2e34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906166, "uuid": "eb708b75-92b3-46c3-afeb-58f168f3d97a", "value": "T129453A88B10075DEC857CE36CA749C74AA213C7A532AD10F509739EBBA7E693DE141E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906166, "uuid": "6e5a46f0-8a93-4efe-bf9e-2b5b9092aa66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906166, "uuid": "9449abbc-66a0-49a5-8c2f-905373ca16de", "value": "24576:0mZ3quDY54sPHmI89yYBKhvcztYKxo1q:LZ3zDG4i89yYBK1USKxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702906166, "uuid": "ee759fa9-2875-40e4-a6a2-689fc1efad5b", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702906166, "uuid": "5af82f6e-bd32-489b-a00d-78d5297cedd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702906166, "uuid": "b850bdd1-b365-467d-ba7a-8e5260324ddf", "value": "SecuriteInfo.com.Variant.Ransom.Loki.16647.7173.27932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f7eda0-9d6d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702880213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880213, "uuid": "16704a84-e4e5-495a-8c51-561e2e309446", "comment": "Malware payload (RemcosRAT)", "value": "560a72cc78f999a503fd476bbc5b87cb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880213, "uuid": "bc0d9713-dee5-45a1-b498-8775f61376a8", "comment": "Malware payload (RemcosRAT)", "value": "e63c4cc9ebb0a91cde1762188deecc60c3fa5340d7ec967fb6b886ebdf574e94", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880213, "uuid": "58ee7c04-8984-40b3-ae09-19b387fb6915", "comment": "Malware payload (RemcosRAT)", "value": "34997980fe8319c9f54b8b320d28ca9b48de0b15", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880213, "uuid": "fc66ba70-5af9-46be-92a1-9603d2ce4f61", "comment": "Malware payload (RemcosRAT)", "value": "b0e1c3797fce2e50b9d7e1fd3c44be0025413bee4211d0720973d30452a3dc86ccc88413bd094caaf63688f4bc8395d0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880213, "uuid": "a8084e1c-c910-44fb-bfbd-547216408d84", "value": "T1DE34F000324CD898F28567FD79F2B18EA01CBD7339C662C7BA99B70F843AE6B5527405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880213, "uuid": "d4da310c-4861-4db2-a6ad-d301f569d544", "value": "6144:QuQ4YlLSmmeHZMhD6wM3XALQuE6cHV2+DvFSbrx/g0:QuWQmmme6v3QLQuE6K7FSbre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880213, "uuid": "f1e74986-ab7e-409c-887f-dea6bcf9a32b", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880213, "uuid": "68cdec40-0fa6-42e4-9487-22c365fcea54", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880213, "uuid": "521fe33b-0ad4-4aac-905d-6deb914b1702", "value": "Request for Quotation-V-40795.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc648f0-9dcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702921019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921019, "uuid": "32ce111e-e83f-404f-97e3-ac5c291b8e54", "comment": "Malware payload", "value": "57774186c59c24b051590bfa68ffdb58", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921019, "uuid": "945809cc-cadb-4d43-96a8-4ef371fd6b06", "comment": "Malware payload", "value": "e91ce8aba557078f7e914406c1ba224db9cf67c66ebfc97eed5c62d04957e0b1", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921019, "uuid": "c6cb1a2b-8095-43e4-8d7c-f6d80bdc7ec3", "comment": "Malware payload", "value": "38aab872ac2ce5604ec9911d9dd650a149fc6aff", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921019, "uuid": "56caa7b3-974d-4586-b8d2-e0785ff0fe13", "comment": "Malware payload", "value": "510bea739519d672efbaa749d7951a880dc9bc66d27350953024d8fe7fc3ed38b40c6de63b37b6cd9fd625cd66b711df", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921019, "uuid": "50ae99a0-7411-49cf-8e0c-c37ab90fd6f6", "value": "T1BC43F140FBE14F56E314A6F8D7E691BA3B07C8B406C02B8847CC2A6F5976D6D03075AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921019, "uuid": "ccb65279-c6f3-4482-b25c-d7385b17b1c1", "value": "1536:PPqTKC0Hhon5yAFriqoKW9n5P7SjoDHztOp8hbrBA:kn5NfoKW95Gj2TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921019, "uuid": "3dc2898e-0aa7-4c76-9aae-e384fefd2193", "value": 60480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921019, "uuid": "52709d3d-aa73-4bba-b15a-794cd3b87fa7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921019, "uuid": "cd024d89-01c0-4db2-a4d3-aa02bda0672e", "value": "PO.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85ebc84-9df2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1702937710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702937710, "uuid": "079f1c75-7029-46a7-b8f2-73334ab378aa", "comment": "Malware payload (RiseProStealer)", "value": "ac18ad4de0d70e7cbbfb829afea0dd45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702937710, "uuid": "784931f4-69a6-4df2-ae81-125a17034a0a", "comment": "Malware payload (RiseProStealer)", "value": "e96789d697301017c3c5f2332f7f74fd5aabbee70373e2d7af8c7ebd24ab22e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702937710, "uuid": "4b4b5c76-25eb-4e61-80cc-5de9a3f78f6e", "comment": "Malware payload (RiseProStealer)", "value": "81f3b5282d453b70724ffbe70e7298389dd1194c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702937710, "uuid": "46e4ca2f-5dd5-4a1c-b491-5c8c9630dba1", "comment": "Malware payload (RiseProStealer)", "value": "9f0e9fa05a082b618959b41c2b1f4534761d49ee395487fba3eb7699742b85837c6ec8d1096d06f72080f04a50ed8c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702937710, "uuid": "f67ee4b5-aded-4177-ae83-54eb8682d6bb", "value": "T18525221297E86877D4B127B42CF723530739BCA10C788A7F7656A4584C72AE8B07276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702937710, "uuid": "eb6afaa7-6066-4e03-95d6-323bb8df717f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702937710, "uuid": "a744136c-1b6f-487d-ae5a-0bbb160dfc62", "value": "24576:zy2I2Sr+pny1Aed6Dk9y6mEG0HqpNo1tUbJfk:G2I5Ked3nmDSTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702937710, "uuid": "8b992650-d21c-4b11-93e6-1b4300a19de9", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702937710, "uuid": "53233a32-59b6-479a-9c28-b881d172ede0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702937710, "uuid": "553f0a32-68bc-44ba-8a36-87be50dfd2de", "value": "ac18ad4de0d70e7cbbfb829afea0dd45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc554ea3-9d70-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702881855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881855, "uuid": "ef38e13d-d0a4-4769-a635-ec33b7b51ddf", "comment": "Malware payload (AgentTesla)", "value": "9b8a17fc843b9f389d377594cffb85df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881855, "uuid": "c41061af-930b-4d0f-ba88-72422eb5f4dd", "comment": "Malware payload (AgentTesla)", "value": "ea3574bfe04022edcc9d4383c01c90542d16b172662193af5d9daf968797dd04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881855, "uuid": "4a074f90-6609-4570-a188-4494d0f20940", "comment": "Malware payload (AgentTesla)", "value": "bd58477bf8b1dfc83c523ed3b5ddeaa60f4ec752", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702881855, "uuid": "00b2fb14-0e5d-4665-965c-f2334d639efa", "comment": "Malware payload (AgentTesla)", "value": "c9590cdb8996e362a07f9675abc8cfd02e5910789772c62a63f0d6ebed3472eca1e0cd267ed2563a6d8e8b03937077e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881855, "uuid": "37c17a48-9c69-4077-af04-9f3cc1ee64fe", "value": "T10505E33C49BE223B96B5C695CBEC8827F05CA46F3151AD7594DBC36243C6D8278E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881855, "uuid": "dd2d3b5b-d0ad-4638-a612-02d2d27a4bce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881855, "uuid": "7fe2fa83-e7e7-4d57-8798-50f25215fe18", "value": "12288:ZSTpstlWkkAQR+XbSvLsIx4cs1iz1Bz9Bom9nnEQ/3+Plnl2inIX3Pm6oAB6:Z4pi0AQRCbMsIxp1BpaSWN09PLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702881855, "uuid": "2d27ec08-fb89-4b64-b1c0-76facae6e080", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702881855, "uuid": "88ef9f7e-b0ea-406a-8596-4919fc51673b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702881855, "uuid": "6b88f2f1-88f0-4857-b8bd-8ac1a984c3da", "value": "PURCHASE ORDER.pdf_________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d08343e-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1702889480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889480, "uuid": "ab2c8dc0-8815-4806-85c3-6ba9c94298a4", "comment": "Malware payload (DarkCloud)", "value": "60a11df67d8506068e6140e73161a317", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889480, "uuid": "d3fe97e2-1ef4-4d33-925b-be5a5ef2d44f", "comment": "Malware payload (DarkCloud)", "value": "eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889480, "uuid": "64687443-8d96-4a09-8eda-0e84f6544369", "comment": "Malware payload (DarkCloud)", "value": "ce650743b66529854cd3f534cdf362e13b6a57d5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889480, "uuid": "a0613a37-a014-4af8-b75e-78bc05edd041", "comment": "Malware payload (DarkCloud)", "value": "519941edf77f08422beda168958b006d19e43c3cdf84cb6343a1757b5e3c9e2806721950f16ce4acf333bed73d425939", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889480, "uuid": "14481156-d79c-4dec-9aed-6689342d8a22", "value": "T193943A16E651202FF053C8B1EAD5A26BA8296D3A2588EC17F7819F0875315D7E8F133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889480, "uuid": "7a643032-d3c1-48a8-8062-5e2b46ad4dd1", "value": "966d9996c62d870333d6853769a84f18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889480, "uuid": "638cd577-f300-42fb-9d04-bd655d021a6c", "value": "12288:GdVkMuJ5ACU8299NlK7Fzpy/p2/TI8UjYKkJj6GmZU:iuJS+Fzpkp2/08qYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889480, "uuid": "15d02042-1244-472b-8701-f4e005aff28c", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889480, "uuid": "b46f6d9e-e11a-4871-8b73-f57175d70caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889480, "uuid": "5f8451e9-668e-4ab9-bbb3-485cbbfad757", "value": "eb00146f1e30a7554df65d0f1d5e6147d09fcdfeb5c9339202c39ae566b1b2ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d693a28a-9d5c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1702873255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873255, "uuid": "5f49b02c-77c5-4fb8-a9ae-e890b6474fb4", "comment": "Malware payload (Socks5Systemz)", "value": "83ab1e74c615ed9566771b5eaedecb67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873255, "uuid": "04c777a4-961b-4977-9e3b-4bc0d2ad9777", "comment": "Malware payload (Socks5Systemz)", "value": "ec517a03d7f696af138ba9ad32d91c2b1b916c08367edbfb38fb2183e9cc5686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873255, "uuid": "9a20df1f-9f10-4c41-9fec-7f0daa0ad9f2", "comment": "Malware payload (Socks5Systemz)", "value": "2a29afdbaebc685494072893056c42ba7f75bf21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702873255, "uuid": "9be6e2ec-f294-4892-9be1-6db2dfa22b03", "comment": "Malware payload (Socks5Systemz)", "value": "1ece4c4e94c33c7c0d05280ba186d7beaae6c0fd233a63db90c6f2661ccdd525e47311f88a282847d3f62caa4f205bb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873255, "uuid": "aafc6799-5821-4347-89bd-f28e5a28f240", "value": "T1476633D376F56812E1738AB95866D0584BF6CFD9042E30889E4F5C8E8B7F709893AF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873255, "uuid": "5bb850c6-3143-4eef-b28b-688980d25f4c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873255, "uuid": "ad1368b0-2a65-4bf6-b3c6-2c5a519047bc", "value": "196608:zHY3srNMVqtbLF3Npk+VLnikPQRqupe90bKF:jYeltbxXlniMhupe9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702873255, "uuid": "10bbc1b2-de7e-4048-bd68-3e99fc93e977", "value": 6742792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702873255, "uuid": "bc0f1a57-27e6-40ce-8d6d-c845052e7f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702873255, "uuid": "b94d17fa-b81b-4884-8b4f-0c3c3d45cce9", "value": "SecuriteInfo.com.Trojan.Siggen22.40921.24744.3496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20cd2e0-9d98-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702898964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898964, "uuid": "79003c96-2565-4dc0-b3a5-ad8027762162", "comment": "Malware payload (AgentTesla)", "value": "76011baf3a1ed67e55a01705828ad99a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898964, "uuid": "62677cb9-e148-4d48-9727-3ca4ff2ca802", "comment": "Malware payload (AgentTesla)", "value": "ee4ae0633d4f95d3611693174a516e4a4c20dddaafa737245fd8a7100a49b9e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898964, "uuid": "0d80b3b7-7e0e-4275-b61e-7f76154344ea", "comment": "Malware payload (AgentTesla)", "value": "67eeed3a9758683b9e5f1d4cf73b860102a7c35b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702898964, "uuid": "ebd05a9d-ebe1-43e4-bf21-a65b1f89fa7f", "comment": "Malware payload (AgentTesla)", "value": "9e487af718b29f576122ac8996d3ad7a59fabc5dfde57d581d7fbec767f5d62902e98127b175b10407b756e609969db8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898964, "uuid": "178f2da5-48a7-48dd-ab3e-0d0f4b76a364", "value": "T11F15A13C587D2237D5B5C7A58BDC8427F25CA46F3151ED6598DA83E603CAE4238E322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898964, "uuid": "fa879cc3-232b-4701-ae32-670e565f2b75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898964, "uuid": "4d531dc2-6845-49bc-b198-84eeacf9e822", "value": "12288:ZGXDY6t68ItmPrGO37JMLD+WaUVN02OeEc9TU3NIc9aDFsQDV:IzIbmPSOqD+Wan2BtFU8FsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702898964, "uuid": "e24b44bd-6d33-4125-80e7-7471477a88a5", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702898964, "uuid": "614b8064-4a88-4964-a9c2-e3c8e231d66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702898964, "uuid": "92be5998-840e-4768-8b54-0b11c68f814e", "value": "SecuriteInfo.com.Win32.PWSX-gen.13612.12304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a995e0f0-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889501, "uuid": "e5d4a02e-1330-4ef7-a4f6-1a2d2849a416", "comment": "Malware payload (Formbook)", "value": "1e16342a068b4e4ad6d2cf034e0a6071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889501, "uuid": "1416afcf-b13f-41ba-96f6-463117d9fb7c", "comment": "Malware payload (Formbook)", "value": "f03de9696694c012f89421f28a087a9ce5f67e4a7f4902d4111cb7d2758a2ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889501, "uuid": "1ef888d4-32ac-43c7-a0a4-8f2bc085e19c", "comment": "Malware payload (Formbook)", "value": "b7e768b5fbfb885315248ade9ca2f20d5769fcbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889501, "uuid": "6840bcdb-1bfe-4bc8-94aa-784bd2a99644", "comment": "Malware payload (Formbook)", "value": "01e92453d3d2e4e9cd35cfda6344bf94cfbbad11ef5a31c39f5de239d0fb707a8065e6529163078683bba35d1e8e5d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889501, "uuid": "5b1280a0-3674-4e06-8213-05b7e6338e03", "value": "T133E4229092ECCFE9D26697F81D61788253379C4F18A9DC540DEAB4C80A73F819271E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889501, "uuid": "76a6c039-a70c-4879-bc02-6c1cd69d4803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889501, "uuid": "836e500b-930c-4b7b-a923-9446d3ee6042", "value": "12288:92iNb0oLt0pMyMjI6RSX1TMC7iLvmU9yJXdZ7SEX2QxSqa7hxLCj6Vw:916gypZGI6R493XVdmwGdojWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889501, "uuid": "4488f03c-e89f-476e-aff3-8d6ed9e8dd74", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889501, "uuid": "eca6b630-a69d-4c87-8ebf-6862734d07dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889501, "uuid": "d6d28d57-c0f6-4bca-86aa-1a90bd7a8853", "value": "PO MNJ4828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add7ef1d-9d62-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702875764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875764, "uuid": "f7fd7ad8-083a-423b-a6d5-a17510dfeef0", "comment": "Malware payload (Mirai)", "value": "adf2849c40110514e1d4a50fe0d39f74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875764, "uuid": "387b0a33-a937-45c2-a347-0f9c22008265", "comment": "Malware payload (Mirai)", "value": "f1aed32a1ecb418f8320c133c1f8ca2f8375dc934f8de98594aa314bf7959fbd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875764, "uuid": "3e66c2bd-309f-4879-a9fb-0e0e5f710f18", "comment": "Malware payload (Mirai)", "value": "37d01f59daf5e73103354360adbf50639f45ac8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702875764, "uuid": "5bdca8a2-c43f-45d0-a5a9-5ea7579cf40a", "comment": "Malware payload (Mirai)", "value": "d327d7b9d90e5e64921d9b1eef0cf14cc2749d3ddb11e6114158569c4db19b3d00a5a90d9b356d69d3c7f8572a1b8460", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875764, "uuid": "ac477170-686e-4f50-b1e4-5a8955b4014b", "value": "T1F3931786B9818B11C5C512BAFE1E118E3313177CE3EE73139D246F24778A96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875764, "uuid": "6255a4a8-5928-4e94-9649-38ff6a436a3f", "value": "1536:oon8fDF8xoZKBUnmqgJRazzRvsa9S72gc/I3i25WHfQ1S73Z5XY6ae:eD2xlUmNRaXRvsa945WHfQ1SzZJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702875764, "uuid": "3d061721-22c8-4e3a-b1a2-a1957f7e067b", "value": 95700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702875764, "uuid": "58b281c0-43bf-498c-bea8-82c364c5d5e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702875764, "uuid": "17d840bc-f35d-48e5-94e5-78db15863709", "value": "nig.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a697e46-9d54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702869638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869638, "uuid": "23db5406-4120-4199-922c-c345f0d024b7", "comment": "Malware payload (Formbook)", "value": "d8991deab1bba4cc40d36a1475a2a1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869638, "uuid": "51851c5c-6d7d-4180-b217-6732b36d6a86", "comment": "Malware payload (Formbook)", "value": "f22dc835d2b201dc613f7f673a0a5b606f3c43e967cca82b5093267f56ca9a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869638, "uuid": "938e9512-ca4f-4d60-945e-da2f62bbfbfc", "comment": "Malware payload (Formbook)", "value": "864186fe32ac6110e64247854a7a8b9ba5769c9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869638, "uuid": "5f0925cf-51d9-4dec-926a-29f8c4358036", "comment": "Malware payload (Formbook)", "value": "6617218e84e40a367350fd8b448c6f2e8df8201bae3d12ac21c302873c208aacecdc588e8ee3f22374bd2a2cf0e18bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869638, "uuid": "5e280b01-dddf-411b-8fda-a3692501c547", "value": "T16FF36C1174C08072E577153219F4DAB06E3EFE714FA25EDFAB840B6E4F312C19635A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869638, "uuid": "e06c249a-4710-4547-a46b-8dd4600b92b4", "value": "7b84262346ae10fcd5a6070d7504e7f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869638, "uuid": "74d60fca-6d99-4d18-9684-14f10f7c5aab", "value": "3072:P9JcnxhiBoyRZxhoSXMJSZPk84KA51Q3acyAP2HZKXEr+VZeO7sU2JAu6y:P9JcnxqzDxho1SZk731RcTPgZXO7sU2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702869638, "uuid": "443ba21b-63a0-4fb5-8f44-2550730ded3e", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702869638, "uuid": "1fdb3e20-9e2d-4be3-985a-249fdda14283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869638, "uuid": "d4978613-e0df-4f29-bec1-22e1aac01e72", "value": "SecuriteInfo.com.Win32.TrojanX-gen.11904.22422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95721f27-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702889467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889467, "uuid": "ede48bed-5e57-42ca-91c7-734e0fcc437c", "comment": "Malware payload (AgentTesla)", "value": "0fa18af06a30d2ecde67a147f27b7d08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889467, "uuid": "394d320a-3d74-4adb-b646-688257b94bed", "comment": "Malware payload (AgentTesla)", "value": "f389fb6cbeab6ca68e33d0de1b74579618493de6f42a0b8a159442cd84732ebd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889467, "uuid": "2bfcef61-8513-4fbd-be05-63d2d1325821", "comment": "Malware payload (AgentTesla)", "value": "793fabe134d423ff7946098e659992f5b1826306", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889467, "uuid": "a3c810aa-f05f-4bca-a13c-f3bb613e30f9", "comment": "Malware payload (AgentTesla)", "value": "30853c109602ff7d2d383ee6a0520f3545aa79834fcf5f9f59ccea8d30f52a6fd348a5324b38965dcfbd09e44f92bf03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889467, "uuid": "1d5d6240-7410-47f5-ba09-33fd64e98d25", "value": "T18FF4CF5823644A9FC7D96B35E9B353020322EA7F6113D32793D42039A46F7FE1BA1762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889467, "uuid": "5629cf21-4030-4be8-b4b7-61bab45cd5b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889467, "uuid": "93b40349-33d3-4fc5-85fe-a9a6054f4a36", "value": "12288:rulRhY8J9nsHBJVV/R0oDqo29178iN1uHBvYtAazWi/Ira0du:ay8J5CBXFRlVu5j2Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889467, "uuid": "7129ada6-72ef-4f36-b0ba-47670fd33f8a", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889467, "uuid": "da943a6e-bcf0-4c95-b944-e96011f61194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889467, "uuid": "37e73514-50bd-4ad6-bbbc-d2ea23c2abd1", "value": "Bank_Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1590250-9dc9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702920008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920008, "uuid": "b71fa6ad-f8c9-4396-903b-36f66f3421f1", "comment": "Malware payload (zgRAT)", "value": "e1f3ae947a883a7b5d6888a7b94bba93", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920008, "uuid": "195a070f-20d0-4408-8ecd-916dcfab0702", "comment": "Malware payload (zgRAT)", "value": "f3a04c649958b58bc5742cffe7cede8c2e772d6999dd513de7857d3289fd2c37", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920008, "uuid": "d5f51931-228b-439b-915a-bad1d5e752c8", "comment": "Malware payload (zgRAT)", "value": "450f8f681a97fdadc7c6198688edf5c73205daef", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702920008, "uuid": "1232eb6c-461b-450a-9054-c4846b2cd276", "comment": "Malware payload (zgRAT)", "value": "b0b55950b2603e415d5d1b252c0f17ff67c335672c3f46f77c464fd0ea6ac646b8f2e8290f4f8c4ece80193a5475eee5", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920008, "uuid": "558ab195-8b03-49f8-b966-569f3d799a1b", "value": "T19034F0B9B96CB94BF6C94A3780578CBEC71D3720C4742485CE228DCAB97310ACFB1852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920008, "uuid": "7fd9c154-4e1f-4c82-8247-485d3bdc2e77", "value": "768:MJxJpMv1WnUSJopKRT7ovmEMkskiLMowyhqKlPA7ezQOGMm:MJxJpMtooI9kvbo/fwT4dRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702920008, "uuid": "454be67b-9e2b-4077-a6db-f5beab91f9e0", "value": 234600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702920008, "uuid": "903bb651-1373-4795-9c67-201dc037b7ea", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702920008, "uuid": "96d3cd54-bcd1-489b-b12e-dc8dae17c98c", "value": "RFQ_95100000006321000001110.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf65347-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702908830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908830, "uuid": "85cb6692-1ce0-46ce-9336-271ef6877f98", "comment": "Malware payload (AgentTesla)", "value": "bdefc3724ecd84f1f0731dd0b3b4c5c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908830, "uuid": "56c2baee-9b5c-4bef-aafe-68d534914880", "comment": "Malware payload (AgentTesla)", "value": "f60ddd273d6b6611e0ef184330464084062dfee927af24acba40ffc08fcbef89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908830, "uuid": "176d5544-ead2-47d1-973e-2bfefb026cf6", "comment": "Malware payload (AgentTesla)", "value": "ace186651d77a3ed9382b1b43ed9e81644b67762", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908830, "uuid": "d57453fb-4b8f-4ec4-a78e-1124da4baa13", "comment": "Malware payload (AgentTesla)", "value": "ac1995d37b31d05963fdd34b1d5d922ce94e42321a3aa3463ba045e43d832c81e127925edf1c25d2597ca2e4cd4d7c62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908830, "uuid": "e88e24bd-a74d-413e-927d-58f064167726", "value": "T18FD423E6923E071193428C1408D9D52E9C6B6FA3DD0D3FEC4A925CB6BD14F291DF9B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908830, "uuid": "bd39c65b-5245-4be1-8aa4-6e943af7773e", "value": "12288:Q9dV0TfdLQZHrat7/XFb9KaNB92o//RTkAVW7QDEGJIMA2Pa6R8wTg3ndA:QCTlLQZHrGVxfnWP+xIMB8mGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908830, "uuid": "16d5ce51-f227-4173-b3a8-51ce26490a68", "value": 618720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908830, "uuid": "7512add0-97a3-4f1a-b727-7c252c516b93", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908830, "uuid": "dad1ca72-dcbe-43d4-ace1-c33d73be8053", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24a5bc3-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1702880039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880039, "uuid": "a8271b5b-05ab-4ec0-877c-62f70cdfad94", "comment": "Malware payload (RiseProStealer)", "value": "59f2907b1a5ef0740d58b0764c692842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880039, "uuid": "b039587d-09a3-4546-9adf-788861fa9be2", "comment": "Malware payload (RiseProStealer)", "value": "f71e73ec270c6c193dfa492a94c8ff17f70259a64a68f56f9f2a5a7c5b83a008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880039, "uuid": "c52105d2-321e-467c-9f11-9558b845a862", "comment": "Malware payload (RiseProStealer)", "value": "ba0fc71436f29dfdf2d938a4d6c74f5cb9633b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880039, "uuid": "1ca7601e-fd4b-47ff-a238-50613e2f08b4", "comment": "Malware payload (RiseProStealer)", "value": "40b5f04661d5f192d92241fb0a0547c29226d0b4cf3dfea2628f10ba49f4ff48d49584e2da4b721d22b88ed8ce40e4de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880039, "uuid": "322d3a4a-4593-43d2-a2c5-f6d645cc5bf3", "value": "T16E25121122D041B6E2235676597AC1B41B1BBC669F622FCF2BCA563F0F345D2CAB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880039, "uuid": "eaed7f57-0a9f-4448-ae22-1d13967ee743", "value": "5e8686e70ea4bdd5e81bbb9e77bbf42d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880039, "uuid": "ed79ae63-516d-4e08-9025-e79c790a5ae7", "value": "24576:uaFmfjAlUxVeYX9pMPe/2FCEdwj9+xgGZiPg7kf+xCBZPgP+6iPUAQvYnUUhx:5mrAKVX9CKjYxXiI7kfSCBZYWVUxYnzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880039, "uuid": "9d79c3bf-edf2-451d-a95d-1c36dc814f0c", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880039, "uuid": "a9e196b3-0959-4896-974b-322dcc8722cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880039, "uuid": "e3e4f5f3-d44a-4f80-b067-2168f5258dab", "value": "59f2907b1a5ef0740d58b0764c692842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a2d06c-9dd3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1702924208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702924208, "uuid": "6190f2f1-6406-4ddb-a42a-0f15e44c94a8", "comment": "Malware payload (RiseProStealer)", "value": "c0061cc9028a73844f3121fe399ad621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702924208, "uuid": "0c268f34-1616-4343-b9fb-90fec2e89f1f", "comment": "Malware payload (RiseProStealer)", "value": "f782933fb6a551cd97aabaf041ce9521694203199fe8a62efdfdd9dda00548e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702924208, "uuid": "d3e0570c-7744-4834-98f9-1cdbb6085f6a", "comment": "Malware payload (RiseProStealer)", "value": "8ffa300ebca3ad064d99b590956be68703b8dcc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702924208, "uuid": "057723de-1f5e-4d82-a79b-a62d09b995a0", "comment": "Malware payload (RiseProStealer)", "value": "4d888c6656227181cc6c7a7d31830b6c5da5d9fc926e8dbe0a6cb1c6ddb2b11570d22976102f3564805839997a6a23c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702924208, "uuid": "98aedc68-cc86-4ddb-8a67-69e496cf2f2c", "value": "T17A252303A9E180B7E8B427B135F717871A323CB648348B27239AA6651C737A5793177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702924208, "uuid": "3c542b34-2508-4bb7-bbf5-f7440cb52f5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702924208, "uuid": "a31dbbd4-baf2-4248-b18f-3c8a7f3d4a19", "value": "12288:JMrGy90p8E2wB06puJG1TP/XtLgM0VCND/4BW9whUI/l+22w2Z4pTqUt/ZacIa9s:DyU92wAJuLDd/4k9X29yZCT4cz2mur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702924208, "uuid": "1a1faa04-a85a-4e85-a055-b14edec44c06", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702924208, "uuid": "6d193003-05ab-470a-9582-b3807ecc10a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702924208, "uuid": "f680239d-e25b-4039-a4af-52e01aa28c12", "value": "c0061cc9028a73844f3121fe399ad621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b875ba-9d9c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702900418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702900418, "uuid": "3c855c8a-897d-45fa-aefe-8cd9eb589265", "comment": "Malware payload (AgentTesla)", "value": "602586797314cb256c9588bd12606a18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702900418, "uuid": "a2255b8f-c0a2-4919-b93c-4ce39b71dea0", "comment": "Malware payload (AgentTesla)", "value": "f7a5e844ed82169ead7a0a1cfa698320fb2aee3497926548619c1ed4d0a63dbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702900418, "uuid": "7f7c5485-8163-483b-9a08-da1b2dc2c342", "comment": "Malware payload (AgentTesla)", "value": "9693cd2a9b5d1780e7764f4200af72072d2580fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702900418, "uuid": "1ec8004b-5d31-4315-bbc6-5288b778e14f", "comment": "Malware payload (AgentTesla)", "value": "0a932e2b22345379a9c237adaeff5abd6f1fd88cbd5d849eba423afc745ce3f7a7b571231ad7a31ebde111355d62d21a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702900418, "uuid": "2a3a7533-0d8f-4ab5-bf4e-7abf16565ca4", "value": "T106C423C33C36FDDF064FE7C9363D46E762505EE10E096A8923BF20946EE365D659420A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702900418, "uuid": "8359d8b7-7d5e-42e2-92c3-0fc65761d9e8", "value": "12288:IQ8claChqfUxotskSiwzMDjnes3tmSPHzEAt8F90O2yOhuCnWL2/:IVGaChGfVwzM+s3NEAtu9f2yQb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702900418, "uuid": "08adf501-2ca0-47d2-9b5b-b6fc679d3b67", "value": 596828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702900418, "uuid": "f9e7a506-e9d2-46a1-a7cf-a5b98b6d7bb3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702900418, "uuid": "039a18c0-a5d5-4d7b-8363-58bfeacfa3de", "value": "RQ-2023-E042.pdf.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be76a317-9dff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702943223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943223, "uuid": "d4d15b4e-5db9-4b15-a234-ce76716980ac", "comment": "Malware payload", "value": "b276c4714e4cddf8fb79c06a791665c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943223, "uuid": "288240d7-1561-4ec9-9f8c-13c6ab0416db", "comment": "Malware payload", "value": "f7be5ff4282b683de0799c6060a374b9c41ebae0837fbb6ad212aa90bdd57836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943223, "uuid": "35f5d600-94fb-42ad-9700-3b8fe120de58", "comment": "Malware payload", "value": "7b7ba5d44a6f00dcadfd961aef4718f1bb610c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702943223, "uuid": "98c25d4a-bc85-4f3e-ad66-b308aee13463", "comment": "Malware payload", "value": "58ab98dcf0ddf7b7d46f3df0dbd23f446b169bcfa601bb7ce34fcc2e132ae5106642c9ce1eac1b664e5370ad1b9f3f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943223, "uuid": "967315cd-b14c-4b3b-8b5e-5fe6fc2395bd", "value": "T1C3645A3C6EA044F1F5F41C33E8DDE8511455F278DE04A9AB32824ABDB9BCA92F1BE115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943223, "uuid": "0f94edff-8841-4753-b724-9454262f8759", "value": "b521c6b31b233b3fc3cd2e95b2217cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943223, "uuid": "d0d62515-7d22-47b4-a81a-fbb0ea3b710f", "value": "6144:bgdWjaWAOnL5pHeo+nKGk68vfnc8umGhO:brjvTL7wLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702943223, "uuid": "46ce475d-5403-4716-b397-14d6672b26c6", "value": 332640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702943223, "uuid": "de76b529-0182-4352-87a5-cfe7a837905b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702943223, "uuid": "d7b4c4af-46d3-45c0-9027-f5b4f73f7a0a", "value": "AXKCPRLS.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61a1582-9d82-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702889495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889495, "uuid": "589f1b7d-9cef-4257-91d4-b14803eea40d", "comment": "Malware payload (Formbook)", "value": "86ae96a903a4a4d42694747153a2a35e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889495, "uuid": "14bb83de-fd64-4293-82c1-bdeb3c6e0a53", "comment": "Malware payload (Formbook)", "value": "f94c13c34d4e91b3b078cd9cdcfa1bfaaf31d8795b2d9652253be6a0fbc92069", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889495, "uuid": "2754818a-e50c-4b71-8013-fbf9ef8a106f", "comment": "Malware payload (Formbook)", "value": "02d835e5ddd68debc87e9414b0cb17d841411b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702889495, "uuid": "92a1bfe6-1ec9-445d-9ed2-279520433de2", "comment": "Malware payload (Formbook)", "value": "eafe345819a5b6d769d2c3eb57af3ada467ad91f1aa54ad80655caf55ea078d912981e632037bc8b79d6f3eca39e1aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889495, "uuid": "56db25e6-bc06-4d6e-a957-00f113b811ec", "value": "T1FFE4230957EED337CC4F63B3F590A3121FB5211A6AD5F328DD6995F4494BF8AA20A203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889495, "uuid": "b6c33d7e-b1ed-4856-8929-4e0b81181486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889495, "uuid": "9a7e7647-85aa-4be9-a4a9-474f1e0d03f6", "value": "12288:gry0oLtry0sKGL1JjbqzPNULBa2iPwFA47aADVdyKAhtHBKrJ6UvwIpGXAMP9qoM:gpgly0UJJvqz+Ba2iPw3rDbMh/rZmGQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702889495, "uuid": "5034bc81-283e-451d-be3d-ac4a3a30fe44", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702889495, "uuid": "6e5b37b8-5360-4189-925a-dda96271a0cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702889495, "uuid": "ca570803-447b-48f2-bc10-709c4fc1c775", "value": "Payment Copy_Eur22,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4db8852-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702880178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880178, "uuid": "2d1b65a0-6fb2-4ce7-b210-be8f7223467f", "comment": "Malware payload (Smoke Loader)", "value": "4d78b11fd29aa4ef37c25d9edeb8e49c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880178, "uuid": "df5f7f7c-5b6d-43d8-a280-d9da065bd53b", "comment": "Malware payload (Smoke Loader)", "value": "fa15fc2db4846baa9558792f3758b38b686a0a933beb94e5e699c7e8c23da6f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880178, "uuid": "2c981d5e-677a-4f8d-97e6-cc415f03941f", "comment": "Malware payload (Smoke Loader)", "value": "07d1332e20dae515a224c337f85d08282acafb22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880178, "uuid": "16c181b0-d27c-460b-b3b1-5582cd812788", "comment": "Malware payload (Smoke Loader)", "value": "8a1884e1f4baf97b3eadd13d9c66864560e384349fa7f41e44075714f6178a812b17a2bbd191dd5700121a8bc9c7b3a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880178, "uuid": "7fb43ae1-6dc7-4291-8556-5a024e8f92ed", "value": "T14D44BF1232E081B1E22356758E66C7F55B2FB8654F266ACF2BC45A7E0F343D2C67131A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880178, "uuid": "203ef2a8-9d5e-40ca-85e8-f40a1b3826d3", "value": "a31f3c008619cf92274079860da735d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880178, "uuid": "a2d7d68c-3793-44d5-ad89-6a125d000bda", "value": "3072:GOCJMOG8W89PogXJdQ5ckHz0nUapuKhuST2s2wgrSEUVS+WXXgUZdxtR3hX:d5yHnwQnlrQzs2wgNXXgUZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880178, "uuid": "a7a89bd3-13e1-42e8-b6d8-d219c26bb5a1", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880178, "uuid": "b0603218-60f2-4323-a49b-6df306c08de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880178, "uuid": "ecb68ebe-63c0-4651-9adb-352dde8db1bc", "value": "4d78b11fd29aa4ef37c25d9edeb8e49c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9181d3-9dd6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702925612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925612, "uuid": "48b48970-160b-4a55-98df-6bec6b7b6fa4", "comment": "Malware payload (Formbook)", "value": "349d105141a4e4c7b5d5ca5d2a797a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925612, "uuid": "9e3ea5bf-9c6b-4c34-af25-017de9423767", "comment": "Malware payload (Formbook)", "value": "fac3a6c2d9b0a406b2dbcb2fd466e0f18e5cc7bb5ca2e0b565701a169c9f1806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925612, "uuid": "b1b8dd22-2d4d-4966-bfe3-e51c2cd58d50", "comment": "Malware payload (Formbook)", "value": "c20559ca4ca7dcdebacb6640a573279894d5cf8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702925612, "uuid": "4a68dd36-f1a0-4a08-b891-ee87e9a790bd", "comment": "Malware payload (Formbook)", "value": "37c78e90c8a8564a33e2e41cfa170f811af70c0e85481d1b8b4c655b7dcee74c0f89dd7f4b2138cfb94d08813725f8f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925612, "uuid": "577b8bf3-71e0-4592-a361-e0ac4201cfc2", "value": "T1DCE4E09C366072EFC86BCC76C9A82C64AA6064BB930BD643A45315ED9E0D9D7CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925612, "uuid": "324eb1b5-82ee-43fe-aa40-7cf33ad54d26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925612, "uuid": "cd14034a-9924-4d88-a021-4475d41c7f8d", "value": "12288:pAxiNxqB+6cNADW6eGwU33BfMpDKp66svmgQnffpi4ad3yXpAK/bd:2WxkMN+vnxsUjaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702925612, "uuid": "5d4130df-61ba-487a-a2df-de6de9093766", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702925612, "uuid": "f3702d6f-cf31-40f2-aa94-c0fe6c063968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702925612, "uuid": "51264f95-fc42-475f-b1cf-54cfbb3da147", "value": "\u00d6DEME MAKBUZU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d732277d-9dcc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702921360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921360, "uuid": "8b2d7a0e-788b-4f8e-b359-ea96a0fd66fa", "comment": "Malware payload (AgentTesla)", "value": "9929ec4f754d857a2401f732640a3c61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921360, "uuid": "093d91fb-26e7-418e-af46-872b247bb9bf", "comment": "Malware payload (AgentTesla)", "value": "fbc11b823c996b26d75e250826c73df9b6867d2bb16076b73095874e147845b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921360, "uuid": "a90b0c99-30fc-4d9b-b946-27e9ef2696f9", "comment": "Malware payload (AgentTesla)", "value": "6cab71c0294bf5bc4982a5022b31312a8e863585", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921360, "uuid": "4597faa8-b930-4315-84db-acf19ca0f6e8", "comment": "Malware payload (AgentTesla)", "value": "cbec9a865c723f0ebc3590d532c3f49273ef6a6bc056740c13c613c7ae01af6c1a51b8f9d760929c019161ac9cfbc166", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921360, "uuid": "45a42eb5-7b34-4cdf-bd00-23c096b95798", "value": "T18CA3D827B55FB1B1E6856B36C59B410C0363E782BAF3E64A784F23561B033E9CA4074B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921360, "uuid": "6b812586-2d1c-4381-b152-2675e5cb3c40", "value": "768:j20/1cyCPJmQcsmC2+vdiS8hYo8gk4nFYiBIuSWC93hxb/xeFe746FCi:j2s1bwJt2Lj8gfii3hC93hX4E4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921360, "uuid": "ca51f720-53ab-4f2d-bef3-43e614e7ef57", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921360, "uuid": "0b348f36-0179-477a-98a8-02e1214241d4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921360, "uuid": "6484ed81-ab8a-4ffc-ba81-5c1bd9fca8db", "value": "Quotation request - Form No ES0083ESP23.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79e0246-9d52-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702869016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869016, "uuid": "a282e495-14c8-408c-a8c7-24a89e4af988", "comment": "Malware payload (LummaStealer)", "value": "5d6e898b8f84dceeb3ee87d9002fb410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869016, "uuid": "a7495090-9a0d-432f-b358-f6823f1d81e7", "comment": "Malware payload (LummaStealer)", "value": "fc1af115d47f4f6f00b3c2a06c64b4b580b76a16f8e1c122670ced300f4abf57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869016, "uuid": "de878713-d154-4962-a515-a3d6c7af44be", "comment": "Malware payload (LummaStealer)", "value": "02b5f37971ee1ffd68bf748f09f9d7c581de8907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702869016, "uuid": "f6b7d69c-6e6c-4866-92d0-20a4b5dd1224", "comment": "Malware payload (LummaStealer)", "value": "10ae5ed3dc384b9426bbe0f9857fe21cab7c5fb16ff52df393fe99764e8ed90b2b412e7e1e62bfcca20ba432df9aa7a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869016, "uuid": "69e40c21-d967-47cd-ab2e-1317a990794d", "value": "T1DB063313E3D14049DCA9377042F3138729207DA654794A5FA38CAA9E48B7CA4AF653FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869016, "uuid": "10f2c273-5a8a-42db-a2ec-4ada8970611e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869016, "uuid": "a399a76a-dc0f-4494-9127-4673f5703fdb", "value": "98304:hjBhleixKsyEmLl+ylqiSxcmni/uDEPnJWc6iw:5Neicsy1459niuEPnJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702869016, "uuid": "47565de6-24c5-4144-9976-9f23df55eb7d", "value": 3778048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702869016, "uuid": "b40fd6b6-243a-4f0e-8590-3c6d3679e46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702869016, "uuid": "cedd342d-cfd3-41f2-a1cf-2ab54c663c12", "value": "5d6e898b8f84dceeb3ee87d9002fb410.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9438db8-9d6c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1702880132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880132, "uuid": "bed2c73a-90d8-48c1-9e20-5a8d66cdb497", "comment": "Malware payload (SnakeKeylogger)", "value": "3dff19e34ed9a7f7ccc7d64000884890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880132, "uuid": "36263cfc-7ac9-46d8-8147-559c8d8a9d8b", "comment": "Malware payload (SnakeKeylogger)", "value": "fccac8700366b9cf48eafc5c012a1616534d26fc6501d4014e56a0619d5d0db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880132, "uuid": "5fc41f16-0c7a-4aa4-9a2a-7b9d7836d7b6", "comment": "Malware payload (SnakeKeylogger)", "value": "70260264fa675af06d320ed289e8513d4a0d3344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702880132, "uuid": "9f32a6c2-2d48-4784-8494-96659c6f08b6", "comment": "Malware payload (SnakeKeylogger)", "value": "913f74ec230887abf7f3e46179bb531b9a3ef3758d5d428d71e367f18e6546115441b7eecfd301c5ba3ec835a33fc3a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880132, "uuid": "a35c652f-6279-41a0-9cb6-01c753fb334b", "value": "T132F4B23C49BE223796B5C6A5CBEC8827F05CA46F3151AD7594DBC3A603C6E4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880132, "uuid": "31c3f910-a022-431f-b3f0-dbfad163a94b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880132, "uuid": "cf5e2249-62b0-4e14-b86c-13289222976a", "value": "6144:152RKZ/DhvC7+a0Yu4GLtf0uGizuwhZfaq0Re1K9XoiNZKspgeJNwkKTZlrzV0UX:152R7XCGiiZqoeoNNgI36vrB0gGwJjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702880132, "uuid": "b3106f93-f3c2-4dc7-9aee-f6b9944877a6", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702880132, "uuid": "43b26d95-b411-4cbc-b3cf-5481fd93119c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702880132, "uuid": "7eefa3fb-cb87-4fc5-872d-b1711395318b", "value": "KSA-PDA_17122023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346e6421-9dcd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1702921516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921516, "uuid": "dac09db9-8e5e-4c1f-8abb-9fb5d912ba00", "comment": "Malware payload (Arechclient2)", "value": "0947fab2dc35b66694760c51d7073ed5", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921516, "uuid": "99b68c37-bd86-49c1-83d0-ee1699584eed", "comment": "Malware payload (Arechclient2)", "value": "fd927c3c6a733cab18a4f657a605682c6d043728442d0d2fe4dd1d464fb0d7ec", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921516, "uuid": "a715918b-3075-457b-b1e0-4ae58535fe7a", "comment": "Malware payload (Arechclient2)", "value": "3e2cd6875db025c07280166bdf038c872d9c9d03", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702921516, "uuid": "c5d35fe8-524f-49a0-a42b-d00fdd94dcf5", "comment": "Malware payload (Arechclient2)", "value": "54db0b7f019f072e3c36ae6344213f1c3b8ce737927032745d5db01586641f1224bcf0b6d202ca7479f48c1e3ee8b04d", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921516, "uuid": "2a71274e-4a9a-4bb5-bc36-f8492f149e6b", "value": "T1D9468D027F50AB16F44D5137E9DE480903F4E8693692F7AB29B8323D58413637C9ADEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921516, "uuid": "a86901ec-28c4-4801-909c-1562c4320a23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921516, "uuid": "81024d87-e33e-44b5-b2be-fc94af58c5ef", "value": "98304:ZjwIyFNlPJuU+YTrn2RILFifv6T4WLeUcP48MppHlAnB:dyFN7uU+YfzJifm4xUoMjlmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702921516, "uuid": "46a719bb-b851-41a9-87e5-0bd707e63c46", "value": 5646416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702921516, "uuid": "9681a1a3-7772-45de-b862-6135fc4b3552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702921516, "uuid": "a4d09433-c69a-4f94-9c8f-92925e270418", "value": "0947fab2dc35b66694760c51d7073ed5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fc343c-9d43-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702862430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702862430, "uuid": "51537a57-2f37-4c20-9c40-61723526336b", "comment": "Malware payload (Mirai)", "value": "5f35f7bbd92da6d07887336c62872173", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702862430, "uuid": "72dfc1c4-7dd6-4877-99b7-8d1acc179b7b", "comment": "Malware payload (Mirai)", "value": "fdf4138070ce0f6432bd72906557d509bb275dcdcdf4f1439d95b173b77258b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702862430, "uuid": "11bd73b1-bcee-4ece-bb1e-82dff33115c0", "comment": "Malware payload (Mirai)", "value": "44e3e612914953f25b162bb83bf76884a880dce8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702862430, "uuid": "6f2a521d-c4ca-49fa-bc48-e2699d7f8947", "comment": "Malware payload (Mirai)", "value": "f2dfb39726baef8ec9668be84881cb1cd372d55822f22e07c2f90881b92f89c4eea23ed8ed9bba8558cbd403baa33550", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702862430, "uuid": "57775a13-fc70-42f1-ada9-d7481a422746", "value": "T10012CFA12F122382E512EFB47BDC342BD46D4635709C9A117669868BC06E31C087F26E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702862430, "uuid": "6629d46a-1875-4216-ae40-71628fe28320", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQG2tdR:yb2eX3zAKuiNPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702862430, "uuid": "4417a9f8-32bb-4ab6-ba97-57dcf5aa673c", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702862430, "uuid": "ce8facaf-31af-4c78-ab18-5d9bce59fe04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702862430, "uuid": "369a3328-fe65-494f-8874-dd06988cdac1", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.FSO.4102.3909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee76d228-9dac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702907655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907655, "uuid": "e56aaa7e-5c4b-4915-bf26-57218dcddfd7", "comment": "Malware payload (AgentTesla)", "value": "b647085602dc692a7832f58ce040bc2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907655, "uuid": "88e71be7-7cdf-4521-9fbd-857b7ce6b45c", "comment": "Malware payload (AgentTesla)", "value": "fe631848ec9e5b0eb6675e44eee3d3bfc17bc4c2a1669842ab02303e748a85e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907655, "uuid": "41878c60-547d-41f1-9dc0-ec1e3c2620de", "comment": "Malware payload (AgentTesla)", "value": "f2178f8dbaa4fd23e4d16aba277a5a5248afe54c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702907655, "uuid": "66eff76e-14a2-4f13-adba-0ac58b0b678a", "comment": "Malware payload (AgentTesla)", "value": "35030153650bfce1e58b24411a9f784e549f9247e03902fcabdcf59def644329e5ff5100b10bcb6e6ce561643dc090c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907655, "uuid": "4bf8621e-b207-41e3-b746-a3f6c2390d17", "value": "T1A215E33C49BE223BD6B5C6B58BEC8827F05CA46F3150AD6594DBC36613C6E4274E322D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907655, "uuid": "d74fdac7-6747-45bc-a42a-4f1831c73464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907655, "uuid": "4fabbb94-03e0-47d3-a833-e77ee6545dd3", "value": "12288:bFfwEx2iNRkj4qKWx34dv4NTNYfXK8AoForH1sLcbxpa+YgA70gqhBdnra8:xwk1PkUU34dvMW6oFSsLcbfA7RiU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702907655, "uuid": "843bd70e-c0cd-46a9-bee0-93aa9500f221", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702907655, "uuid": "6ca51a7f-ee9a-4325-ac6d-04e370584524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702907655, "uuid": "3b03e110-f53a-4977-baf4-bfcd4729f3b6", "value": "payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a243ec1f-9daf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702908816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908816, "uuid": "d7119a14-43a1-4181-854e-71cd1241e748", "comment": "Malware payload (Formbook)", "value": "625691727a4263f4fcd27e82b9fd6fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908816, "uuid": "92113c59-fffd-4265-97d8-8de5bb1a2d47", "comment": "Malware payload (Formbook)", "value": "fe708d845a9c3e6d3338b2a146a4a5e68fe05d448b72a63bd60f4b431b243d9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908816, "uuid": "9c061cc1-d2e6-4f9b-a34d-386e9755477d", "comment": "Malware payload (Formbook)", "value": "623bd6c72802eaaf28a5857d21badfb7148de3ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702908816, "uuid": "31f01a28-0cb8-485d-8e89-ebbc77bb1c0e", "comment": "Malware payload (Formbook)", "value": "2b633a82cac3ee1cef21842d0c9a518eb550f6b96d822b739e478ccdad22c4d0109323964ef4e3441f55b7d060230e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908816, "uuid": "06f42d1b-471a-40b7-bb54-36b716af14a3", "value": "T182F423853318EEBBDB4443B45CB685C2C3AEE237B9A0E18E7CC9D7AF3CA23544555246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908816, "uuid": "aec63900-769d-4c6f-b88b-fbb1d11676c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908816, "uuid": "473139b3-c81e-4857-acf5-81277285fa39", "value": "12288:d6wEx2iNOXoad2i+hDZeYY8ezIX2D+D1SKA4o1akUSVj8lcGDesHMTqDvK5GQPAD:wwk18XXdPWDZeJYXnJ81akyMTmKIuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702908816, "uuid": "1ee8de48-b76e-4e61-9888-8eb537eab8a9", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702908816, "uuid": "f12fdd32-9f52-4e8b-81d0-aa41dbcdcfe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702908816, "uuid": "ff298f1a-2a4b-48eb-8f13-768ea119900d", "value": "Mokejimas,jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }